Kgateway v2.4.0: The Kubernetes Gateway That Just Learned to Discover EC2, Route by Zone, and Fail Over Automatically

Kgateway v2.4.0 just landed, and it is an absolute monster of a release — 43 new features, including AWS EC2 backends that auto-discover your instances, zone-aware routing that keeps traffic local, priority groups for active/passive failover, and multi-codec compression that finally brings Brotli and Zstd to your gateway.

If you have never heard of Kgateway, here is the thirty-second pitch: it is a Kubernetes-native API gateway built on Envoy, descended from the Gloo Edge lineage and now a CNCF sandbox project. Think of it as the control plane that sits between your Kubernetes cluster and the outside world, translating Gateway API resources into Envoy configuration.

What problem does it solve? Managing Envoy directly is like assembling IKEA furniture with instructions in Swedish — technically possible, but painful. Kgateway gives you Kubernetes CRDs that describe how traffic should flow, and it handles the translation to Envoy automatically. Traffic routing, TLS termination, auth, rate limiting, transformation — all declarative, all version-controlled, all reconciled like any other Kubernetes resource.

Who uses it? Platform engineers running microservices on Kubernetes who need a powerful, programmable gateway without hand-writing Envoy YAML. It is especially popular in hybrid environments where you are managing traffic across clusters, cloud providers, and legacy infrastructure.

Why should you care about v2.4.0 specifically? Because this release takes Kgateway from “capable gateway” to “serious infrastructure platform.” The headline feature is AWS EC2 backend support — your gateway can now dynamically discover and route to tagged EC2 instances without manual endpoint management. Add in zone-aware routing for latency reduction, priority groups for automatic failover, and Gateway API 1.6 compliance, and you have a release that changes how teams architect their edge layer.

It is like upgrading from a traffic cop at a single intersection to a fully automated highway system that knows where every car is, which lanes are closed, and how to reroute around accidents in real time.

What Is New

AWS EC2 Backend Support — Your Gateway Now Discovers Instances Automatically

This is the big one. Kgateway can now dynamically discover tagged EC2 instances and route traffic to them through Envoy’s Endpoint Discovery Service (EDS). No more maintaining static endpoint lists. No more writing sidecar scripts to sync instance IPs. You tag your instances, point Kgateway at them, and it handles the rest.

The implementation is thoughtful: it includes AssumeRole support for STS role chaining (PR #14148), so each Backend can assume its own IAM role for both Lambda request signing and EC2 discovery. There is an EndpointsDiscovered status condition (PR #14173) that tells you exactly whether discovery succeeded, including credential, authorization, and zero-match failures. And Prometheus metrics (PR #14318) give you full visibility into discovery health.

apiVersion: kgateway.dev/v1alpha1
kind: Backend
metadata:
  name: my-ec2-instances
spec:
  type: aws
  aws:
    ec2:
      region: us-east-1
      tags:
        - key: environment
          value: production
    auth:
      assumeRole:
        roleArn: arn:aws:iam::123456789012:role/kgateway-discovery

Why it matters: If you are running services on EC2 alongside Kubernetes, this bridges the gap. Your gateway now speaks both worlds fluently. This is the feature that makes Kgateway a viable replacement for heavyweight API gateways in hybrid AWS environments.

Zone-Aware Routing — Keep Traffic Local, Cut Latency and Cross-AZ Bills

Zone-aware routing (PR #13978) brings native Envoy prefer-local and force-local support to Kgateway. In plain English: when your gateway picks a backend endpoint to send a request to, it now prefers endpoints in the same availability zone as the gateway pod itself.

This is a big deal for two reasons. First, latency — same-zone calls are physically faster. Second, cost — AWS charges for cross-AZ data transfer, and those bills add up fast at scale. The feature includes bootstrap locality wiring for Envoy proxies, so the gateway knows which zone it is in.

apiVersion: kgateway.dev/v1alpha1
kind: BackendConfigPolicy
metadata:
  name: zone-aware
spec:
  targetRefs:
    - group: kgateway.dev
      kind: Backend
      name: my-backend
  localitySettings:
    localityWeighted: true

Why it matters: For teams running multi-AZ deployments on AWS or GCP, this is the difference between a gateway that treats all endpoints as equal and one that understands topology. Combined with the EC2 backend support above, this gives you a genuinely zone-aware traffic layer.

