Apache APISIX

Traffic entering a microservice platform has to be routed, authenticated, limited and observed somewhere. Apache APISIX is the gateway that does it, in real time, and it handles north-south traffic from clients as readily as east-west traffic between services or the job of a Kubernetes ingress controller.

It is built on NGINX and etcd, which is what allows routes, upstreams, certificates and plugins to change without a restart. Configuration goes through an Admin API, nodes are stateless, and a standalone mode reads route rules from a local YAML file instead.

Most of the capability arrives as plugins.

• Traffic control: load balancing, health checks, circuit breaking, traffic splitting, canary releases and request mirroring.
• Protocols: TCP and UDP proxying, gRPC and gRPC Web, gRPC transcoding, Dubbo, MQTT, WebSocket and HTTP/3 with QUIC.
• Security: key, JWT and basic auth, Keycloak and Casbin authorization, IP and referer lists, CORS, CSRF and rate limiting.
• AI gateway: route to several LLM providers behind one interface, with fallbacks and token-based rate limiting.
• Operations: Prometheus metrics, Zipkin and SkyWalking tracing, and discovery through Consul, Nacos, Eureka or Zookeeper.

A quickstart script brings up the gateway and its etcd store from one command on any Docker host, listening on port 9080 with the Admin API on 9180. APISIX runs from bare metal to Kubernetes, supports ARM64, and reports 18k QPS per core at under 0.2 milliseconds of average delay.