API Gateway Performance: Envoy, Kong & Apache APISIX
Modern microservice architectures require an API Gateway at the edge to handle incoming client traffic, enforce authentication, execute rate limiting, terminate TLS, and dynamically route requests across hundreds of internal services. Traditional static reverse proxies (like standalone NGINX or HAProxy) require reloading the entire process config file whenever upstream service endpoints change, causing temporary connection drops during frequent Kubernetes deployments.
Programmable Cloud-Native API Gateways solve this with dynamic control planes and hot-reloading routing tables. Envoy Proxy, Kong Gateway, and Apache APISIX offer distinct extension architectures (C++ Wasm, Lua/OpenResty, and ETCD sync) to process tens of thousands of requests per second with sub-millisecond overhead. This guide compares Envoy, Kong, and APISIX on plugin extensibility, route reload performance, memory footprint, and tail latency.
Mental Model: Monolithic Reverse Proxies vs Programmable Cloud-Native API Gateways
Traditional static proxies require updating /etc/nginx/nginx.conf and issuing nginx -s reload during every service deployment. At high concurrency, configuration reloads create connection drop spikes and worker process memory leaks.
Cloud-Native API Gateway Architecture decouples control plane state from data plane execution:
1. Data Plane: High-throughput proxy engine (Envoy C++ or OpenResty Lua) that routes HTTP/gRPC requests, evaluates JWT tokens, and enforces rate limits in RAM. 2. Dynamic Control Plane: Pushes route updates via gRPC xDS APIs (Envoy) or ETCD key-value watches (APISIX/Kong) in milliseconds without dropping active TCP connections. For gateway security and performance, review securing api gateways oauth2 m2m client credentials and high performance api gateway.
Quick reference
- Decouples data plane proxy execution from dynamic control plane route configuration.
- Hot-reloads routing tables in milliseconds without dropping active client TCP connections.
- Executes edge security (OAuth2 JWT, mTLS, WAF) before requests enter internal networks.
- Provides rich telemetry metrics (Prometheus, OpenTelemetry) per route and upstream service.
- Powers edge routing at Lyft, Stripe, Cloudflare, Apple, and CoreConcept.
Remember this
Deploy programmable API Gateways to hot-reload routes dynamically without dropping active connections.
Envoy Proxy C++ Core & WebAssembly (Wasm) Plugin Extensions
Envoy Proxy is a high-performance C++ L4/L7 proxy designed for cloud-native service meshes (Istio/Gloo):
- gRPC xDS Control Plane: Listens for dynamic Endpoint Discovery Service (EDS) and Route Discovery Service (RDS) updates over gRPC streams. - WebAssembly (Wasm) Extensions: Custom gateway plugins (written in Rust, Go, or C++) compile into Wasm bytecode and execute inside Envoy's embedded V8 Wasm engine:
1// Rust WebAssembly Plugin for Envoy API Gateway2use proxy_wasm::types::*;3 4#[no_mangle]5pub fn _start() {6 proxy_wasm::set_stream_context(|_, _| -> Box<dyn StreamContext> {7 Box::new(HeaderAuthContext)8 });9}Quick reference
- Envoy C++ memory architecture delivers sub-millisecond p99 request routing latency.
- WebAssembly (Wasm) plugins enable safe, sandboxed custom plugin development in Rust or Go.
- xDS APIs dynamically update clusters and routes without process restarts or file reloads.
- Native HTTP/2, HTTP/3 (QUIC), and gRPC proxying out of the box.
- Powers cloud-native service meshes across thousands of Kubernetes clusters.
Remember this
Use Envoy Proxy with WebAssembly (Wasm) plugins for sandboxed, polyglot extension development.
Kong OpenResty NGINX vs Apache APISIX Dynamic ETCD Route Configuration
Evaluating Kong vs Apache APISIX highlights architectural evolution in Lua-based proxies:
- Kong Gateway: Built on NGINX / OpenResty, Kong stores configuration in PostgreSQL or Cassandra (or declarative YAML in DB-less mode). Plugins are written in Lua or Go sidecars. - Apache APISIX: Uses ETCD for real-time key-value route configuration sync. Replaces traditional NGINX shared memory locks with lock-free radixtree routing, achieving sub-millisecond route lookup even with 10,000+ active routes.
Quick reference
- Apache APISIX uses ETCD watches to push route updates to data plane nodes in under 1 millisecond.
- Lock-free radixtree algorithm in APISIX prevents route matching performance drops at scale.
- Kong offers a rich enterprise plugin ecosystem (OAuth2, SAML, Rate Limiting, Transformer).
- Both platforms support Lua scripting for custom high-speed plugin development.
- Delivers sub-millisecond edge proxy performance for enterprise microservices.
Remember this
Choose Apache APISIX for lock-free ETCD route synchronization and Kong for enterprise plugin ecosystems.
Benchmark Throughput, Tail Latency, & Hot-Reloading Production Metrics
Selecting the right API Gateway depends on throughput requirements and team skillsets:
- Latency & CPU Footprint: Envoy delivers the lowest RAM footprint (~30MB) and lowest tail latency ($p_{99} < 1\text{ms}$). APISIX out-performs Kong under 5,000+ dynamic route updates per minute due to ETCD event streams. - Operability: Kong and APISIX provide intuitive Admin REST APIs and UI dashboards. Envoy requires operating an xDS control plane server (such as Gloo Edge or Istio Ingress).
Quick reference
- Envoy C++ core offers the lowest RAM consumption and lowest p99 latency SLAs.
- APISIX ETCD watch architecture out-performs Kong during high-frequency route reloads.
- Kong DB-less mode operates cleanly inside Kubernetes Declarative GitOps pipelines.
- Monitor latency histograms and connection pool depth metrics in Grafana dashboards.
- Establishes a resilient, high-speed API gateway foundation for enterprise microservices.
Remember this
Benchmark memory footprint and control plane requirements when selecting between Envoy, Kong, and APISIX.
Key takeaway
To test Apache APISIX locally, run docker run -d --name apisix-quickstart -p 9080:9080 apache/apisix. Configure routes via curl http://127.0.0.1:9180/apisix/admin/routes/1.
Related Articles
Explore this topic