►
Description
In this Hoot live stream series we dig into Envoy, the cloud-native proxy technology that drives the data plane for major service meshes (Istio, Consul Connect, AWS AppMesh, etc) and API Gateways like Gloo. Starting from the fundamentals, each demo-filled episode focuses on one functional area like observability, customization, security and more -- to help you get a deep understanding of how Envoy Proxy works, it’s role in cloud-native application architecture, and how to use it.
Hosted every other Tuesday starting on July 21st at 1pm Eastern / 10am Pacific Time.
* Envoy Architectural Overview and Fundamentals
* Observing Envoy: Monitoring Metrics and Logs, Proxy Performance, and Troubleshooting
* Securing Envoy: Understanding Available Security Configurations and Best Practices
* xDS Dynamic Configuration and Control Plane Interactions with Envoy Proxy Data Plane
* Envoy Filters: What are They and How They Work, Understanding the Filter Chain, and Lots of Examples
* Advanced Envoy Filtering and Build Your Own Filters with WebAssembly
Learn More
About Solo.io https://solo.io
Questions? https://slack.solo.io
About Envoy https://envoyproxy.io
Code Samples: https://github.com/solo-io/hoot
Suggest a topic to cover here: https://github.com/solo-io/hoot/issues/new?title=episode+suggestion:
A
A
So
today,
we'll
just
start
with
android
basics
kind
of
the
motivation
for
unvoice
some
core
concepts
and
we'll
do
some
demos
in
the
end
play
around
with
it
and
see
how
we,
how
it
works
and,
of
course,
if
there's
any
questions,
feel
free
to
ask
in
the
chat
all
right.
Let
me
start
my
slideshow
so
intro
to
envoy.
A
A
A
So,
unlike
software
like
nginx,
you
don't
need
to
manage
a
configuration
file
on
a
server
or
anything
like
that.
The
configuration
is
deployed
through
a
configuration
channel,
usually
a
grpc
connection,
to
a
control,
plane
server
that
distributes
this
configuration
and
that
allows
a
lot
of
various
deployment
patterns.
It
allows
for
rapid
scale
out
and
easier
configuration
management
right
so
think
about
kubernetes,
where
everything
is
immutable.
A
A
What's
going
on,
there's
no,
you
can't
just
go
into
a
machine
and
see
because
it's
only
one
machine
out
of
a
thousand,
so
anway
has
tracing
and
metrics
that
allow
you
to
understand,
what's
going
on
and
has
a
rich
set
of
of
these
metrics,
so
you
can
see
exactly
what's
going
on
with
the
samba
instance,
so
that
kind
of
what
made
envoy
so
popular
and
why
we
call
it
the
cloud
native
proxy.
Now,
additionally,
there's
no
envoy
plus
right,
there's
only
open
source
upstream
android
and
you
can
see
it
on
github
everything.
A
Every
angry
feature
lands
in
there,
all
right.
So
moving
on.
Let's
talk
a
little
bit
about
core
concepts
in
envoy.
There
is
a
always
essentially
a
proxy
and
a
proxy
receives
data
manipulates.
It
potentially
and
then
sends
it
away
right
and
the
way
we
tell
android
to
receive
data
is
we
create,
what's
called
a
listener,
a
listener.
Instructs
android
to
listen
on
a
specified
port,
accept
incoming
connection
and
do
something
with
them
right
and
that
something
is
user
defined.
The
way
the
user
defines
it.
It's
it's
called
using
filters.
A
So
essentially,
when
only
gets
data
from
the
listener,
it
sends
it
through
a
chain
of
filters
and
those
filters
decide
what
to
do
with
the
request
and
usually
there'll
be
a
filler
that
sends
their
this
data
upstream
somewhere
right
so
a
listener
just
and
it's
a
bit
of
a
cilcular
dependency,
because
I'm
talking
about
filters
before
I've
defined
them,
but
a
listener
takes
in
a
tcp
connection.
They
send
the
data,
does
something
with
the
data
with
pieces
of
code
that
are
called
filters,
and
usually
one
of
them
will
send
it
upstream
now.
A
A
You
can
and
you
can
also
configure
them
dynamically
using
a
protocol
called
eds
endpoint
discovery
service.
So
in
the
android
terminology,
you'll
see
it
called
endpoints.
You
see
it's
mentioned
by
a
cluster
membership,
and
you
see
it
also
been
called
cluster
load
assignment
in
general.
They
refer
to
the
members
endpoints
list
of
ipn
ports
that
are
part
of
a
cluster.
