Envoy

Envoy is an L7 (application layer) and L4 (transport layer) network proxy originally developed by Lyft, now a CNCF graduated project. It has established itself as the foundational component of modern service mesh architectures, offering advanced routing, resilience, and observability capabilities for containerized distributed applications.

Envoy Fundamentals

• Edge and service mesh proxy designed for cloud-native architectures with multi-protocol support (HTTP/1.1, HTTP/2, gRPC, TCP)
• Out-of-process architecture deployed as sidecar alongside each application service
• Dynamic configuration via xDS APIs (Discovery Service) enabling updates without restarts
• Written in C++ for optimal performance with minimal memory footprint and ultra-low latency

Strategic Benefits

• Native observability with detailed metrics, distributed tracing, and structured logs for every request
• Advanced resilience through circuit breakers, intelligent retries, timeouts, and granular rate limiting
• Sophisticated load balancing with multiple algorithms (round-robin, least request, ring hash) and active health checking
• Enhanced security via automatic mutual TLS, certificate validation, and identity-based access control
• Extensibility through WebAssembly (Wasm) filters enabling custom business logic without recompilation

Envoy Configuration Example

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          access_log:
          - name: envoy.access_loggers.stdout
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
          route_config:
            name: local_route
            virtual_hosts:
            - name: backend
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: service_backend
                  timeout: 5s
                  retry_policy:
                    retry_on: 5xx
                    num_retries: 3
  clusters:
  - name: service_backend
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: service_backend
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: backend-service
                port_value: 8080
    health_checks:
    - timeout: 1s
      interval: 5s
      unhealthy_threshold: 2
      healthy_threshold: 2
      http_health_check:
        path: "/health"

Envoy Implementation

1. Define deployment architecture: edge proxy, service mesh sidecar, or API gateway based on requirements
2. Configure listeners to expose listening ports and define appropriate network filters
3. Define backend clusters with load balancing policies, health checks, and circuit breakers
4. Implement routes with matching rules, transformations, and retry/timeout policies
5. Integrate with a control plane (Istio, Consul Connect) for dynamic configuration via xDS APIs
6. Configure observability by connecting Envoy to Prometheus, Jaeger, and your centralized logging system
7. Enable mutual TLS to secure inter-service communications with automatic certificate rotation

Ecosystem and Integrations

• Istio: uses Envoy as data plane to implement service mesh functionality
• Consul Connect: relies on Envoy for network segmentation and automatic encryption
• Ambassador/Emissary-ingress: Kubernetes API gateway based on Envoy for edge traffic management
• Gloo Edge: API-first gateway using Envoy with advanced request transformation
• Contour: high-performance Kubernetes ingress controller powered by Envoy
• AWS App Mesh: managed service mesh using Envoy as data proxy

Envoy has established itself as the de facto standard for proxying in cloud-native architectures, providing a solid foundation for building resilient and observable distributed systems. Its exceptional performance, flexibility through xDS APIs, and vibrant ecosystem make it a strategic choice for organizations adopting microservices and service mesh, reducing operational complexity while improving overall application reliability.