►
From YouTube: Intro: Envoy - Lizan Zhou, Tetrate
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro: Envoy - Lizan Zhou, Tetrate
Envoy is a high-performance proxy in the cloud-native landscape designed to be extensible at its core. There are several possible “extension points” in Envoy as outlined in https://github.com/envoyproxy/envoy/tree/master/source/extensions. However, the currently available approaches to extend it is rather limited. Since Envoy is written in C++, the primary way to introduce new extended functionality in Envoy is by writing an extension (e.g. filters, either network or HTTP filter, as one of the most relevant use-cases in Envoy), in C++. It is possible to write an extension for Envoy using Lua (https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/lua_filter.html), but the current scope of this extension is only for HTTP traffic.
https://sched.co/MPhd
A
A
I
will
spend
probably
half
of
the
time
to
explain
the
Envoy,
a
brief
of
the
history
and
how
it
is
used,
what
problem
it
solves
the
configuration
model
etc
and
spend
the
rest
half
time
for
Q&A.
So
it's
more
like
Q&A,
and
so
ok
before
I
begin
my
session.
How
many
of
you
guys
are
using
amboy
in
your
development.
A
A
Okay,
so
this
is
likely
basically
the
problems
that
statements
for
the
micro
service,
networking
so
I
think
if
you're
running
micro
service
in
the
relatively
large
cluster,
you
will
have
this
problem.
So
basically
the
networking
are
handled
by
usually
by
libraries.
If
you
are
not
using
my
so
there's.
A
Languages
that
you
might
use-
and
there
are
different
frameworks
like
finagle
spring
Ruby,
on
Rails,
like
different
language,
different
frameworks
and
different
protocol-
and
you
use
your
PC-
you
use
database
use
you.
Of
course
you
have
the
HTTP
to
handle
the
external
Network
calls
and
there's
several
different
stacks.
Getting
yours,
and
also
you
have
two
infrastructures
some
might
be
on.
Prime
Sun
might
be
on
the
cloud
you
have
the
different
load,
balancers,
5lb,
Google,
car
load,
balancer,
etc,
and
the
observability
eligibility
is
not
consistent.
Anyway,
they
have.
You
have
stars
tracing
logging
and.
A
B
A
Authentication
and
authorization
is
handled
by
a
different
point,
like
you
have
the
perimeter,
security
and
load
balancer
in
the
edge
proxy,
and
you
you
also
want
to
have
the
service
to
service
or
authentication
handled
by
the
framework
each
service
is
handled.
So
those
are
like
the
problem
that
I'm
going
to
solve.
A
So
unless
you
are
like
you're
in
really
like
big
company
that
have
like
consistent
framework
managing
for
every
languages,
every
service
in
your
company,
then
the
this
will
be
a
very
hard
situation
to
solve
and
there's
the
micro
service
is
incredibly
well
painful
to
upgrade
when
the
library
have
some
security
vulnerabilities
so
and
the
visibility
is
not
consistent.
So
that's
what
envoy
is
introduced.
So,
basically
the
concept,
the
very
basic
concept
of
envoy
is
that
the
network
and
the
network,
the
features
are
wrong.
Network
should
be
like
really
transparent
to
the
application.
A
So
what
that
mean
is
like
the
if
you
do,
the
deployment
model
have
a
void
in
between
and
what
will
handle.
Most
of
the
network
features
you
you
want
to
use
on
behalf
of
your
application,
so
the
deployment
model
here
is
like.
If
you
want
to
avoid
your
handle
service
to
service
communication,
it
will
be
deployed
at
sidecar.
A
B
B
A
A
It's
not
so
it
can
be
upgraded
independently
from
your
application,
your
service
and
then
the
code
base
is
a
very
modern
C++
14
code
base
that
will
allow
a
very
high
performance
and
also
it
it's
a
key
for
to
achieve
low
latency,
especially
for
the
tail
latency.
In
the
case,
the
future
architecture
is
interesting.
A
We
have
the
elf
for
theater
architecture,
basically,
it
handles
at
TCP.
Currently,
the
we
also
have
in
development,
quick,
which
will
be
like
next
couple
quarters.
The
elf
for
architecture
allows
am
going
to
operate
in
different
protocols,
so
the
one
of
the
major
use
case
is,
of
course,
HTTP
and
HTTPS,
but
we
also
support
other
protocol
like
we
have
mongrel
extension,
we
have
my
circle
support.
We
have
Redis,
we
have
double
and
etc.
