Contour
Ingress controller built on Envoy, whose point isn't the performance but that several teams can share a domain without being able to hijack each other's routes.
The standard Ingress resource has a design flaw that only shows up in a cluster with many teams: anyone allowed to create an Ingress in their own namespace can claim any path under any host, including /login on the company's main domain. Nothing in the model prevents it. Contour's own resource type, HTTPProxy, introduces delegation instead: a cluster administrator owns the domain root and explicitly delegates subtrees to namespaces, which cannot reach outside their mandate. Along with it come weighted traffic splitting, header-based routing and rate limiting as real fields rather than a bag of annotations. Envoy handles the data path and is configured dynamically without restarts.