krouter: Kubernetes Gateway API routerRoute everything.<br>Break nothing.<br>krouter is a Kubernetes-native gateway built on the official<br>Gateway API: one tiny binary that routes HTTP, gRPC, TCP, UDP<br>and TLS without ever dropping a connection.<br>Get started<br>View on GitHub

710<br>Gateway API conformance checks

custom CRDs to learn

binary to run

Why teams pick krouter<br>Standards first, no lock-in<br>Built on pure Gateway API v1.6.1: your Gateways and Routes stay<br>portable Kubernetes resources. Even the extras (rate limiting, WAF)<br>ride the standard ExtensionRef filter and plain ConfigMaps, so there<br>are still no custom CRDs holding your YAML hostage.

Hitless by design<br>Configuration changes apply atomically. Ten thousand live<br>connections survive every reload and certificate rotation, and a<br>release gate proves it, every time.

Five protocols, one gateway<br>HTTP, gRPC, raw TCP, UDP and TLS (passthrough or terminated)<br>through the same tiny data plane. No sidecars, no fleet of proxies<br>to babysit.

Proof, not promises<br>Every build ships with the full official conformance report:<br>710 checks, zero failures. Read<br>the latest report (we publish it as-is).

See your traffic<br>A live dashboard is built in: gateways, routes and backends as<br>an always-current topology map, with degraded paths highlighted<br>before your users notice.

Secure at both ends<br>Terminate TLS, validate client certificates and re-encrypt to<br>backends with SAN-verified policies, then shield routes with a<br>built-in WAF (OWASP Core Rule Set) and per-route rate limiting:<br>defence in depth, configured entirely through standard resources.

How krouter compares<br>An honest look at what krouter does (and deliberately does not do)<br>next to other Gateway API implementations.<br>FeaturekrouterEnvoy GatewayNGINX Gateway FabricTraefikIstioGateway APICore conformance (HTTP, GRPC, TLS, TCP, UDP profiles)✓✓◐◐✓Every non-mesh Extended conformance test (v1.6.1)✓◐◐◐◐TCPRoute, UDPRoute, TLSRoute✓✓◐◐✓ListenerSet (merged listeners)✓◐———BackendTLSPolicy (incl. SAN validation)✓✓◐—◐Client certificate validation (frontend mTLS)✓✓—✓✓CORS filter✓✓—✓✓OperationsNo custom CRDs required✓————Single binary and container image✓——✓—Hitless reloads (proven with 10,000 live connections)✓✓◐✓✓Built-in live topology dashboard✓——✓◐Conformance report published with every build✓◐◐◐◐SecurityRate limiting✓✓—✓✓Web application firewall (built-in OWASP CRS)✓◐—◐◐Authentication / authorization policies—✓—✓✓Beyond krouter's scopeService mesh (east-west traffic)————✓Retries and circuit breaking—✓—✓✓Active backend health checks—✓—✓✓<br>✓ supported · ◐ partial or via vendor extensions · — not provided.<br>Based on each project's public documentation as of July 2026; always<br>check upstream for the latest state.

Up and running in three commands<br>1 · Install the Gateway API CRDs<br>kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml<br>2 · Deploy krouter<br>kubectl apply -f https://raw.githubusercontent.com/link-society/krouter/main/k8s/krouter.yaml<br>3 · Create your first Gateway<br>kubectl apply -f my-gateway.yaml<br># then follow the tutorials!

Start the first tutorial