Now
the
assumption
is
that
all
these
endpoints
implement
the
same
api
and
we
any
data
or
request.
That's
meant
for
the
cluster
could
end
in
any
of
these
endpoints,
all
right.
A
A
If
the
path
is
full,
send
it
to
cluster
a
if
the
path
is
bar,
send
it
to
cluster
b,
and
once
we
open
up
some
android
config,
we
can
show
an
example
of
that
now.
The
last
con
core
concept
I
want
to
discuss
is
filters,
so
a
filter
in
envoy.
I
know
it
has
various
extendability
points
and
a
filter
is
one
of
these
ways
that
you
can
extend.
Envoy
filter
is
essentially
a
piece
of
code
that
interacts
with
incoming
data
and
can
do
something
with
it
it
doesn't
have
to,
but
it
can
so.
A
A
For
now,
filters
are
a
piece
of
code
that
can
be
added
into
envoy.
That
does
some
or
can
do
some
manipulation
to
the
request,
all
right.
So
let's
talk
a
little
bit
about
the
flow
of
the
data,
so
we
have
a
downstream
client
like
an
app
or
your
phone
app
your
website,
your
react,
app
that
sits
on
the
internet
and
sends
a
request
to
the
backend
right.
As
we
discussed.
This
request
ends
up
in
a
listener.
A
A
One
of
the
endpoints
in
the
cluster
will
be
selected
for
routing
and
the
data
will
be
sent
there,
so
it
comes
from
the
downstream
through
the
listener,
one
by
one
through
the
filters
in
the
filter
chain
and
during
which
a
decision
is
made
to
where
to
route
the
request.
So
the
routing
decision
is
made
in
the
filters
a
cluster
is
selected
and
within
the
cluster
a
host
is
selected
or
an
endpoint,
and
then
the
data
gets
sent
there.
A
Now,
let's
understand
a
little
bit
about
the.
How
that
this
routing
decision
is
done
so
envoy
has
basically
a
listener,
has
a
list
of
tcp
filters,
and
these
tcp
filters
can
interact
with
tcp
data
right.
They
can
read
bytes
and
write
about
one
of
those
tcp
filters
is
called
the
http
connection
manager
and
that
filter
kind
of
turns
envoy
into
an
l7
or
an
http
proxy
right.
So
this
filter
reads:
bytes,
write,
bytes
and
converts
that
into
an
http
request
with
header
and
body
and
trailers.
A
A
A
So
probably
99.99
of
android
configurations
that
use
the
http
connection,
manager
you'll
see
a
router
filter
and
it
will
be
in
the
end
of
the
http
filter
chain,
all
right.
So
I
think
that's
enough
background
for
the
demos
we're
gonna
going
to
do
and,
of
course,
if
there's
questions,
I'm
looking
at
the
chat
so
feel
free
to
ask-
and
I
will
answer
them
and
with
that,
let's
go
and
see
the
demos
I've
prepared
for
us.
A
All
right
here
we
go
so
examples
and
we'll
start
with
simple
just
to
show
that
envoy
is
a
tcp
proxy
as
well.
I've
prepared
a
small
tcp,
echo
server.
All
that
it
does
is
copy,
the
whatever
stream
of
data
it
received
to
the
response,
and
now,
let's
review
the
android
configuration
to
proxy
this
simple
tcp
server,
so
you
first
start
with
an
admin
part.
A
For
now,
what
we
care
about
is
the
unvoice
static
resources
and
in
the
future,
we'll
talk
about
dynamic
resources
for
now,
we'll
just
start
with
the
static
resources,
just
as
a
as
a
way
to
start.
So,
as
you
can
see
like
we
talked
about
in
the
android
core
concepts,
we
have
a
list
of
listeners
and
a
list
of
clusters
and
listeners.
It
means
the
port.
Android
listens
on,
and
clusters
are
the
destination
of
traffic.
A
A
A
A
A
Let's
see
how
we're
starting
with
slogs
nc
installed
in
my
toolbox,
so
I
can
now
echo
hi
to
netcat
and
netcat.
If
you're
not
familiar,
it's
a
utility
that
will
connect
to
whatever
you
tell
it
to
connect
and
will
pipe
std
in
and
out
to
that
to
the
tcp
connection
you
just
made.
So
you
can
echo
hi
and
you
can
see
that
I
get
high
back
so
echo
hi
internet
cat
net
could
send
this
into
envoy
and
we
send
it
into
the
tcp
server.
