Envoy Proxy - A Comprehensive Guide

The Core Idea: High-Performance Proxying

Envoy is a high-performance C++ proxy server developed by Lyft, specifically designed for handling all inbound and outbound traffic for services within a service mesh.

It acts as an L7 proxy and communication bus for large modern service-oriented architectures. Envoy works alongside applications, abstracting the network and providing functionality that would be difficult to implement in each individual service.

Health Checking: Active and Passive Monitoring

Envoy offers advanced load balancing capabilities utilizing a variety of algorithms.

The xDS API allows for dynamic configuration, enabling rapid adjustments to service routing based on real-time health checks.

live demo · related simulation● LIVE

CDS (Cluster Discovery Service): Cluster Configuration

EDS (Endpoint Discovery Service) maintains a list of endpoints within a cluster.

LDS (Listener Discovery Service) configures listeners, defining how Envoy should receive and route traffic.

Frequently asked questions

Can Envoy be used as an API Gateway?

Yes, Envoy is ideally suited for acting as an API gateway. You would configure it by creating a listener on ports 80 or 443, setting up virtual hosts for different domains and paths, routing traffic using routes to backend services, adding authentication filters like JWT or OAuth, implementing rate limiting, incorporating CORS filters, and handling SSL/TLS termination. For example, one listener could receive all requests, routing them based on the path (/api/users, /api/orders), with each route pointing to a different cluster.

Does Envoy support TLS termination and origination?

Absolutely. Envoy supports both TLS termination and origination. For TLS termination, it receives TLS connections and forwards the plain text data to upstream services. For TLS origination, it receives plain text data and forwards the encrypted connection to upstream services. This is configured by adding a TLS transport socket with a TLS context to the listener, utilizing certificates obtained through SDS or statically, supporting SNI (Server Name Indication), and automating certificate rotation via SDS.

Does Envoy provide comprehensive observability?

Yes, Envoy offers extensive observability features. It provides metrics via the /stats endpoint (and Prometheus export), access logs in various formats (JSON, plain text), distributed tracing through OpenTracing/OpenTelemetry, and an admin interface on port 9901. Metrics include request counts, durations, errors, connection counts, and circuit breaker states, while access logs contain detailed information about each request. Tracing utilizes automatic header injection for tracing, integrating with tools like Zipkin and Jaeger.

Does Envoy support rate limiting through Redis?

Yes, Envoy can implement rate limiting using a Redis-based rate limit service. You would add a rate limit filter to the HTTP filter chain, configure the rate limit service endpoint, and define descriptors for rate limit rules based on factors like IP address, headers (user ID, API key), or combinations of these. A separate rate limit service can be used (with Envoy providing a reference implementation) or you can leverage existing solutions.

▶ Try it live

Everything above runs in your browser — open Hash Function Avalanche Visualizer and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open Hash Function Avalanche Visualizer simulation