Emissary Ingress — Kubernetes-Native API Gateway on Envoy

What it is

Emissary Ingress (formerly Ambassador API Gateway) is a Kubernetes-native API gateway built on top of Envoy Proxy. It uses Custom Resource Definitions (CRDs) to configure routing, rate limiting, TLS termination, and authentication without restarting the proxy.

Emissary is designed for teams running microservices on Kubernetes who need a developer-friendly, GitOps-compatible ingress layer. It handles HTTP and gRPC traffic routing, canary releases, and traffic shifting through declarative Kubernetes manifests.

How it saves time or tokens

Emissary eliminates the complexity of manually configuring Envoy Proxy. Instead of writing Envoy YAML configurations and managing hot-reloading, you declare routing rules as Kubernetes CRDs. Changes apply automatically without proxy restarts. The Mapping CRD maps URL paths to services in a single resource definition, replacing the multi-file Ingress + Service + upstream configuration pattern. Integration with cert-manager provides automatic TLS certificate provisioning and renewal.

How to use

1. Install Emissary Ingress via Helm:

helm repo add datawire https://app.getambassador.io
helm install emissary datawire/emissary-ingress \
  -n emissary --create-namespace

1. Create a Mapping to route traffic to your service:

apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: my-service
spec:
  hostname: 'api.example.com'
  prefix: /api/
  service: my-service:8080

1. Apply the mapping and verify traffic routing:

kubectl apply -f mapping.yaml
kubectl get mappings

Example

Configuring rate limiting and authentication for an API endpoint:

apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: protected-api
spec:
  hostname: 'api.example.com'
  prefix: /api/v1/
  service: backend-api:8080
  labels:
    ambassador:
      - request_label_group:
        - api-rate-limit:
            header: 'Authorization'
---
apiVersion: getambassador.io/v3alpha1
kind: RateLimitService
metadata:
  name: rate-limit
spec:
  service: rate-limit-service:8081
  protocol_version: v3

Related on TokRepo

• DevOps tools — More Kubernetes and infrastructure tools on TokRepo.
• AI gateway providers — Compare API gateway solutions for AI and microservices.

Common pitfalls

• Forgetting to create a Host CRD alongside Mappings causes TLS to not work. Define Host resources with your domain and TLS configuration before creating Mappings.
• Using prefix-based routing without trailing slashes can match unintended paths. Be explicit with prefix values and use regex_prefix for complex matching.
• Not setting resource limits on the Emissary pods leads to Envoy consuming excessive memory under high traffic. Always configure CPU and memory limits in the Helm values.