Case Studies

• 1: From Evaluation to Integration: SAP's Journey with Envoy Gateway

1 - From Evaluation to Integration: SAP's Journey with Envoy Gateway

Why Envoy Gateway

Our journey with Envoy Gateway (EG) began in late 2023, when multiple SAP product teams undertook an initiative to modernize and streamline their existing gateway infrastructure, which consists of various 3rd party, open source, and managed solutions running on diverse infrastructure. We decided on Envoy as the data plane and conducted a rigorous control-plane evaluation. Envoy Gateway, then pre-GA (General Availability), emerged as the strategic choice. Selecting Envoy Gateway was not a trivial decision given the number of mature control planes in the market.

However, the following factors made Envoy Gateway the right strategic choice for us:

• Strong alignment with the Envoy Proxy organization and maintainer community.
• An open-source-first roadmap that matched our requirements and balanced community and vendor needs.
• A leading implementation of Gateway API, providing portability and long-term viability.
• Multi-vendor backing committed to a common layer for Envoy-based gateways and announced plans to migrate to this common layer.
• Strong extensibility that accelerates delivery without waiting on upstream changes.

During our evaluation, we also identified capability and readiness gaps. We concluded that successful adoption required us to take a proactive role as significant contributors, committing to a sustained engineering effort to close those gaps in collaboration with the community. This was essential to meeting enterprise timelines and helping the broader ecosystem reach GA with confidence.

Driving Production Readiness

Our contributions were initially guided by the project’s GA roadmap and focused on three areas to help the project reach this critical milestone for both our adoption and the community at large:

• Features: Extended client and backend traffic policies to cover timeouts, HTTP and TLS options, circuit breakers, retries, backend mTLS, failover, and more.
• Reliability: Added control-plane leader election, hardened the translation pipeline with robust error handling, and implemented various resilience and upgrade tests.
• Processes: Improved project hygiene through image, dependency, and license scanning, and collaborated on developing a clear security policy and coordinated disclosure process.

After GA, we focused on high-impact capabilities requested by the Envoy Gateway and the Gateway API communities. Using Gateway API extension points, we introduced EG-native capabilities:

• Routing to non-Kubernetes backends (external domains, Unix domain sockets, etc.) using a custom backend resource, later extended by the community for dynamic proxy use-cases.
• Advanced route actions via an Envoy Gateway HTTPRouteFilter, starting with regex rewrites and subsequently expanded by the community to direct responses, credential injection, and more.

For scenarios beyond common API Gateway patterns, we invested in the extensibility of both the data plane and the control plane:

• Data Plane: We co-designed and co-implemented the Envoy Extension Policy resource with the community, enabling features such as Ext-Proc and Wasm, filter ordering, and per-route extensions.
• Control Plane: We invested in the Envoy Gateway Extension Server, a programmable XDS mutation path. We added Custom Policies to pass extension context via the same policy model used by the Gateway API. We strengthened error handling, resilience, and security while exposing additional deployment modes.

These extensibility options became foundational for vendors aiming to deliver distinctive features, large-scale enterprises seeking additional configuration flexibility, and domain-specific projects such as Envoy AI Gateway. The community continues to invest in these extensibility options, introducing Lua extensions and custom backend extension resources.

Adopting Envoy Gateway

In parallel, we executed a controlled rollout across diverse environments. We identified and resolved real-world resilience, scale, and performance bottlenecks along the way. The outcomes were substantial: significantly lower CPU and memory consumption, much larger configuration scale support, and markedly faster configuration programming times. Envoy Gateway now runs reliably across hundreds of clusters worldwide on multiple infrastructure providers.

Envoy Gateway is currently used to manage HTTPS traffic across multiple cloud products. The project’s robust support for data plane extensibility has enabled SAP to implement organization-specific policies and routing capabilities. Moreover, control plane extensibility has allowed SAP to overcome limitations in the Gateway API and fine-tune low-level Envoy configuration options that are currently not exposed, demonstrating the versatility and power of Envoy Gateway in meeting the unique demands of an enterprise environment.

We are grateful to the contributors, reviewers, maintainers, and committee members who shaped this work. We’re genuinely excited to see our joint efforts in production and to watch the foundation we helped build continuously improve and be extended by end users and adopters. If you’re building on Envoy and value openness and collaboration, we invite you to join the Envoy Gateway community.