A
Tcp
server,
replied,
hi
back,
send
it
through
envoy,
send
it
through
netcat
that
printed
it
in
the
shell
all
right.
So
that's
a
simple
tcp
configuration
and
let
me
just
kill
all
the
programs
here
all
right.
So
let's
talk
about
http
now,
so
I've
prepared
also
an
http
echo
server
and
it's
essentially
the
same.
A
It
just
echoes
the
http
body
of
the
request
that
it
received
and
let's
see
how
we
configure
envoy
to
use
an
a
proxy
this
service,
it's
a
very
simple
http
configuration
and
as
before,
we
have
a
cluster
list
this
time,
instead
of
using
the
all
deprecated
host
configuration,
which
I
used
in
the
first
example
for
simplicity,
I'm
using
the
newer
load
assignment
configuration
it's
essentially,
it
allows
you
to
do
more
things,
but
this
specific
configuration
is
equivalent
to
what
we've
seen
a
second
ago.
It
just
configures
an
address
and
a
port.
A
So
we
have
here
the
cluster
and
it
has
it
slowed
assignment,
which
is
essentially
the
the
list
of
endpoints
the
members
and
it's
like
before.
Just
one
address
import
moving
on
to
the
listeners,
and
you
can
see
that
I
still
listen
on
the
same
port
still
have
one
filter
chain,
but
this
time
in
the
filter
chain,
I
don't
have
the
tcp
proxy
filter.
I
have
the
http
connection
manager
and
the
http
connection
manager
converts
envoy
from
an
l4
or
a
tcp
proxy
to
an
l7
or
http
proxy
right.
A
A
So
a
route
config
is
composed
of
virtual
host.
A
virtual
host
has
a
name
which
is
not
important
right
now,
and
it
has
the
domain.
So
asterix
means
any
domain,
and
this
is
this
will
match
the
host
header
in
the
http
request,
and
then
we
have
the
routes,
the
list
of
routes
and
the
list
of
routes
is
composed
of
a
matcher
and
a
route
action.
So
we
match
on
prefix
slash,
which
effectively
means
any
request,
and
we
what
we
do
with
eric
with
the
requested
match.
We
send
it
to
a
cluster
called
sum
cluster.
A
In
order
for
anything
to
actually
happen
here,
I
have
to
define
http
filters
and
you
can
see.
I
only
have
one
filter,
the
envoy,
http
router
and
that's
the
filter
that
I
must
have
here,
and
it
must
be
less
in
order
for
traffic
to
reach
to
some
cluster
to
my
cluster
called
some
cluster,
because
the
router
filter
is
the
filter
that
performs
the
connection
to
the
upstream
cluster.
A
So,
let's
do
this
all
right,
so
envoy
is
working
and
now,
instead
of
using
netcat,
I
can
use
curl.
I
can
curl
and
you
can
see
I
get
high
back.
I
can
do
hello
instead
and
hello
back
so
essentially,
let's
go
over
the
configuration
traffic
reach
to
the
listener
to
port
10
000.
It
went
through
the
filter
chain
to
the
http
connection
manager,
tcp
filter,
the
http
connection
manager,
parses,
the
tcp
stream
into
http,
request
and
response.
A
It
performs
the
routing
decision
and
see
that
and
decide
that
it
needs
to
go
to
the
cluster
sum
cluster
and
then
sends
it
down
the
filter
chain.
In
this
case,
we
only
have
one
filtered
http
router
that
sends
the
request
to
that
destination
and
then
it
all
happens
in
reverse.
The
destination
returns
a
response
flows
back
through
the
filters
and
back
to
the
client.
A
A
All
right.
We
we
will
demonstrate
how
to
use
the
course
android
filter
to
inject
chorus
header
to
a
request
and
that's
something
very
common
when
doing
web
development.
So,
let's
review
the
filter
configuration
so
like
before
we
have
the
cluster
it's
similar
to
before
so
I'll
just
collapse.
It
here
to
get
it
out
of
the
way.
A
So
the
course
configuration
says
that
if
the
origin
is
solo,
I
o
and
essentially
add
the
course
matters
allow
the
origin,
and
in
order
for
this
configuration
to
have
any
effect,
we
have
to
add
the
course
filter
before
the
router
filter
right
if
it
was
reversed.
If
I
were
to
do
this
specifically
nowadays,
they
safeguard
against
this
an
unbelievable
error,
but
the
other
filter
sends
the
request
upstream,
so
any
filter
after
it
does
not
get
executed.
