BFE — Modern Layer 7 Load Balancer from Baidu

Introduction

BFE (Baidu Front End) is a modern, open-source Layer 7 load balancer donated to the CNCF. Originally developed at Baidu to handle massive internet-scale traffic, it provides flexible request routing, traffic management, and security features through a modular plugin architecture.

What BFE Does

• Routes HTTP and HTTPS traffic based on host, path, headers, and cookies
• Supports weighted load balancing across backend clusters
• Provides traffic mirroring, rate limiting, and circuit breaking
• Manages TLS termination with SNI-based certificate selection
• Enables canary releases and A/B testing through traffic splitting rules

Architecture Overview

BFE processes requests through a pipeline of configurable modules. Incoming connections are accepted by the network layer, passed through TLS termination, then routed by the rule engine to backend clusters. Each module in the pipeline can inspect, modify, or reject requests. Configuration is loaded from JSON files and can be hot-reloaded without restarting the process.

Self-Hosting & Configuration

• Install via go install or download prebuilt binaries from GitHub releases
• Define routing rules in JSON configuration files mapping hosts and paths to backend clusters
• Configure backend pools with health check intervals and load balancing policies
• Enable modules for WAF, rate limiting, header rewriting, and other traffic controls
• Hot-reload configuration changes without service interruption

Key Features

• Battle-tested at Baidu handling millions of requests per second
• CNCF Sandbox project with active community governance
• Modular architecture with 30+ built-in traffic management modules
• Hot-reloadable configuration without process restarts
• Built-in dashboard and detailed metrics for observability

Comparison with Similar Tools

• Nginx — config-file driven general web server; BFE uses structured JSON rules with hot reload
• Envoy — xDS API-driven service proxy; BFE offers a simpler file-based configuration model
• Traefik — auto-discovery focused; BFE provides finer-grained traffic splitting and rule-based routing
• HAProxy — TCP/HTTP proxy with config reloads; BFE adds Layer 7 rule engine and modular plugins

FAQ

Q: What scale has BFE been proven at? A: BFE was developed at Baidu to handle internet-scale traffic, serving as the primary Layer 7 entry point for one of the largest web platforms.

Q: Does BFE support Kubernetes? A: Yes, the BFE Ingress Controller integrates with Kubernetes for service routing using BFE as the data plane.

Q: Can I extend BFE with custom modules? A: Yes, BFE has a plugin interface for writing custom Go modules that hook into the request processing pipeline.

Q: How does configuration hot-reload work? A: BFE watches for changes to its JSON configuration files and applies updates atomically without dropping existing connections.

Sources

• https://github.com/bfenetworks/bfe
• https://www.bfe-networks.net/en_us/