91 ms·

Why not just use Istio and Knative? Also Project contour can do the same as an api Gateway. What's the difference?

zinclozenge 6y ago
Can Contour actually do the same? For me, the main benefit of an API gateway is being able to specify an internal service to handle authn/authz. With Envoy that's done via a filter, iirc. Can you set that Envoy specific config with Contour?
- iampims 6y ago
  you can't. See GH issue: https://github.com/projectcontour/contour/issues/432 https://github.com/projectcontour/contour/issues/432
base698 6y ago
Istio is fairly resource intensive in my limited use. Contour is a bit simpler to configure and use with overlap. Gloo has lots of other features, like WAF and Webassembly hooks for request flow.
ceposta07 6y ago
Contour is not an API Gateway. Disclaimer: I work for Solo.io An API Gateway can do sophisticated edge security challenges (OIDC, Authz based on OPA, web app firewalling/WAF, etc) as well as things like message transformation, swagger/grpc detection, exposing APIs for self-service signup through a portal, etc. Gloo does all these things. I've written in depth about this as well, specifically in terms of things like contour, Istio ingress gateway, consul's service mesh gateway, etc, etc https://blog.christianposta.com/microservices/do-i-need-an-api-gateway-if-i-have-a-service-mesh/ https://blog.christianposta.com/microservices/do-i-need-an-a... Gloo resources: https://docs.solo.io/gloo/latest/guides/dev_portal/ https://docs.solo.io/gloo/latest/guides/dev_portal/ https://docs.solo.io/gloo/latest/guides/security/waf/ https://docs.solo.io/gloo/latest/guides/security/waf/ https://docs.solo.io/gloo/latest/guides/security/auth/oauth/google/ https://docs.solo.io/gloo/latest/guides/security/auth/oauth/... https://docs.solo.io/gloo/latest/guides/security/opa/ https://docs.solo.io/gloo/latest/guides/security/opa/ https://docs.solo.io/gloo/latest/installation/advanced_configuration/fds_mode/ https://docs.solo.io/gloo/latest/installation/advanced_confi... https://docs.solo.io/gloo/latest/guides/traffic_management/request_processing/transformations/ https://docs.solo.io/gloo/latest/guides/traffic_management/r...
- foreign-inc 6y ago
  Thanks for the detailed response. In that regard, it is like Kong. What is the difference between Kong vs Gloo? Kong is based on nginx which is rock solid.
  - ceposta07 6y ago
    Kong is mostly built on OpenResty/Lua I'd say the main reason to use Gloo is it's much simpler, it's based on Envoy which is where most of the innovation around L7 proxies is happening these days (ie, see WebAssembly), and was built from the ground up with a cloud-native and kube-native architecture. More can be found here: https://docs.solo.io/gloo/latest/introduction/others/ https://docs.solo.io/gloo/latest/introduction/others/ And I can go into much more detail on slack. I'm `ceposta` on the solo/istio/cncf/envoy/kubernetes slack

Can Contour actually do the same? For me, the main benefit of an API gateway is being able to specify an internal service to handle authn/authz. With Envoy that's done via a filter, iirc. Can you set that Envoy specific config with Contour?

iampims 6y ago
you can't. See GH issue: https://github.com/projectcontour/contour/issues/432 https://github.com/projectcontour/contour/issues/432

base698 6y ago

Istio is fairly resource intensive in my limited use. Contour is a bit simpler to configure and use with overlap. Gloo has lots of other features, like WAF and Webassembly hooks for request flow.

ceposta07 6y ago

Contour is not an API Gateway. Disclaimer: I work for Solo.io An API Gateway can do sophisticated edge security challenges (OIDC, Authz based on OPA, web app firewalling/WAF, etc) as well as things like message transformation, swagger/grpc detection, exposing APIs for self-service signup through a portal, etc. Gloo does all these things. I've written in depth about this as well, specifically in terms of things like contour, Istio ingress gateway, consul's service mesh gateway, etc, etc https://blog.christianposta.com/microservices/do-i-need-an-api-gateway-if-i-have-a-service-mesh/ https://blog.christianposta.com/microservices/do-i-need-an-a... Gloo resources: https://docs.solo.io/gloo/latest/guides/dev_portal/ https://docs.solo.io/gloo/latest/guides/dev_portal/ https://docs.solo.io/gloo/latest/guides/security/waf/ https://docs.solo.io/gloo/latest/guides/security/waf/ https://docs.solo.io/gloo/latest/guides/security/auth/oauth/google/ https://docs.solo.io/gloo/latest/guides/security/auth/oauth/... https://docs.solo.io/gloo/latest/guides/security/opa/ https://docs.solo.io/gloo/latest/guides/security/opa/ https://docs.solo.io/gloo/latest/installation/advanced_configuration/fds_mode/ https://docs.solo.io/gloo/latest/installation/advanced_confi... https://docs.solo.io/gloo/latest/guides/traffic_management/request_processing/transformations/ https://docs.solo.io/gloo/latest/guides/traffic_management/r...

foreign-inc 6y ago
Thanks for the detailed response. In that regard, it is like Kong. What is the difference between Kong vs Gloo? Kong is based on nginx which is rock solid.
- ceposta07 6y ago
  Kong is mostly built on OpenResty/Lua I'd say the main reason to use Gloo is it's much simpler, it's based on Envoy which is where most of the innovation around L7 proxies is happening these days (ie, see WebAssembly), and was built from the ground up with a cloud-native and kube-native architecture. More can be found here: https://docs.solo.io/gloo/latest/introduction/others/ https://docs.solo.io/gloo/latest/introduction/others/ And I can go into much more detail on slack. I'm `ceposta` on the solo/istio/cncf/envoy/kubernetes slack