Envoy Proxy Fundamentals
Envoy is a programmable network proxy that accepts traffic, applies configured processing, and forwards it to backend services. Teams use it at an application edge, as a service-mesh sidecar, or as an internal load balancer.
itCloud native tools and technologies | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Envoy Proxy Fundamentals
Envoy is a self-contained network proxy. It receives traffic from a downstream client, applies a configured processing pipeline, and forwards traffic to an upstream endpoint. That sounds ordinary. The useful difference is that Envoy makes routing, security, load balancing, and telemetry available outside the application process.
You can place Envoy at an application edge, beside an application as a sidecar, or between internal services. The placement changes who is downstream and upstream. The core model does not change.
Start with the request path
A listener binds an address and port and accepts downstream connections. Envoy chooses a filter chain for that connection. Network filters then process the connection. For HTTP traffic, the HTTP connection manager creates an HTTP filter chain for each request. The router filter selects a route and cluster, then forwards the request to an endpoint in that cluster.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.envoyproxy.io/docs/envoy/latest/intro/what_is_envoy
Supports
- Envoy as an L3/L4 network proxy with pluggable filter chains and an additional HTTP L7 filter layer
- HTTP routing by request properties and common edge or service-mesh uses
- Dynamic configuration for hosts, clusters, routes, listeners, and cryptographic material
- Health checking, load balancing, retries, circuit breaking, rate limiting, request shadowing, and outlier detection
- https://www.envoyproxy.io/docs/envoy/latest/intro/life_of_a_request.html
Supports
- Definitions of downstream, upstream, cluster, endpoint, filter, filter chain, and listener
- Edge, internal load-balancer, and service-mesh traffic topologies
- Request flow through listener filters, network filters, HTTP connection manager, HTTP filters, router filter, cluster, and endpoint
- Cluster subsystem responsibility for upstream selection, endpoint health, load balancing, and connection pooling
- Event-based worker processing and one-worker lifetime for a downstream TCP connection
- https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/dynamic_configuration
Supports
- Static configuration and dynamic configuration choices
- xDS discovery services and control-plane configuration sources
- Dynamic listener, cluster, route, endpoint, and secret-related resources
- https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/intro/threading_model
Supports
- Single-process, multiple-thread architecture
- Main-thread coordination duties, worker-thread traffic duties, and file-flusher access-log duty
- Listener connection lifetime on one worker thread
- https://www.envoyproxy.io/docs/envoy/latest/operations/admin.html
Supports
- Administration interface security risks and secure-network restriction
- Runtime configuration and statistics inspection
- Destructive operations and sensitive information exposure
- https://www.envoyproxy.io/docs/envoy/latest/start/quick-start/
Supports
- Official progression for running Envoy, static and dynamic configuration, validation, administration, and TLS
- https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl.html
Supports
- Upstream and downstream TLS contexts, certificate validation, client certificate authentication, and SNI