Don't Panic - Envoy Proxy Fundamentals

Envoy Proxy Fundamentals centers on Envoy. Envoy is a self-contained network proxy. It receives traffic from a downstream client, applies a configured processing pipeline, and forwards traffic to an upstream endpoint.

Operate from the project's own resources and APIs. Learn how desired state becomes running state, which status conditions matter, and which dependencies (network, storage, identity, certificates) the control plane assumes.

Upgrades, backups, and credential rotation are part of the product, not optional aftercare. Version skew between clients and servers creates failures that look like application bugs. Pin versions and rehearse rollback.

Convenience features reduce boilerplate and widen blast radius. Enable them when you can observe and reverse the expanded surface. Defaults from quickstarts are starting points, not production policy.

Name owners for upgrades, credentials, and disaster recovery before traffic arrives. Unowned control-plane state becomes an outage with no clear pager. Prefer explicit version pins and tested rollback over floating tags that quietly change behavior between deploys.

Name owners for upgrades, credentials, and disaster recovery before traffic arrives. Unowned control-plane state becomes an outage with no clear pager. Prefer explicit version pins and tested rollback over floating tags that quietly change behavior between deploys.

Name owners for upgrades, credentials, and disaster recovery before traffic arrives. Unowned control-plane state becomes an outage with no clear pager. Prefer explicit version pins and tested rollback over floating tags that quietly change behavior between deploys.

Read the Intro for the mental model. Use the Cheatsheet when you need the resource map. Updates and Upstream track the Envoy release line that changes these APIs.