🛡️Envoy

NEW

High-performance open source edge and service proxy for L7 routing, observability, and resilience.

DESCRIPTION

Envoy is a modern, extensible proxy used as an edge proxy and as a sidecar in service meshes. It supports advanced L7 features, HTTP/2, HTTP/3, gRPC, circuit breaking, retries, and timeouts. Dynamic configuration via xDS APIs enables centralized control planes such as Istio. Envoy integrates with tracing, metrics, and logging systems for deep observability. Its filter architecture and WASM extensions allow powerful customization.

ALTERNATIVE DEFINITIONS

Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications.

Concise positioning as cloud-native edge and service proxy.

Source

CNCF

Envoy is a high performance, open source edge and service proxy that makes the network transparent to applications.

Emphasizes high performance and network transparency.

Source

RELATED TERMS

Service Mesh Istio Linkerd xDS API gRPC OpenTelemetry Load Balancer

COMPETING TERMS

NGINX HAProxy Traefik

RELATIONS

• Conforms to: OpenTelemetry

KNOWLEDGE AREAS

Infrastructure Observability & Telemetry Software Engineering Cloud Platform & Tooling Real-time & Streaming Data

TARGET AUDIENCE

DevOps Engineer Cloud Architect Software Architect Software Developer Security Architect

EXTERNAL SOURCES

• Wikipedia - Envoy (software)
• Envoy - Official Envoy documentation
• Istio - Istio sidecar proxy requirements
• OpenTelemetry - Tracing Envoy with OTel

TOP QUESTIONS

Where is Envoy used in modern architectures?

As an ingress/egress edge proxy and as a sidecar in service meshes like Istio for traffic management and observability.

Category: Overview

How does Envoy enable dynamic configuration?

Through xDS APIs, Envoy can fetch and update listeners, routes, and clusters from a control plane without restarts.

Category: Capabilities

What differentiates Envoy from NGINX or HAProxy?

Envoy offers rich L7 features, native gRPC/HTTP2/3 support, and dynamic xDS APIs for cloud-native control planes.

Category: Comparison

How does Envoy support resilience?

It provides circuit breaking, outlier detection, retries with backoff, and timeouts to harden service-to-service calls.

Category: Capabilities

How is observability implemented in Envoy?

Envoy exports metrics, access logs, and distributed traces, integrating with Prometheus, Grafana, and OpenTelemetry.

Category: Observability

Can Envoy be extended?

Yes, via filters and WASM extensions, enabling custom protocol handling and policies.

Category: Extensibility

What are common mistakes when deploying Envoy?

Hardcoding static configs, ignoring health checks, and missing circuit breakers can cause outages and cascading failures.

Category: Mistakes

Is Envoy suitable for gRPC?

Yes, Envoy natively supports gRPC, providing load balancing, retries, and observability for gRPC services.

Category: Use-case

How does Envoy handle TLS?

It supports TLS termination, mTLS for service meshes, and dynamic certificate rotation via SDS.

Category: Security