repository·main·Indexed 12 days ago
https://github.com/envoyproxy/envoyA cloud-native, high-performance edge, middle, and service proxy designed for microservices-oriented architectures and hosted by the CNCF. It features a universal data plane API defined via Protocol Buffers, including the envoy.api.v2 namespace for xDS definitions, and provides specialized filters such as the jwt_authn HTTP filter for JWT verification and extraction.
The Envoy Docker distribution consists of the following key files:
Dockerfile-envoy: The primary Dockerfile used for building Envoy container images.buildd.sh: A script used in CI environments to build Docker images.docker-entrypoint.sh: The entrypoint script executed when an Envoy container starts.The Datadog Tracer is an Envoy extension that provides distributed tracing capabilities using Datadog. It acts as a wrapper around the dd-trace-cpp library (Datadog's core C++ tracing library).
To integrate with Envoy, the extension implements several core Datadog interfaces using Envoy-specific components:
EventScheduler (implemented via Envoy's Event::Dispatcher) to periodically send batched traces to the Datadog Agent.AgentHTTPClient (implemented via Envoy's Http::AsyncClient::Callbacks) to send traces to the Datadog Agent via HTTP POST requests.Logger (implemented via spdlog::logger) for error diagnostics and configuration banners.Envoy supports a wide range of configurable timeouts across different layers of the networking stack. Depending on your deployment (HTTP/gRPC, TCP, or Transport Socket), you may need to configure specific timeout settings to ensure stability and prevent resource exhaustion.
Note: This documentation provides a summary of the most important timeouts but is not an exhaustive list of all configurable timeouts supported by Envoy.
Envoy Mobile is an iOS and Android client networking library built using Envoy as its core. Unlike the server-side Envoy proxy, which is a self-contained process, Envoy Mobile is distributed as a library designed to be compiled directly into mobile applications.
The project aims to extend the benefits of a service mesh (observability, consistency, etc.) from the data center edge directly to the mobile client, allowing developers to reason about the entire distributed system network.
Envoy uses an HTTP router filter to perform advanced routing tasks. This filter is used for:
host or authority HTTP headers to reach specific upstream service clusters.At a high level, the router matches an incoming HTTP request to an upstream cluster, acquires a connection pool to a host in that cluster, and forwards the request.
google/jwt_verify_lib. This library is used within Envoy to validate the authenticity and integrity of JWTs, typically used for identity and access management in proxy configurations.Envoy provides several built-in Thrift filters that can be used within a filter chain to process Thrift-encoded traffic. These filters allow for inspecting headers or payloads and converting them into Envoy metadata, applying rate limiting, or routing traffic based on Thrift content.
Available built-in Thrift filters include:
header_to_metadata_filter: Extracts Thrift headers and populates Envoy metadata.payload_to_metadata_filter: Extracts information from the Thrift payload and populates Envoy metadata.rate_limit_filter: Applies rate limiting based on Thrift-specific information.router_filter: Handles the routing of Thrift requests.Watchdog is a set of features in Envoy used for monitoring and diagnostic actions (such as backtracing or profiling) when specific conditions are met.
Note: Watchdog features are not supported on Windows.
Watchdog configuration is organized under the watchdog API namespace. Available sub-features include:
The Envoy repository is organized into several top-level directories that separate core logic, extensions, configuration, and documentation. Understanding this layout helps in locating source code, finding example configurations, or identifying where to add new extensions.
api/: Envoy data plane API definitions.bazel/: Configuration for the Bazel build system.configs/: Example Envoy configurations for testing or reference.contrib/: Non-core (contrib) extensions. See EXTENSION_POLICY.md for details.docs/: End-user documentation for the Envoy proxy and data plane API.envoy/: "Public" interface headers for core Envoy (mostly abstract classes).mobile/: Envoy Mobile library for iOS and Android.source/: The primary location for core Envoy source code and extensions.test/: Test suites for core Envoy and extensions.third_party/: Third-party dependencies.tools/: Miscellaneous development tools.Envoy provides several built-in network filters that can be used within a listener configuration. While the HTTP connection manager is the most common way to handle application-layer traffic, network filters allow you to intercept and process raw TCP/network traffic.
Common use cases for these filters include:
mysql_proxy_filter, redis_proxy_filter, mongo_proxy_filter, or thrift_proxy_filter.rbac_filter, ext_authz_filter, or tls related filters.local_rate_limit_filter, connection_limit_filter, or tcp_bandwidth_limit_filter.wasm_filter or golang_filter to run custom logic.Each filter is configured within the network_filters section of a listener's configuration.
/* Example conceptual structure of a listener with a network filter */
listener:
address: ...
filter_chains:
- filters:
- name: envoy.filters.network.tcp_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
...The Set Metadata filter adds or updates dynamic metadata with static or dynamically formatted data. This metadata can be consumed by other filters, used for load balancing decisions, included in access logs, or used for routing decisions.
Key features:
google.protobuf.Struct) and typed metadata (google.protobuf.Any).allow_overwrite setting.To configure this filter, use the type URL: type.googleapis.com/envoy.extensions.filters.http.set_metadata.v3.Config.
# Example of the filter type URL
type_url: type.googleapis.com/envoy.extensions.filters.http.set_metadata.v3.ConfigThe Envoy documentation is organized into several key sections to help you understand, deploy, and extend the proxy: