Airlock Microgateway
Airlock Microgateway, developed by Ergon Informatik AG, is a Kubernetes-native gateway built on open standards. It implements the Kubernetes Gateway API, the successor to the Ingress API and extends it with enterprise-grade security: a Web Application Firewall, an Identity-aware Proxy, and API protection, reporting and monitoring features, all runs as a single lightweight component in your cluster.
The free Community Edition is a fully featured Kubernetes Gateway API implementation. It requires no license and has no throughput limit, and it works as a drop-in replacement for the end-of-life Ingress NGINX. The kubernetes-sigs ingress2gateway tool includes an Airlock Microgateway emitter that converts existing Ingress NGINX resources into Gateway API resources for Airlock Microgateway, and the Airlock documentation gives step-by-step migration instructions.
Airlock Microgateway secures applications and APIs right at the cluster entry point, making it easy to bring Zero Trust and identity-based security into modern DevOps and platform engineering processes. Routing and security policies are defined declaratively as code and rolled out through GitOps workflows. Every rollout stays automated, reproducible, and consistent across all environments.
The solution is cloud-agnostic, Red Hat OpenShift certified, and compatible with service mesh and network security stacks such as Istio and Cilium. Start for free with the Community Edition, then evaluate the advanced WAF, API protection, and identity features with a free, self-service evaluation license.
Key Features
- Kubernetes-native WAAP: Web Application Firewall and API protection integrated directly into Kubernetes.
- Identity-aware Proxy: Upstream authentication and authorization via OIDC, JWT, OAuth 2.0 Token Exchange, or mTLS, with fine-grained, path-based access control.
- Threat protection: OWASP-style deny rules, CSRF protection, OpenAPI specification enforcement, and GraphQL schema validation.
- Security as code: Declarative GitOps-driven configuration of routing and security policies.
- Compatibility: Compatible with the Kubernetes Gateway API, Istio, and Cilium, and certified for Red Hat OpenShift.
- Observability: Built-in Grafana dashboards based on Prometheus metrics and ECS-format based logs, and tracing support.
- Ingress Nginx replacement: Drop-in replacement for the end-of-life Ingress NGINX, with automated migration via the kubernetes-sigs ingress2gateway tool and its Airlock Microgateway emitter.
- Community Edition: A fully featured Kubernetes Gateway API implementation with no license, no throughput limit.
Use Cases
- Protecting containerized web applications and APIs in Kubernetes clusters on Exoscale
- Replacing the end-of-life Ingress NGINX with a Kubernetes Gateway API reverse proxy, using the ingress2gateway tool to migrate existing Ingress resources
- Securing highly sensitive workloads such as healthcare data in multi-cloud setups across cloud providers
- Identity-aware access control (OIDC, OAuth 2.0 Token Exchange, mTLS) for web applications and APIs inside or outside Kubernetes
- Implementing security-as-code in DevSecOps and GitOps processes for regulated industries
Benefits
Standards, not lock-in
Capabilities are built on open standard such as: Gateway API, OIDC, OAuth 2.0 Token Exchange, mTLS, OpenAPI, GraphQL, OpenTelemetry.
Grows into full security when you need it
The same component adds a Web Application Firewall, API protection, and identity-aware access control through a free evaluation license, so security scales with the workload instead of requiring a second product.
Zero Trust for Kubernetes
Every request is validated and authorized at the cluster entry point, so only authenticated, authorized users and systems reach your critical services.
Security that keeps pace with DevOps
Security runs automatically in the CI/CD pipeline instead of slowing deployments down. Policies live as code in the repository, so DevSecOps teams manage security themselves without waiting for manual approvals.
Lower operational overhead
A clear role model separates platform, security, and development responsibilities. Consistent, versioned policies across all environments reduce coordination effort and configuration drift.
Protected from the first request
Multi-layered application and API filtering blocks common web attacks with OWASP-style deny rules before they reach your services, turning audit preparation from months into hours.
A clean path off Ingress NGINX
The ingress2gateway tool reads your existing Ingress NGINX resources and its Airlock Microgateway emitter outputs the matching Gateway API resources. Migration is scripted, not hand-rewritten.
Start free, no procurement
The Community Edition runs in production with no license, no limits, and no sales conversation. Engineers adopt it the same day they find it.
Exoscale Integration
Airlock Microgateway deploys as a container directly into Kubernetes clusters on Exoscale, such as the Exoscale Scalable Kubernetes Service (SKS). As a cloud-agnostic, standards-based solution, it integrates directly with Exoscale's European, GDPR-aligned infrastructure. This makes Kubernetes environments Zero Trust ready within hours. Running Airlock Microgateway on Exoscale keeps ingress, WAF, API protection, and identity on European infrastructure. Data processing stays within Exoscale's European data centers, which suits organizations with data sovereignty requirements or a multi-cloud strategy across European providers.
- Runs in the Exoscale Scalable Kubernetes Service (SKS)
- Cloud-agnostic by design, ideal for dual-cloud and multi-cloud architectures
- European data sovereignty and GDPR alignment through the combination of Exoscale's EU infrastructure and Airlock's security-as-code approach
- Observability integration via Prometheus and Grafana, compatible with standard Kubernetes monitoring stacks
Compatible
Getting Started
- 1 Provision a Kubernetes cluster on Exoscale using the Exoscale Scalable Kubernetes Service (SKS)
- 2 Install Airlock Microgateway Operator via Helm from oci://quay.io/airlockcharts/microgateway following the installation guide https://docs.airlock.com/microgateway
- 3 Define routing and security policies (filtering, authentication, OpenAPI and GraphQL validation) declaratively as code
- 4 To evaluate advanced WAAP and authentication features, request a free self-service evaluation license at https://airlock.com/en/microgateway-evaluation. For production use, request a Premium license and contact Airlock at https://airlock.com/en/microgateway-premium
- 5 Optional: Migrate existing Ingress NGINX resources with the ingress2gateway tool and its Airlock Microgateway emitter (run ingress2gateway print --providers=ingress-nginx --emitter=airlock-microgateway, see https://github.com/kubernetes-sigs/ingress2gateway), following the Airlock documentation at https://docs.airlock.com/microgateway/latest/
Support
- Model
- Free community support via the Airlock community forum. Premium support included with every Premium Edition license.
- Contact
- Community support at https://forum.airlock.com/. Premium support at https://techzone.ergon.ch/support-form
- Documentation
- View docs
Pricing
- Model
- Free Community Edition, plus license-based evaluation and production plans
- Details
- Start for free with the Community Edition, which includes the Kubernetes Gateway API capabilities, and observability features with no license and no limits. Evaluate the advanced WAAP and identity features with a free, self-service evaluation license at https://airlock.com/en/microgateway-evaluation. For production use, request a Premium license and contact Airlock at https://airlock.com/en/microgateway-premium
Certifications
- Red Hat OpenShift Certified
- Works with Exoscale