Executive Summary
Ory faced challenges with their previous API gateway, including high operational complexity, performance bottlenecks, and increasing resource consumption as they scaled. To address these issues, they adopted Tetrate Enterprise Gateway for Envoy (TEG), leveraging its open-source foundation, strong community support, and great transparency.
Through a structured five-month migration, Ory validated TEG’s performance, executed a phased rollout, and finished without performance regressions. TEG achieved 40% resource savings, simplified operations, and improved observability.
The migration was successful, solidifying TEG as a core part of Ory’s infrastructure while fostering a strategic partnership with Tetrate to drive future innovations in cloud-native API gateway solutions.
About Ory
Ory delivers modern IAM/CIAM solutions built on open standards, ensuring interoperability and flexibility across modern tech stacks. Powered by open source and trusted by a global community, Ory is the only CIAM vendor that offers a choice from free, open-source software and supported Enterprise Licenses to a fully managed, globally secure, and compliant Ory Network.
The Ory Network is a global, cloud-native identity and access management (IAM) and customer identity and access management (CIAM) platform built for high availability and low latency. It secures user authentication, authorization, and API protection for humans, devices, and software with advanced zero-trust security.
“From the first day, Tetrate has demonstrated and continues to demonstrate a strong commitment to this project and has proven to be a great technology partner.”
Motivation
As Ory scaled, it encountered significant challenges with its Gateway solution, leading them to explore alternative solutions in the industry.
Key issues they observed:
- High adoption and operational complexity
- Performance and scalability bottlenecks
- Difficulties in debugging issues
- High resource consumption
The original solution’s initial setup had a steep learning curve, making it difficult to start. In addition to the initial setup challenges, the complexity of maintaining the solution also increased, resulting in higher operational overhead.
In addition to the complexity of managing the existing solution, Ory faced performance and scalability bottlenecks. The solution made these issues challenging to debug and hindered their ability to identify and resolve root causes.
Ory also observed a noticeable rise in resource consumption as it scaled, further impacting operational efficiency.
As a result, Ory began seeking a more straightforward, scalable, transparent, and resource-efficient solution.
Solution
To address the limitations of their previous Gateway solution, Ory chose Tetrate Enterprise Gateway for Envoy (TEG). Its fully open-source nature, backed by a strong community and multi-company support, offered the transparency and flexibility Ory needed.
To validate that TEG addressed the challenges, Ory & Tetrate collaborated on a Proof of Concept (POC) to test:
- Feature parity with previous solutions
- Performance and resource efficiency at scale
- Operational simplicity for managing and troubleshooting
During the validation phase, Tetrate demonstrated their commitment to the project and Ory as a design partner. When Ory identified any missing features in TEG, Tetrate quickly addressed and implemented them.
As the POC demonstrated that TEG had the required features, could handle the scale, and provided operational simplicity, Ory began implementing a phased rollout.
Implementation
The migration to Tetrate Enterprise Gateway was a carefully planned and executed process that spanned approximately five months. The initial validation and testing phase consumed most of this time, reflecting its critical importance in ensuring a smooth transition.
In their staging environment, Ory ran their existing solution and TEG side-by-side, allowing for a graceful migration and the creation of detailed procedures for potential production deployment. This dual-running approach minimized risk and ensured a smooth transition.
Finally, Ory migrated their production environment in a similar phased manner, replicating the successful strategy used in development. This approach allowed Ory to integrate TEG seamlessly with their existing infrastructure, minimizing disruption and ensuring a stable, performant environment.
Key steps in the implementation
- Extensive Validation and Testing: Ory thoroughly tested TEG in the initial phase, ensuring it matched their existing solution’s features and giving Ory the confidence to move forward on a test environment.
- Local Development Environment Migration: Following successful testing, Ory transitioned their local development environments to TEG, allowing developers to become familiar with the new platform.
- Staging Environment Migration: This stage focused on zero-downtime, graceful canary migration. Ory developed a detailed migration procedure and used the staging environment migration as a live test, ensuring a seamless transition.
- Production Environment Migration: Based on the successful staging migration, Ory executed the production environment migration according to the established plan, minimizing risk and ensuring stability.
Results
The migration to TEG provided significant measurable improvements across several key areas:
- Performance Improvements: While Ory focused on operational stability and feature parity during migration, they observed no performance regressions and, in some cases, improvements in throughput due to Envoy’s efficiency
- Simplified Operations: TEG’s clearer interface and configuration plane drastically simplified operations. Ory now has a simpler process for configuring and operating their API gateway, reducing complexity and easing maintenance.
- 40% Reduction in Resource Consumption: Ory achieved approximately a 40% reduction in resource consumption, leading to significant cost savings. This optimization also frees up resources for other critical tasks.
- Other Notable Benefits: Ory gained full observability into the gateway, including the rate-limiting service, significantly enhancing their ability to monitor and manage performance and security.
- Open Source Foundation: The open-source nature of the TEG and its community support means Ory has improved its scalability and is a more secure solution.
Conclusion
The successful migration to TEG has achieved significant operational improvements, resource optimization, and enhanced observability. Beyond the immediate benefits, Ory has established a strong partnership with Tetrate, leading to shorter development cycles and a collaborative roadmap.
This partnership allows Ory to contribute actively and shape the future API gateway. Ory is now collaborating on further enhancements, particularly in Web Application Firewalls and routing configuration generation, ensuring Ory stays at the forefront of API management. Tetrate’s commitment to the project has been evident from day one, solidifying it as a valuable technology partner.
As a result, Ory is confident that TEG will continue to be a cornerstone of their infrastructure, providing the flexibility and future-proofing needed to scale and innovate. Interested in learning more? Reach out for a demo.