Ambassador Technology Intelligence

What is Ambassador/Emissary-ingress?

Ambassador (now Emissary-ingress) is a Kubernetes-native API gateway built on Envoy Proxy. It provides developers with a self-service approach to configuring edge traffic management, including routing, authentication, rate limiting, and TLS termination.

Emissary-ingress integrates deeply with Kubernetes, using Custom Resource Definitions (CRDs) for configuration. This allows developers to manage routing alongside their applications using GitOps workflows and familiar Kubernetes tools.

Detection of Ambassador/Emissary-ingress indicates Kubernetes-native API gateway deployment, commonly found in organizations practicing DevOps and GitOps where developer self-service and Kubernetes-native tooling are priorities.

Ambassador/Emissary Features

Kubernetes Native: CRD-based configuration. Native integration. GitOps ready. Declarative setup.

Envoy Powered: Full Envoy features. HTTP/2. gRPC. WebSocket. Advanced routing.

Authentication: JWT validation. OAuth2. External auth. Single sign-on. API keys.

Rate Limiting: Global limits. Per-user limits. Per-route limits. Distributed rate limiting.

Traffic Management: Canary releases. Traffic shifting. Header-based routing. A/B testing.

Developer Portal: API documentation. Service catalog. Developer self-service.

Ambassador Use Cases

Kubernetes Ingress: Edge gateway. External traffic. TLS termination. Load balancing.

API Gateway: API management. Authentication. Rate limiting. Request transformation.

Developer Platform: Self-service routing. GitOps workflow. Automated deployments.

Canary Deployments: Traffic shifting. Progressive rollouts. Feature flags. A/B testing.

Microservices: Service routing. Header-based routing. Path routing. Timeout management.

gRPC Gateway: gRPC-Web. gRPC transcoding. Protocol bridging. Binary traffic.

Ambassador Configuration Examples

Mapping CRD

apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: user-service
spec:
  hostname: api.example.com
  prefix: /users/
  service: user-service:8080
  timeout_ms: 5000
  retry_policy:
    retry_on: "5xx"
    num_retries: 3

Rate Limiting

apiVersion: getambassador.io/v3alpha1
kind: RateLimit
metadata:
  name: api-rate-limit
spec:
  domain: ambassador
  limits:
    - pattern:
        - generic_key:
            generic_key: default
      rate: 100
      unit: minute

Authentication

apiVersion: getambassador.io/v3alpha1
kind: AuthService
metadata:
  name: authentication
spec:
  auth_service: "auth-service:3000"
  path_prefix: "/auth"
  allowed_request_headers:
    - "Authorization"

Ambassador Benefits

Kubernetes Native: CRDs. Native integration. Familiar tooling. GitOps compatible.

Envoy Foundation: Battle-tested proxy. High performance. Rich features. Active development.

Developer Self-Service: Decentralized config. Team ownership. Reduced bottlenecks.

Progressive Delivery: Canary deployments. Traffic shifting. Safe rollouts. Easy rollbacks.

CNCF Project: Open governance. Community driven. Wide adoption. Long-term support.

Observability: Built-in metrics. Tracing support. Logging. Full visibility.