Contour — High-Performance Kubernetes Ingress Controller Using Envoy

What it is

Contour is a Kubernetes ingress controller that uses Envoy proxy as its data plane. It provides a custom HTTPProxy CRD that goes beyond standard Ingress with features like TLS delegation, rate limiting, and weighted routing.

Contour targets platform engineers running Kubernetes who need more routing control than the standard Ingress resource provides, without the complexity of a full service mesh like Istio.

How it saves time or tokens

Contour provides advanced routing features through a single CRD instead of requiring annotations, config maps, or multiple resources. TLS certificate delegation lets teams manage their own certificates without cluster-admin access. This reduces operational overhead and support tickets.

How to use

1. Install Contour on your cluster:

# kubectl quickstart
kubectl apply -f https://projectcontour.io/quickstart/contour.yaml
# Or with Helm
helm repo add bitnami https://charts.bitnami.com/bitnami
helm install contour bitnami/contour -n projectcontour --create-namespace

1. Verify pods are running: kubectl get pods -n projectcontour.

1. Create HTTPProxy resources to route traffic to your services.

Example

# HTTPProxy with TLS and weighted routing
apiVersion: projectcontour.io/v1
kind: HTTPProxy
metadata:
  name: my-app
spec:
  virtualhost:
    fqdn: app.example.com
    tls:
      secretName: app-tls
  routes:
    - conditions:
        - prefix: /
      services:
        - name: app-v1
          port: 80
          weight: 90
        - name: app-v2
          port: 80
          weight: 10

Related on TokRepo

• DevOps Tools -- Kubernetes and infrastructure tooling
• Self-Hosted Tools -- Self-hosted infrastructure components

Common pitfalls

• Contour requires Envoy pods running alongside it. Ensure sufficient cluster resources for both Contour control plane and Envoy data plane pods.
• HTTPProxy and standard Ingress resources can conflict if both are applied to the same host. Use one or the other per domain.
• TLS certificate delegation requires the TLSCertificateDelegation resource to be created in the certificate namespace first.