A
Those
are
like
basically,
the
extension
point
that
my
can
have
so
the
this
allows
us
to
basically
exchange
that
you
different
protocols
and
basically
the
basics
TCP
proxy-
can
be
also
used
if
you,
if
you're,
if
boy,
doesn't
know
what
application
layer
protocols,
but
the
feature
will
be
limited
to
what
we
can
get
from
TCP
layer,
though
it
can
handle
the
TCP
proxy
as
well.
The
l4
filter
architecture
is
simple,
but
very
strong.
Just
a
lot
of
extensions
for
this,
like
the
authentic
authorization
are
back.
A
So
the
HTTP
are
back
like
a
still
mixer
like
API
management.
Stuff
can
be
implemented
in
this
layer
as
well,
but
it
is
very
strong
and
the
also
another
good
thing
is
that
we,
as
the
time
of
my
being
build
the
HTTP
2,
is
almost
was
almost
there.
So
the
Envoy
was
built
with
HTTP
2.
First,
it
has
the
concept
of
the
HTTP
remote
practicing
stuff
that
have
so
it's
it's
support
from
supports
job.
A
Some
like
HTTP
2,
based
protocol
accuracy
from
it's
very
beginning,
post
in
the
downstream
side
and
upstream
side,
so
HTTP
2
is
not
just
for
edge.
I
can
also
this
also
provide
efficiency
that
if
your
service
to
service
call
is
actually
http/1
the
service
once
my
handle
them
and
what
can
be
can
upgrade
them
to
h3,
to
which
is
makes
the
network
more
efficient,
authentication
and
authorization
is
also
supported.
A
Mutual
TOS
is
the
basic
authentication
for
the
service
to
service
call,
and
we
have
also
the
HTTP
authentication
and
also
our
bank
based
authorization
as
well.
So
basically,
this
is
like,
if
you
use
the
Envoy-
and
we
can
do
this
for
you
and
that-
and
let's
talk
a
little
bit
more
about
the
configuration
model
that
I
mentioned
earlier.
B
A
Basically,
my
serve
standard
Universal
data
plan.
Here
we
do
have
the
XDS
a
configuration
area
model
which
stands
for
the
discovery
service.
So
we
have
I.
Think
I
only
have
two
example
here:
there's
listener
discovery,
service
and
cluster
discovery
service,
which
based
basically
stands
for
the
water
connection
from
the
downstream
and
what
the
upstream
is
cluster
and
we
also
have
the
couple
more
discovery.
Service
called
like
RDS
is
the
route
discovery
service
for
the
HTTP
route.
A
How
you
met
the
virtual
host
passed
to
the
which
cluster
you
are
routing
the
traffic
to
we
have
two
SDS,
which
is
the
secret
discovery
service
that
in
responsible
for
delivering
key
TRS
key
insert
and
any
sensitive
information
that
is
separated
from
the
LDS
mcds.
The
EDS
is
to
basically
deliver
the
end
point
for
each
caster's,
so
the
configuration
API
is
streaming
and
we
support
your
PC
streaming
and
Jason
and
llamó
which
the
the
schema
is
defining
proto
3.
So
those
can
be.
A
Programmatically
generated
the
central
manage
management
system
control,
the
flip,
the
Envoy,
to
avoid
the
like
the
proxy,
like
you
have
to
configure
the
proxy
for
every
service
or
every
instance
of
em
boy.
We
basically
in
a
major
use
cases
and
what
can
be
bootstrapped
with
a
very
standard
bootstrap
config
for
every
convoy.
Basically,
you
just
have
ok.
Here
is
my
control
plane
server.
A
You
should
and
we
should
get
a
rest
after
config
from
this
configurate
control.
Plane,
server
and
envoy
can
take
care
by
the
management
server
from
there
so
which
is
very
convenient.
You
do
a
large-scale
deployment
and
also
you
don't
have
to
do
the
manual
reload
or
like
to
load
the
new
listeners
and
you
load
new
classes.
A
So
this
is
like
very
brief.
History
I
started
working
one
after
it.
It
was
open
sourced.
This
is
like
a
very
incredible
reductions.
We
now
have
like
more
than
this.
This
is
like
only
a
part
of
the
adoption
that
is
public
published
in
in
envoy
website,
so
we
are
glad
to
see
more
adoption,
so
this
is
actually
last
night
so
and
I
want
to
spend
more
time
on
the
Q
&
A
so
and
we
have
a
great
development,
a
great
community.
We
want
to
thanks
to
that
and
we
have
extensibility.
A
A
For
the
question
is
what
the
options
for
management
plan
there
are
several
solutions
out.