Priority Groups — Active/Passive Failover Built Into the Gateway

The new priorityGroups backend type (PR #14379) lets you define ordered groups of backends for active/passive failover. Traffic goes to the first group. When all endpoints in that group are unhealthy, it automatically fails over to the next group. When the primary group recovers, traffic comes back.

Each group in the ordered list maps to an Envoy priority level. Combine it with an active health check via BackendConfigPolicy, and you have a robust failover mechanism that previously required external tooling or custom Envoy filters.

apiVersion: kgateway.dev/v1alpha1
kind: Backend
metadata:
  name: primary-with-failover
spec:
  type: priorityGroups
  priorityGroups:
    - priority: 0
      backends:
        - type: static
          static:
            hosts:
              - host: primary-service.internal
                port: 8080
    - priority: 1
      backends:
        - type: static
          static:
            hosts:
              - host: backup-service.internal
                port: 8080

Why it matters: Active/passive failover is one of those things every platform team needs but rarely wants to build. Having it native in the gateway means one less thing to glue together.

Multi-Codec Compression — Brotli and Zstd Join the Party

TrafficPolicy response compression (PR #14275) now supports multiple codecs simultaneously — Gzip, Brotli, and Zstd — with automatic negotiation based on the client’s Accept-Encoding header. You specify codecs in preference order, and Envoy picks the best one the client supports.

This is not just a nice-to-have. Brotli typically achieves 15-25% better compression than Gzip for text-based responses, and Zstd pushes that even further for large payloads. For a gateway serving API responses, that is real bandwidth savings — and faster page loads for your users.

apiVersion: kgateway.dev/v1alpha1
kind: TrafficPolicy
metadata:
  name: compress-everything
spec:
  compression:
    responseCompression:
      libraries:
        - gzip
        - brotli
        - zstd

Why it matters: Most gateways support Gzip and call it a day. Getting Brotli and Zstd with automatic negotiation is a meaningful upgrade for any latency-sensitive or bandwidth-constrained deployment. Your users on mobile networks will thank you.

Gateway API 1.6 Support and Dozens More

Kgateway v2.4.0 also brings Gateway API 1.6.0 and 1.6.1 support (PR #14245, PR #14426), keeping pace with the upstream spec. Other notable additions include:

• Internal redirects in TrafficPolicy (PR #14261) — handle redirect logic at the gateway without round-tripping to backends.
• Per-route statistics via statPrefix (PR #14409) — finally, granular observability per HTTPRoute rule.
• WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT) (PR #14323) — for modern streaming workloads.
• Secret-backed header values in TrafficPolicy (PR #13880) — pull header values from Kubernetes Secrets with cross-namespace ReferenceGrant support.
• OAuth2 improvements — redirect-based flows via headersToClient (PR #13592), separate JWKS backend (PR #14147), and async JWKS fetching with retries (PR #14211).
• Ordered ADS delivery (PR #14372) — opt-in via KGW_ENABLE_ORDERED_ADS=true for consistent CDS, EDS, LDS, and RDS response ordering.

Breaking Changes

There are three breaking changes to be aware of:

• New Programmed condition on Routes — Route issues (conflicts, dropped routes, replacements) now surface on the kgateway.dev/Programmed condition instead of Accepted. The Accepted condition only indicates semantic validity. If you have automation watching the Accepted condition for route health, update it.
• Image tag overrides clear digests (PR #13953) — Only affects you if your GatewayParameters use sha256 image digests. Default parameters use tags only, so most users are unaffected.
• Removed deprecated perConnectionBufferLimitBytes annotation (PR #14156) — Use ListenerPolicy instead.

Bug Fixes

The release includes 40+ bug fixes. Notable ones:

• xDS race condition during reconnect (PR #14380) — fixed a bug where per-client xDS snapshots could be withheld indefinitely, stranding gateway pods on stale endpoints.
• Multiple leaders during upgrades (PR #14017) — no more split brain when the control plane restarts.
• Excessive DNS queries (PR #14291) — xDS cluster addresses now render as rooted FQDNs, preventing DNS search-domain expansion under ndots:5.
• Route status reporting for GRPCRoute, TCPRoute, and TLSRoute (PR #14294) — stale statuses are now properly cleared.

Envoy was upgraded to v1.38.3 (PR #14314), and Istio proxy version was bumped (PR #14056).

Kgateway v2.4.0 is the kind of release that makes you reconsider what an API gateway can do in a Kubernetes-native world.

Learn More

• Kgateway Official Documentation
• GitHub Repository
• Full Changelog for v2.4.0