https://blog.none.at Production notes on Kubernetes, OpenShift, and OVHcloud: observability, log archiving, service mesh, LLM inference, and digital sovereignty. Zola en Thu, 25 Jun 2026 00:00:00 +0000 Thu, 30 Apr 2026 00:00:00 +0000 aleks https://blog.none.at/blog/2026/2026-04-30-istio-vs-envoy-gateway/ https://blog.none.at/blog/2026/2026-04-30-istio-vs-envoy-gateway/ <p>Both <a rel="noopener external" target="_blank" href="https://istio.io">Istio</a> and <a rel="noopener external" target="_blank" href="https://gateway.envoyproxy.io">Envoy Gateway</a> implement the <a rel="noopener external" target="_blank" href="https://gateway-api.sigs.k8s.io">Kubernetes Gateway API</a> and use Envoy as their data plane. That is roughly where the similarity ends. Istio is a full service mesh that happens to implement Gateway API; Envoy Gateway is a dedicated Gateway API controller with no mesh ambitions. Choosing between them is mostly a question of scope.</p> <p>This post starts with that comparison — architecture, mTLS, egress control, and resource overhead — then broadens to cover <a rel="noopener external" target="_blank" href="https://cilium.io">Cilium</a> as a lighter alternative for East-West security, how the choice plays out on managed Kubernetes offerings (AKS, GKE, and OVH MKS including their cloud-native ingress and egress options), and finally how to get the real client IP through a cloud load balancer to your application.</p>