Zuul — Dynamic API Gateway by Netflix

Introduction

Zuul is an API gateway developed by Netflix that sits at the front door of all requests entering the Netflix streaming infrastructure. It handles dynamic routing, load balancing, authentication, and monitoring for backend microservices, processing billions of requests daily in production.

What Zuul Does

• Routes incoming requests to backend microservices based on configurable rules
• Applies pre-route, route, and post-route filters for cross-cutting concerns
• Provides connection pooling, retries, and circuit-breaking for backend resilience
• Supports request throttling, authentication, and IP-based access control
• Enables canary testing and traffic shaping through dynamic filter deployment

Architecture Overview

Zuul 2 is built on a non-blocking, event-driven architecture using Netty for I/O. Incoming requests pass through a filter chain: inbound filters handle authentication and rate limiting, endpoint filters route to backends, and outbound filters modify responses. Filters are written in Java or Groovy and can be deployed dynamically without restarts. Service discovery integrates with Eureka or other registries. The connection manager pools persistent connections to backend services with configurable timeouts and retry policies.

Self-Hosting & Configuration

• Build from source using Gradle with Java 11+ required
• Configure routing rules via properties files or dynamic configuration stores
• Integrate with Eureka, Consul, or static server lists for service discovery
• Deploy behind a load balancer (ELB, Nginx) for TLS termination
• Write custom filters in Java or Groovy for authentication, logging, or transformation

Key Features

• Non-blocking I/O architecture handles high concurrency with low resource usage
• Dynamic filter deployment allows routing changes without gateway restarts
• Built-in integration with Netflix Eureka for service discovery
• Request passport tracking provides detailed latency diagnostics per request stage
• Battle-tested at Netflix scale handling billions of daily API requests

Comparison with Similar Tools

• Kong — plugin-based API gateway with a broader ecosystem but requires a datastore
• Traefik — automatic service discovery and Let's Encrypt, simpler configuration
• Spring Cloud Gateway — reactive Spring alternative that replaced Zuul 1 in the Spring ecosystem
• Envoy — high-performance L4/L7 proxy, more focused on service mesh than API gateway
• APISIX — Nginx + Lua gateway with plugin architecture and dashboard

FAQ

Q: Should I use Zuul 1 or Zuul 2? A: Zuul 2 is the current version with non-blocking Netty architecture. Zuul 1 used a blocking Servlet model and is no longer actively developed.

Q: How does Zuul compare to Spring Cloud Gateway? A: Spring Cloud Gateway replaced Zuul 1 in the Spring Cloud ecosystem and uses Project Reactor. Zuul 2 is Netflix's independent solution with different filter architecture.

Q: Can Zuul handle WebSocket connections? A: Zuul 2 supports WebSocket proxying through its push connection handling, though configuration requires additional setup.

Q: Is Zuul still maintained? A: Yes. Netflix continues to use and maintain Zuul 2 internally. The open-source repository receives regular updates.

Sources

• https://github.com/Netflix/zuul
• https://netflixtechblog.com/