Production notes on Kubernetes, OpenShift, and OVHcloud: observability, log archiving, service mesh, LLM inference, and digital sovereignty. Zola 2026-06-25T00:00:00+00:00 https://blog.none.at/tags/gke/atom.xml 2026-04-30T00:00:00+00:00 2026-06-25T00:00:00+00:00 aleks https://blog.none.at/blog/2026/2026-04-30-istio-vs-envoy-gateway/

<p>Both <a rel="noopener external" target="_blank" href="https://istio.io">Istio</a> and <a rel="noopener external" target="_blank" href="https://gateway.envoyproxy.io">Envoy Gateway</a> implement the <a rel="noopener external" target="_blank" href="https://gateway-api.sigs.k8s.io">Kubernetes Gateway API</a> and use Envoy as their data plane. That is roughly where the similarity ends. Istio is a full service mesh that happens to implement Gateway API; Envoy Gateway is a dedicated Gateway API controller with no mesh ambitions. Choosing between them is mostly a question of scope.</p> <p>This post starts with that comparison — architecture, mTLS, egress control, and resource overhead — then broadens to cover <a rel="noopener external" target="_blank" href="https://cilium.io">Cilium</a> as a lighter alternative for East-West security, how the choice plays out on managed Kubernetes offerings (AKS, GKE, and OVH MKS including their cloud-native ingress and egress options), and finally how to get the real client IP through a cloud load balancer to your application.</p>