krouter

krouter (Kubernetes Router) is a Kubernetes Gateway API implementation and HTTP/HTTPS reverse proxy. It uses standard Kubernetes resources only (no custom resource definitions), applies configuration changes without dropping connections, and embeds a live dashboard of your gateways, routes and backends.

The design, behavior and guarantees are described in the specification; user documentation and tutorials live on the website (sources in website/).

Features

How krouter compares with other Gateway API implementations (including what it deliberately does not do). Based on each project's public documentation as of July 2026 (✅ supported · ◐ partial or via vendor extensions · — not provided):

Feature	krouter	Envoy Gateway	NGINX Gateway Fabric	Traefik	Istio
Gateway API
Core conformance (HTTP, GRPC, TLS, TCP, UDP profiles)	✅	✅	◐	◐	✅
Every non-mesh Extended conformance test	✅	◐	◐	◐	◐
TCPRoute, UDPRoute, TLSRoute	✅	✅	◐	◐	✅
ListenerSet (merged listeners)	✅	◐	—	—	—
BackendTLSPolicy (incl. SAN validation)	✅	✅	◐	—	◐
Client certificate validation (frontend mTLS)	✅	✅	—	✅	✅
CORS filter	✅	✅	—	✅	✅
Operations
No custom CRDs required	✅	—	—	—	—
Hitless reloads (proven with 10,000 live connections)	✅	✅	◐	✅	✅
Built-in live topology dashboard	✅	—	—	✅	◐
Conformance report published with every build	✅	◐	◐	◐	◐
Security
Rate limiting	✅	✅	—	✅	✅
Web application firewall (built-in OWASP CRS)	✅	◐	—	◐	◐
Client IP from trusted proxies (X-Forwarded-For)	✅	✅	✅	✅	✅
PROXY protocol (client IP on raw TCP)	✅	✅	✅	✅	✅
Authentication / authorization policies	✅	✅	—	✅	✅
Beyond krouter's scope
Service mesh (east-west traffic)	—	—	—	—	✅
Retries and circuit breaking	—	✅	—	✅	✅
Active backend health checks	—	✅	—	✅	✅

Prerequisites

• A recent Go toolchain (see go.mod)
• Task (all automation goes through it)
• Docker (container image builds)
• kind and kubectl (local test cluster)
• Python with PDM (end-to-end test suites only)
• Helm (comparative benchmarks only)

task --list is the authoritative list of available commands.

Building

task build         # compile the krouter binary
task docker:build  # build the container image

Deploying

krouter requires the Gateway API CRDs (Standard channel) to be installed first; its own manifest deliberately does not install them.

For a local kind-based environment:

task k8s:up      # create the cluster and install the Gateway API CRDs
task k8s:deploy  # build the image, load it, apply the static manifest

For any other cluster, install the Gateway API CRDs and apply the static installation manifest from the k8s directory with kubectl apply. Everything (namespace, RBAC, control-plane Deployment, data-plane DaemonSet, dashboard Service) is contained in that single manifest, as required by the deployment specification.

Trying it out

A self-contained example topology is provided: one Gateway serving HTTP, gRPC, TCP, UDP and TLS-passthrough routes, backed by real mock services (httpbin, tcpbin, udpbin, grpcbin, built from tests/mocks):

task k8s:serve  # build + load the mock images, deploy the demo, forward the dashboard

Then open http://localhost:8080 to explore the demo Gateway, its routes and backends in the dashboard. The header of tests/config/mocks/manifest.yml lists ready-to-paste curl, grpcurl and nc commands to exercise every route from the host.

Testing

Unit, end-to-end, official Gateway API conformance, performance-gate and comparative benchmark suites are documented in tests/README.md:

task tests:unit
task tests:e2e
task tests:conformance
task tests:performance
task tests:bench:all
task tests:report  # all suites + combined HTML/JUnit report

License

krouter is released under the MIT License.