I know it might sound crazy, but since you're that big, I suggest you investigate the idea of writing your own Envoy control plane and thus creating your own Envoy-based API gateway. It's not really as hard/time consuming as it looks especially if your requirements are not very advanced. Even functionalities like custom authentication/authorization/distributed rate limiting can be done in a few hours/days and plugged as sidecars. Engineering a good API on top of the control plane for those who have to maintain the API gateway is what will take time imo.