Best Practice to deploy Ambassador API gateway to prevent DDoS
As much i know there is two thing
Ambassador API gateway and Edge stack
Ambassador is open source while edge stack is paid version.
You can install the edge stack on VM and linux but for API gateway only YAML and helm are available.
you can put rate-limiting for saving the DDos.
Hosting the API Gateway within same k8s cluster could lead of clusterbeing overwhelmed because of unwanted traffic but if I host the APIgateway on separate k8s cluster application k8s cluster could be savedfrom such scenario.
you are right in this case but if you are using the K8s you can use node affinity to fix the pods of API gateway on specific nodes or run it as daemon set. Setting up affinity and anti-affinity might help separating out the PODs or application and API gateway.