Route everything.
Break nothing.
krouter is a Kubernetes-native gateway built on the official Gateway API: it routes HTTP, gRPC, TCP, UDP and TLS without ever dropping a connection.
710
Gateway API conformance checks
0
custom CRDs to learn
10,000
live connections held across reloads
Why teams pick krouter
Standards first, no lock-in
Built on pure Gateway API: your Gateways and Routes stay portable Kubernetes resources. Even the extras (rate limiting, WAF) ride the standard ExtensionRef filter and plain ConfigMaps, so there are still no custom CRDs holding your YAML hostage.
Hitless by design
Configuration changes apply atomically. Ten thousand live connections survive every reload and certificate rotation, and a release gate proves it, every time.
Five protocols, one gateway
HTTP, gRPC, raw TCP, UDP and TLS (passthrough or terminated) through the same data plane DaemonSet. No sidecars, no per-gateway proxy deployment to babysit.
Proof, not promises
Every build ships with the full official conformance report: 710 checks, zero failures. Read the latest report (we publish it as-is).
See your traffic
A live dashboard is built in: gateways, routes and backends as an always-current topology map, with degraded paths highlighted before your users notice.
Secure at both ends
Terminate TLS, validate client certificates and re-encrypt to backends with SAN-verified policies, then shield routes with a built-in WAF (OWASP Core Rule Set) and per-route rate limiting: defence in depth, configured entirely through standard resources.
How krouter compares
An honest look at what krouter does (and deliberately does not do) next to other Gateway API implementations.
| Feature | krouter | Envoy Gateway | NGINX Gateway Fabric | Traefik | Istio |
|---|---|---|---|---|---|
| Gateway API | |||||
| Core conformance (HTTP, GRPC, TLS, TCP, UDP profiles) | ✓ | ✓ | ◐ | ◐ | ✓ |
| Every non-mesh Extended conformance test | ✓ | ◐ | ◐ | ◐ | ◐ |
| TCPRoute, UDPRoute, TLSRoute | ✓ | ✓ | ◐ | ◐ | ✓ |
| ListenerSet (merged listeners) | ✓ | ◐ | — | — | — |
| BackendTLSPolicy (incl. SAN validation) | ✓ | ✓ | ◐ | — | ◐ |
| Client certificate validation (frontend mTLS) | ✓ | ✓ | — | ✓ | ✓ |
| CORS filter | ✓ | ✓ | — | ✓ | ✓ |
| Operations | |||||
| No custom CRDs required | ✓ | — | — | — | — |
| Hitless reloads (proven with 10,000 live connections) | ✓ | ✓ | ◐ | ✓ | ✓ |
| Built-in live topology dashboard | ✓ | — | — | ✓ | ◐ |
| Conformance report published with every build | ✓ | ◐ | ◐ | ◐ | ◐ |
| Security | |||||
| Rate limiting | ✓ | ✓ | — | ✓ | ✓ |
| Web application firewall (built-in OWASP CRS) | ✓ | ◐ | — | ◐ | ◐ |
| Client IP from trusted proxies (X-Forwarded-For) | ✓ | ✓ | ✓ | ✓ | ✓ |
| PROXY protocol (client IP on raw TCP) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Authentication / authorization policies | ✓ | ✓ | — | ✓ | ✓ |
| Beyond krouter's scope | |||||
| Service mesh (east-west traffic) | — | — | — | — | ✓ |
| Retries and circuit breaking | — | ✓ | — | ✓ | ✓ |
| Active backend health checks | — | ✓ | — | ✓ | ✓ |
✓ supported · ◐ partial or via vendor extensions · — not provided. Based on each project's public documentation as of July 2026; always check upstream for the latest state.
Up and running in three commands
1 · Install the Gateway API CRDs
kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.2/standard-install.yaml2 · Deploy krouter
kubectl apply -f https://raw.githubusercontent.com/link-society/krouter/main/k8s/krouter.yaml3 · Create your first Gateway
kubectl apply -f my-gateway.yaml
# then follow the tutorials!