There
I
think
one
is
obviously
sto
and
there's
some
company
develop
different
control.
Plane
like
solo,
have
to
do,
and
they
do
I
have
ambassador,
basically
there's
different
options,
and
also
you
can
build
your
own
control
plane
since
control
plane
is
more
opportunity
of
opinionated.
A
Some
I
know
some
of
the
big
companies.
They
just
develop
their
own
control
plan
to
connect
to
their
own
like
service
management
stuff.
In
my
proxy
project,
we
do
have
the
basic
layer
four
for
you
to
build
your
like
control
plane
like
we
have
to
go
control,
plane
and
javac.
Entrepreneur
is
basically
generated
code
from
the
protocol,
buffers
plus
a
little
bit
of
plus
alpha
utilities,
and
that
you
can
build
control
plan
from
there
as
well.
I
think
yeah.
C
D
A
D
A
So
I
think
so,
of
course
you
have
to
deploy
like
this
scale
of
scale
and
we're
all
to
multiple
instances
as
much
to
handle
your
traffic
and
I
mean
that's
like
from
there
like
from
big.
You
have
the
network
load
balancer,
probably
more,
like
lowly
a
load
balancer
first,
and
you
also
can
make
use
like
DNS,
Ron,
Robbins
stuff
to
resist
split
the
traffic
out
and
to
each
each
of
my
instance,
and
down
to
the
each
instance
levels.
Yeah,
so
I
think
it's
it's
not
different!
A
E
E
E
A
Oh
yeah
so
I
think
the
in
general
generally,
like
each
service
trees.
Its
request
going
through
my
the
average
latency
is
lower
there,
one
millisecond
so
and
of
course,
there's
just
a
few
costs
as
well.
So
basically,
that's.
That
is
the
cost
that
you
are
paying
for
the
features
that
you
get
for
a
phone
from
envoy
and,
of
course
the
complicated
configuration
will
cost
you
more
like
latency
or
like
CPU
costs
as
well.
If
you
do
like
external
call
for
the
authorization
of
course
that
add
on
top
of
the
latency,
that
of
them
would
cost.
A
A
F
A
So
the
eventually
consistent
configuration
API
is
means.
Basically,
so
we
are
trying
to
improve
the
consistency
of
the
discovery
service
API
in
terms
of
the
eventual
consistent
means,
if
you
use
the
different
set
of
discovery
service
API
independently,
you
have
to
listener.
But
you
have
you:
have
a
listener
have
a
route
to
route
it
to
some
cursor,
but
the
cluster
is
not
delivered
yet
so
that
you
have
we,
you
have
to
wait
till
all
the
the
configuration
places
needed
for
the
whole
configuration
be
there
to
serve
the
given
traffic,
but
the
other
traffic
is
not.
A
A
So,
like
the
first
question
is,
do
we
avoid
support
gos
offload?
The
answer
is
the
short
answer
is
no.
We
don't
do
DTS
offload
with
current
implementation.
We,
the
transport
socket
which
handles
the
TRS,
is
extensible.
We
will
look
into
that.
If
someone
raised
the
issue
and
have
the
demand
for
that,
basically,
the
architecture,
we
can
support
that,
what
we
don't,
we
just
don't
have
the
implementation.
Yet.
Can
you
repeat
your
second
person.
F
So
we
are
basically
artists
for
any
upstream
I
mean
a
Cal
check
will
be.
Was
that
compatible
between?
If
so,
alpha
right
now
support
many
things
right
is.
It
has
like
TCP
I
mean
like
L
for
TCP
row
TCP,
it's
also
as
design
said
we
have
like,
upstream
in
in
Redis
and
also
in
MongoDB,
so
we
have
correspondent
hashtag
for
that.
So
the
health
check
is
one
of
the
extension
point.
If
you
have
another
another
upstream,
that
speaks
different
protocol.
Basically,
you
can
create
your
own
health
checking.
H
H
A
A
Right
I
think
the
service
conservation
concept
is
really
new.
The
like
I,
we
saw
some
like
support
for
the
image
like
in
energy
access
wall,
so
the
like
the
comparison
between
them.
I
really
don't
have
like
real
data
for
that,
but
the
like
compared
to,
if
you
compare
like
and
as
a
proxy,
compared
to
any
X
or
H
a
proxy,
the
dynamic
configuration
API
is
really
unique
parts
of
an
boy
and
the
community
is
a
little
bit
different
in
a
way
we
don't
have
like
we're,
not
a
commercial,
backed
product
open
source.
H
C
C
Correctly,
what's
the
status
there
and
how
does
it
play
with
XDS?
