Ambassador API Gateway

Ambassador API Gateway
Name	Ambassador API Gateway
Developer	Datawire
Initial release	2017
Written in	Python, Go
Operating system	Cross-platform
License	Apache License 2.0

Ambassador API Gateway Ambassador API Gateway is an open-source edge and API gateway for microservices that integrates with Kubernetes, Envoy (software), and gRPC ecosystems to provide routing, observability, and security for cloud-native applications. It was developed by Datawire to support service mesh and API management patterns used by organizations such as Netflix, Airbnb, Pinterest, and Lyft in distributed systems. Ambassador emphasizes declarative configuration via Kubernetes API objects, supports integration with platforms like Istio, Linkerd, and Consul (software), and competes with products including Kong (software), NGINX, and Traefik.

Overview

Ambassador functions as an ingress controller and API gateway tailored for Kubernetes clusters, leveraging Envoy (software) as a data plane and providing a control plane that understands Kubernetes API objects, CustomResourceDefinitions, and Helm (software) charts. It addresses challenges familiar to teams using Docker, Helmfile, Flux (software), and Argo CD by offering features for traffic routing, rate limiting, observability, and authentication. Users often evaluate Ambassador against alternatives such as Istio, Linkerd, Consul (software), AWS App Mesh, and Gloo when designing architectures for organizations like Spotify, Salesforce, Pinterest, and Shopify.

Architecture and Components

The gateway follows a control-plane/data-plane model where the control plane programs Envoy (software) proxies that act as a high-performance data plane. Key components include Ambassador CRDs implemented as Kubernetes CustomResourceDefinitions, an Ambassador control process written in Go (programming language), integration with gRPC and HTTP/2, and support for observability through adapters for Prometheus, Grafana, and Jaeger. The design is influenced by patterns used by Google, Microsoft, Amazon (company), and Facebook for large-scale distributed systems. Ambassador can be deployed alongside Istio and Linkerd or used independently with CI/CD tools like Jenkins, CircleCI, and GitLab CI.

Deployment and Configuration

Ambassador is typically installed into a Kubernetes cluster via Helm (software), kubectl, or GitOps pipelines using Argo CD or Flux (software). Configuration is expressed via CRDs such as Mappings and Hosts, which are reconciled by the control plane; teams integrating Ambassador often use Terraform, Pulumi, or Ansible for infrastructure as code. It supports canary deployments and blue/green strategies familiar from Continuous integration and Continuous delivery workflows used by companies like Spotify, Netflix, Etsy, and Airbnb. Ambassador deployments are commonly monitored with stacks based on Prometheus, Grafana, Loki (software), and Jaeger and integrated with logging systems such as Elasticsearch, Fluentd, and Splunk.

Features and Functionality

Ambassador provides routing, load balancing, TLS termination, retry policies, circuit breaking, shadowing, header manipulation, and observability hooks compatible with Envoy (software) features. It supports protocol-aware routing for HTTP/1.1, HTTP/2, gRPC, and WebSockets, and integrates with identity providers like Okta, Auth0, and Keycloak. Additional functionality includes rate limiting, authentication filters, OAuth2 flows used by Google, Facebook, and GitHub, and API lifecycle features that align with practices in organizations such as Twilio, Stripe, and Square.

Security and Authentication

Ambassador supports TLS via certificates issued by Let's Encrypt or managed by HashiCorp Vault, cert-manager, or cloud providers like Amazon Web Services, Google Cloud Platform, and Microsoft Azure. It integrates with mTLS solutions from Istio and Linkerd and supports JWT validation against issuers such as Okta, Auth0, AWS Cognito, and Azure Active Directory. Ambassador can be configured with role-based access control that complements Kubernetes RBAC and integrates with external identity providers used by enterprises like Salesforce, Microsoft Corporation, and Oracle Corporation.

Performance and Scalability

Built on Envoy (software), Ambassador benefits from Envoy's high-performance proxying, connection pooling, and HTTP/2 multiplexing originally designed by teams at Lyft and Google. Scalability patterns include horizontal pod autoscaling in Kubernetes, integration with Cluster Autoscaler, and use of service discovery mechanisms like Consul (software), enabling deployments at the scale of platforms operated by Netflix, Uber, Airbnb, and Spotify. Performance tuning often involves adjusting Envoy settings, optimizing thread pools, and leveraging observability platforms such as Prometheus and Grafana for latency and throughput analysis.

Use Cases and Integrations

Common use cases include ingress control, API gateway for microservices, gRPC proxying, service mesh edge gateway, and Kubernetes-native API management for enterprises such as Capital One, Goldman Sachs, Comcast, and Verizon. Ambassador integrates with CI/CD pipelines (e.g., Jenkins, GitHub Actions, GitLab CI), observability stacks (Prometheus, Grafana, Jaeger), secret management (HashiCorp Vault, AWS Secrets Manager), and identity providers (Okta, Auth0, Azure Active Directory). It is used in hybrid and multi-cloud architectures alongside services from Amazon Web Services, Google Cloud Platform, Microsoft Azure, and cloud-native projects such as KEDA, Cert-Manager, and Knative.

Category:API gateways