A
I
see
a
question
on
chat.
Can
you
give
an
example
where
this
I
have
more
than
one
filter
chain?
Yes,
so
in
that
case,
if
multiple
filter
shine
are
mainly
used
for
sni,
the
request
will
only
go
to
one
filter
chain
and
the
question
is
which
filter
chain.
So
if
you
have
sni,
where
you
do
ssl
level
routing
to
different
hosts
based
on
the
sni
header
in
the
ssl,
then
a
different
filter
chain
may
be
selected,
but
a
connection
belongs
to
one
filter
chain
right.
A
So
a
request
will
only
be
in
one
connection
and
connection
is
only
in
one
filter
chain
and
what
do
the
type
mean
in
the
type
config
a
very
good
question?
So
the
answer
is
that
android
configuration
is
not
meant
for
people,
it's
meant
for
machines
and
because
envoy
is
extendable,
the
code
that
reads
it
needs
to
know
to
which
internal
component
it
belongs
to
right.
So
this
type
essentially
hints
and
void
to
which
internal
component
to
create
and
provide
this
configuration
right
because
of
android
is
extendable
and
we
want
to
make
it
easy
to
extend.
A
A
And,
let's
see
it's
shining
an
mri,
yes,
so
shine
them
on
envoy
via
config
via
xds.
We
have
that
planned
in
in
the
list
of
talks,
and
we
have
one
specifically
for
xds
and
so
that's
going
to
be
up
in
the
future.
How
does
the
request
and
their
reply
go
through
the
filler
chain?
How
is
it
applying
my
specific
requests?
So
an
envoy
has
an
internal
stream
abstraction
that
represents
both
the
reply
and
the
request.
A
So
when
the
request
goes
through
the
filter
chain,
there's
an
object
that
holds
its
state
and
when
it
we
get
a
response.
We
know
where
to
associate
it
to
now.
It's
different
between
http1
and
http
2
with
http
1.
It's
on
the
same
connection.
So
once
you
get
a
response,
we
know
the
connection
and
we
know
to
associate
it
to
the
right
stream
in
http
2.
A
You
have
a
stream
id
that
associates
the
response
to
the
request
either
way,
anvi
keeps
track
of
it
and
knows
how
to
do
it
and
what
does
glue
and
the
edge
over
android
so
glue
is
a
control
plane
for
envoy
and
the
distribution
of
android.
So
we
have
our
own
version
of
envoy.
We
take
envoy
upstream
and
extend
it
by
adding
more
custom
filters.
A
For
example,
we
have
a
transformation
filter
that
can
perform
advanced
body
transformations
to
request
and
we've
seen
that
very
popular
with
customers
who
are
transitioning
from
a
different
product
onto
onpoi,
so
yeah
and
in
addition
glue
is
a
control
plane
where
you
do.
It
allows
you
to
have
a
more
service
approach
to
self-service
approach
to
android
configuration
where
you
don't
need
to
deal
with.
Writing
configuration
files
like
we
do
here
and
again
we're
going
to
see
examples
of
that
as
we
go
down
and
this
series
of
talks.
A
A
I
hope
that
answers
of
all
the
questions,
if
not
feel,
feel
free
to
write
some
more
and
continuing
with
the
course
example.
So,
like
we
said
we
have
here,
two
filters,
cores
and
router
cores
will
read
this
course.
Configuration
and
inject
course
headers
if
needed,
and
the
router
will
send
the
request
upstream.
A
All
right
and
now
we
can
send
a
request
to
a
example
or
with
example.com
origin,
and
you
can
see
that
there's
nothing
special
about
the
response,
but
if
we
send
a
request
to
with
origin
solo,
I
o
you
can
see
that
the
course
filter
kicked
in
and
added
the
access
control.
Allow
origin
header
to
the
response
indicate
into
the
browser
that
it
can
send
requests
to
that
origin
or
from
that
origin.
Rather,
yes,.
A
We
talked
about
why
envoy
is
a
cloud
native
proxy,
unlike
other
solutions
like
apache
and
nginx,
for
example,
even
though
it's
they're
making
progress
every
day,
so
don't
don't
quote
me
on
that
they
might.
They
might
be
more
in
a
more
advanced
tape
right
now
we
talked
a
little
bit
about
the
flow
of
data
and
showed
some
example
with
two
more
two
filters
and
one
course
that
it
scores
headers
to
the
response
based
on
configuration
and
one
a
router,
and
that's
pretty
much
it
for
today.