Higress

What it is

Higress is a cloud-native API gateway built on Envoy and Istio's control plane architecture. It functions as a Kubernetes Ingress controller, API gateway, and microservice gateway in one binary, with native support for the Kubernetes Gateway API alongside the older Ingress API. It's built in Go, distributed under Apache-2.0, and originated from Alibaba's internal gateway infrastructure before being open-sourced.

Beyond standard gateway duties (routing, TLS termination, rate limiting, canary releases), Higress has leaned hard into WASM plugin extensibility and, more recently, AI gateway functionality — token-based rate limiting, LLM provider routing/fallback, and request/response transformation for model APIs. That AI-gateway pivot is the main thing differentiating it from older-generation ingress controllers right now.

Official project description is not publicly available beyond what's on the GitHub repo and docs site; the summary above is based on documented capabilities.

Who builds it and why

Higress came out of Alibaba, where it replaced internal gateway components handling large-scale production traffic. It's now a CNCF Sandbox project with 183 contributors — a healthy number for sandbox stage, suggesting real usage beyond a single corporate sponsor, though Alibaba engineers still appear to drive the bulk of core architecture decisions. Founding date is not publicly available, but the Istio/Envoy control-plane lineage and Alibaba branding in early commits point to internal use predating open-sourcing.

The motivation is straightforward: Alibaba needed a gateway that could handle Ingress, API management, and (increasingly) AI traffic without stitching together three separate tools. Open-sourcing it is both a community play and a way to battle-test the project outside Alibaba's own traffic patterns.

Production readiness signal

8,761 GitHub stars and 183 contributors is a solid signal for a sandbox-stage CNCF project — this isn't a weekend side project. Latest release is v2.2.3, indicating a maturing versioning cadence past initial 1.x churn. Commit activity through mid-2026 shows the project is actively maintained, not abandoned.

That said, CNCF Sandbox is the earliest maturity tier — no CNCF-level security audits or graduation-level governance guarantees yet. Treat it the way you'd treat any pre-Incubation project: check the issue tracker for your specific use case, pin versions, and don't assume long-term API stability across major releases.

Who should use this

• Teams already running Istio or Envoy-based infrastructure who want Ingress, API gateway, and service mesh gateway consolidated into one control plane instead of three.
• Teams building LLM-facing infrastructure who need token-aware rate limiting, multi-provider routing, and fallback logic at the gateway layer rather than bolted onto application code.
• Organizations comfortable operating CNCF Sandbox-tier software and willing to contribute upstream when they hit edge cases.
• Teams wanting WASM-based custom plugin logic without forking Envoy directly.

Who should NOT use this

• Teams wanting a boring, "it just works" Ingress controller with minimal moving parts — ingress-nginx or Traefik will get you there with far less operational surface area.
• Organizations with strict vendor-maturity requirements (regulated industries, formal procurement processes) that mandate CNCF Incubating/Graduated status.
• Teams without existing Envoy/Istio operational knowledge — the learning curve is real, and troubleshooting requires understanding the underlying control plane, not just Higress's config layer.
• Anyone needing guaranteed long-term commercial support contracts — this is community-driven, not vendor-backed with SLAs.

Alternatives

• Envoy Gateway — a more minimal, CNCF-native implementation of the Gateway API directly from the Envoy project, less opinionated than Higress.
• Kong — API gateway with a larger commercial ecosystem, plugin marketplace, and enterprise support options if you need vendor backing.
• Traefik — simpler Ingress controller/API gateway, easier operational model, weaker on AI-specific routing features.

Pricing

Fully open source under Apache-2.0. No paid tier, no enterprise edition disclosed. Support is community-based through GitHub issues and whatever channels the contributor base maintains — there's no visible commercial entity selling support contracts at this time.