Envoy Gateway vs kgateway vs Traefik: Best Gateway API Controller in 2026

Ingress NGINX retirement and Gateway API's rapid standardization have turned controller selection into an urgent platform decision. Envoy Gateway, kgateway, and Traefik can all implement Kubernetes Gateway API resources, but they optimize for different teams.

The short answer:

• Choose Envoy Gateway for an Envoy-native, policy-rich platform with strong extensibility.
• Choose kgateway when advanced gateway use cases and AI/API traffic are central to the roadmap.
• Choose Traefik for a simpler operational experience and teams already comfortable with Traefik.

Quick Comparison

Support changes by release. Validate the exact Gateway API conformance report and controller version before committing.

Envoy Gateway

Envoy Gateway provides a Kubernetes-native control plane for Envoy Proxy. Standard Gateway API resources cover portable routing, while typed extension policies expose authentication, rate limiting, traffic control, observability, and other Envoy capabilities.

Representative resource model:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: public
spec:
  gatewayClassName: eg
  listeners:
  - name: https
    protocol: HTTPS
    port: 443
    tls:
      mode: Terminate
      certificateRefs:
      - name: public-cert

Strengths

• Envoy's mature proxy data plane
• Typed policy attachment rather than annotation-heavy configuration
• Strong traffic-management, security, and observability extension model
• Good fit when service mesh or other Envoy infrastructure already exists

Trade-offs

• More concepts than a basic ingress controller
• Extension policies reduce portability when used heavily
• Envoy tuning and debugging skills are valuable at scale

kgateway

kgateway targets teams that need more than basic north-south routing. Its positioning is attractive for API gateway capabilities, multi-backend traffic, and emerging AI gateway requirements.

Strengths

• Gateway API-first direction
• Strong focus on extensibility and advanced routing
• Relevant roadmap for AI inference and agent traffic
• Suitable for platform teams consolidating gateway responsibilities

Trade-offs

• Advanced capability brings a larger operational and policy surface
• Teams should distinguish portable Gateway API configuration from implementation-specific policies
• Validate edition, support, and feature availability against your requirements

Choose kgateway when gateway functionality is a product owned by a platform team, not merely a way to expose a few Services.

Traefik

Traefik is widely used because its installation and day-two operations are approachable. Its Kubernetes Gateway provider supports standard Gateway API routing while retaining Traefik's dashboard and existing ecosystem.

providers:
  kubernetesGateway:
    enabled: true

Strengths

• Fast learning curve and straightforward operations
• Strong fit for teams already running Traefik
• Useful dashboard and familiar routing workflow
• Good choice for standard HTTP routing without a large policy platform

Trade-offs

• Version compatibility between Traefik and Gateway API CRDs must be checked carefully
• Experimental/standard channel transitions can require specific upgrade sequencing
• Highly specialized Envoy extensions are not available because Traefik uses its own proxy

Portability: The Detail Most Comparisons Miss

Gateway API improves portability, but only for standard resources and features. This is portable:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute

A controller-specific authentication, rate-limit, or AI policy may not be portable. Before selecting a controller, classify requirements:

1. Core Gateway API requirements
2. Extended but standardized features
3. Controller-specific policies
4. External services and operational tooling

The more configuration lands in category 3, the higher the future switching cost.

Decision Guide

Choose Envoy Gateway if

• Envoy is already a strategic data plane
• You need typed security and traffic policies
• Platform engineers will own and operate the gateway
• Extensibility matters more than minimum complexity

Choose kgateway if

• Advanced API gateway capability is a core requirement
• AI/LLM traffic management is on the near-term roadmap
• You need a gateway platform rather than only ingress
• You can invest in policy governance and operations

Choose Traefik if

• The team values operational simplicity
• You already run Traefik successfully
• Most requirements fit standard Gateway API routing
• A fast, understandable migration is more important than deep Envoy customization

Migration Checklist

Do not migrate by translating every Ingress annotation blindly.

1. Inventory IngressClasses, annotations, TLS, redirects, auth, and canaries.
2. Map requirements to standard Gateway API resources first.
3. Install controller and CRDs in a test cluster.
4. Run Gateway API conformance checks relevant to your routes.
5. Mirror or shift a small percentage of traffic.
6. Validate status conditions, metrics, logs, TLS, and rollback.
7. Move controller-specific policy only after core routes work.

Verdict

There is no universal winner. Envoy Gateway offers the cleanest Envoy-native platform foundation. kgateway is compelling for advanced API and AI gateway ambitions. Traefik is the pragmatic choice when simplicity and existing operational familiarity matter most.

Choose based on required policies and the team that will operate the gateway—not on the longest feature list.

Sources

• Gateway API v1.6 announcement and conformant implementations — https://kubernetes.io/blog/2026/08/03/gateway-api-v1-6-release/
• Envoy Gateway documentation — https://gateway.envoyproxy.io/latest/
• kgateway documentation — https://kgateway.dev/docs/
• Traefik Kubernetes Gateway provider — https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-gateway/

Proposed Internal Links

• /blog/how-to-migrate-ingress-nginx-to-gateway-api-2026
• /blog/how-to-set-up-kubernetes-gateway-api-2026
• /blog/kong-vs-nginx-vs-traefik-api-gateway-2026