Envoy Gateway on Maxime Moreillon

Exposing Envoy Gateway on ports 80 and 443 with hostPort

Sun, 20 Sep 2026 00:00:00 +0900

In my article on migrating to Envoy Gateway, I exposed Envoy through a NodePort service and pointed the router’s port-forwards at the assigned ports, as a NodePort cannot use the standard HTTP and HTTPS ports. Accessing apps directly on the local LAN, however, then requires specifying a non-standard port in the URL. On a single-node homelab cluster, hostPort avoids this: it binds a container port directly on the node’s network interface, so the node answers on ports 80 and 443 with nothing in between. Unlike hostNetwork, the pod keeps its own network namespace.

Nextcloud Notes re-syncing everything behind Envoy Gateway

Sun, 20 Sep 2026 00:00:00 +0900

After moving from Ingress NGINX to Envoy Gateway, the Nextcloud Notes app on my phone started taking around 40 seconds to sync, with the loader spinning the whole time.

The problem

The Envoy access log showed why: every sync downloaded the whole collection.

GET /index.php/apps/notes/api/v1/notes?pruneBefore=0   200   4.8 MB

With around 5,000 notes, that is a lot of data to fetch for a sync that usually has nothing to update. According to the Notes API documentation, a client is supposed to send the Last-Modified timestamp and the ETag of the previous response, so that the server only returns what changed. Behind Ingress NGINX, this worked. Behind Envoy Gateway, pruneBefore was always 0.

Retiring Oauth2-Proxy in favor of Envoy Gateway

Fri, 18 Sep 2026 00:00:00 +0900

Oauth2-Proxy is a convenient solution to add authentication with OIDC on applications that do not ship with it natively. It integrates well with the Ingress NGINX controller but the latter is now deprecated.

A replacement for Ingress NGINX is the Gateway API, a newer Kubernetes standard for traffic routing with several available implementations — Envoy Gateway, Istio, Cilium, and NGINX Gateway Fabric among them. This article uses Envoy Gateway. Since Envoy Gateway provides its own OIDC authentication, Oauth2-Proxy is no longer needed for this purpose.

Migrating from Ingress NGINX Controller to Envoy Gateway

Thu, 17 Sep 2026 00:00:00 +0900

As the Ingress NGINX controller is now deprecated, replacing it with the Gateway API is in order. The Gateway API is a newer Kubernetes standard for traffic routing with several available implementations — Envoy Gateway, Istio, Cilium, and NGINX Gateway Fabric among them. Here, I have chosen Envoy Gateway as it is backed by the CNCF and provides all needed features, including native OIDC authentication, which removes the need for Oauth2-Proxy (see this article).