APISIX
OrchestrationApache APISIX is a dynamic API gateway built on top of Nginx and etcd (or standalone mode with a local config), written in Lua on the OpenResty stack.
What it is
Apache APISIX is a dynamic API gateway built on top of Nginx and etcd (or standalone mode with a local config), written in Lua on the OpenResty stack. It sits in front of your services and handles routing, load balancing, authentication, rate limiting, observability, and traffic control — the usual gateway job list — but with a plugin architecture that lets you hook into the request lifecycle without patching core code. It also ships a Kubernetes Ingress controller variant for those running it as cluster-native ingress rather than a standalone edge gateway.
Category-wise it's Orchestration & Management: this is infrastructure plumbing, not an app you build features in.
Who builds it and why
APISIX is an Apache Software Foundation project (originally donated by Chinese cloud vendor API7.ai). It's built by a distributed community rather than a single vendor payroll, with 507 contributors on record — a healthy number that suggests real diffusion of ownership, not one company's engineers checking boxes. API7.ai remains the commercial entity most closely tied to the project and sells a managed/enterprise version, which is the usual open-core motive: build community adoption, monetize the operational complexity later.
CNCF maturity status is not publicly available in the data we have, so don't assume graduated/incubating status without checking the CNCF landscape directly.
Production readiness signal
The numbers here are solid, not spectacular. 16,797 GitHub stars is respectable for a gateway but well behind Kong or Envoy-adjacent projects in raw mindshare. What matters more: 507 contributors and a last commit dated 2026-07-01 (i.e., actively maintained, no signs of abandonment), plus a release cadence that's reached 3.17.0 — meaning it's well past 1.0 growing pains and iterating on a mature base. Apache-2.0 licensing removes any license-risk conversation.
The Lua/OpenResty core is battle-tested technology (it's the same lineage as Nginx-based gateways used at massive scale elsewhere), so the runtime risk is low even if APISIX-the-project is newer to your stack than Nginx itself.
What's missing from public data: founding date and an official maturity tier. If you're doing vendor risk assessment, get those answers directly from the CNCF TOC page and API7.ai before signing anything.
Who should use this
- Teams that need a gateway with a real plugin ecosystem (auth, transformation, observability) and want to write custom plugins in Lua without forking core.
- Platform teams standardizing on etcd already, since APISIX's dynamic config model is built around it.
- Organizations wanting Kubernetes-native ingress with more gateway features than a bare Ingress-nginx controller, without going straight to a full service mesh.
- Teams comfortable operating OpenResty/Lua-based infrastructure, or willing to learn it.
Who should NOT use this
- Teams with zero Lua/OpenResty experience and no appetite to gain it — troubleshooting custom plugins or edge-case Nginx behavior will require that knowledge eventually.
- Shops already deep in Envoy-based tooling (Istio, Contour, Gloo) — introducing a second, architecturally different proxy adds operational surface for no clear win.
- Small teams that just need basic ingress and nothing more — Ingress-nginx or Traefik is less to operate and reason about.
- Anyone requiring a fully managed, vendor-supported SLA out of the box on pure open source — you'll end up talking to API7.ai anyway, so factor that into the decision now rather than later.
Alternatives
- Kong — larger ecosystem and longer market presence, also open-core with a heavier enterprise sales motion.
- Envoy / Istio Gateway API — better fit if you're already mesh-centric or need xDS-based dynamic config at scale.
- Traefik — simpler operational model, strong Kubernetes-native defaults, smaller plugin surface.
Pricing
Apache APISIX itself is fully open source (Apache-2.0), no license cost, no feature gating in the core project. API7.ai sells a commercial distribution/cloud offering with enterprise support and additional features — pricing for that is not publicly available and requires direct vendor contact.