The
second
question
is
about
like
plugins
and
like
we
I
mean.
As
far
as
I
know,
you
do
have
the
possibility
of
extending
using
Lua
plugins.
What's
the
status
there
is
there
central
repository
where
it's
possible
to
find
more
plugins
and
stuff.
A
A
We
actually,
we
have
formed
a
new
working
group
in
CNCs
called
new
DPA,
which
is
the
universal
data
plan,
API
working
group
to
standardize
the
API,
based
with
the
XDS
API,
based
on
the
current
avoid
implementation.
They
are
semi
is
more
about
how
to
orchestrate
the
interface
between
control
frames
with
the
service
discovery
stuff
there.
So
it
is
less
involving
into
the
data
plan
here,
and
we
do
you
can.
As
a
second
question.
F
So
you
have
correct
me
if
I'm
wrong
I
mean
like
so
you're
asking
about
the
Lua,
plugins
or
extensibility
of
envoy
stuff
like
that
so
yeah,
okay,
so
yesterday,
I
had
talked
with
John
here
about
an
unfulfilled
instance
ability.
So
we
have
a
couple
of
choices
on
how
we
understand
envoy.
The
first
one
is,
of
course
you
can
write
your
own
C++
extension
that
it
will
be
compiled
in
into
your
binary.
So
basically,
we
have
pretty
much
several
extension
points
inside
and
for
itself.
The
first
one
is
the
listener
you
can
basically
have.
F
You
can
basically
design
your
way
to
put
your
own
extension
in
listener
level.
So
basically
one
example
is
like
TCP
I'm,
sorry
TLS
inspector.
So
basically
you
can
check
the
sni
of
a
connection.
You
can
something
like
that
and
the
common
use
cases
will
be
HTTP
filter.
So
this
example
like
this
any
authentication
external
to
the
keygen.
Something
like
that.
So
you
can
do
that.
Okay
in
the
way
of
the
methodology
on
introducing
extensions
one
for
the
first
one,
is
that
c-plus
person
second
one,
will
be
Lua
well.
F
The
lower
support
in
alpha
is
not
that.
Well,
not
mature
enough,
but
it's
I
think
it's
sufficient
for
many.
These
cases
it's
it's
there,
but
mostly
only
for
HTTP.
It's
not
I
mean
currently
is
not
available
for
alpha
level,
TC
2
levels
and
the
third
one
that
we
want
to
introduce
what
we
introduced
yesterday.
F
A
A
B
I'm
interested
in
the
case
of
where
somebody
where
people
are
using
a
service
mesh
together
with
message
brokers
in
that
case,
presumably
the
the
mesh
won't
be
able
to
detect
the
trace
when
the
traffic
is
going
through.
The
broker
so
I'm
wondering
what
what
solutions
are
available
for
people
who
have
that
use
case,
whether
they
have
to
implement
their
own
tracing,
where
they
have
to
put
the
tracing
libraries
in
their
code.
In
that
in
that
case,
or
if
there
are
any
alternatives.
F
To
do
its
racing,
basically,
we
we
still
have
to
deal
with
the
application
level
library,
and
that
means
you
need
to
to
basically
pass
around
the
headers,
the
BT,
the
headers,
from
the
request
and
response
I
mean.
Basically,
you
need
to
propagate
the
headers,
but
but
yeah
envoy
itself
has
trace
its
health,
its.
It
supports
many
several
several
tracing
implementation
like
Zipkin,
Jaeger
and
and
any
other
compatible
open
tracing
mechanism.
A
The
limitation
here
is
that
my
can
inspect
the
incoming
requests
or
like
outgoing
requests,
like
each
individual
request
and
add
a
span
that
were
involved
in
to
them.
The
limitation
of
the
model
here
is
what
cannot
correlate
the
incoming
requests
that
go
into
into
application
and
the
application
initiate
another
request.
Then
my
have
no
information
to
correlate
those
two
into
same
trace
context,
so
that
that's
what
application
have
to
do
to
propagating
the
incoming
one
to
outgoing
one,
or
vice
versa,.
F
Basically,
you
have
like,
for
example,
like
you
have
arm
for
in
front,
and
then
you
have
your
application
in
in
the
middle
and
then
when
you
do
the
outdoor
requests
you
have
artfully
responsible
for
data
store
right
so
in
between
this
harmful,
doesn't
know
anything
about
the
application,
logic
and
stuff
right.
So
you,
basically
the
application
responsible
for
for
Mehcad,
making
sure
that
the
header
is
propagated
properly.