This article provides a detailed comparison of the three leading Kubernetes Ingress Controllers—Nginx, Traefik, and Envoy—covering their architecture, configuration methods, feature sets, performance benchmarks, and practical selection guidance for various deployment scenarios.
This article compares four API‑gateway solutions—Spring Cloud Gateway, NGINX, Envoy, and Kong—detailing their core strengths, drawbacks, suitable scenarios, configuration snippets, and practical selection rules to help architects pick the right gateway for microservice systems.
The Codex team uncovered a new HTTP/2 bomb that exploits HPACK compression and a zero‑byte window stall, allowing an attacker with just 100 Mbps bandwidth to consume up to 32 GB of memory on vulnerable servers such as nginx, Apache, IIS, Envoy and Cloudflare Pingora within seconds, and the article details the attack mechanics, historical context, disclosure timeline, and mitigation strategies.
The article explains how traditional microservice architectures embed network concerns such as time‑outs, retries, circuit breaking, traffic monitoring and mTLS in application code, why this leads to code coupling, upgrade difficulty and duplicated effort, and how Istio’s sidecar‑based service mesh cleanly separates those concerns while providing traffic management, observability and security features.
This article walks through a real‑world performance bottleneck on a high‑traffic e‑commerce platform, explains step‑by‑step deep tuning of Nginx Ingress Controller, compares it with Envoy Gateway, and provides concrete configurations, benchmark results, monitoring rules, and best‑practice recommendations for Kubernetes Ingress optimization.
This guide provides a deep technical comparison of Nginx Ingress Controller, Traefik, and Envoy Proxy, covering architecture, configuration, performance, feature sets, deployment patterns, security hardening, monitoring, and troubleshooting to help operators select the best solution for their Kubernetes clusters.
This tutorial explains how to use Envoy Gateway on Kubernetes to implement circuit breaker and connection‑limit policies, walks through the necessary YAML configurations, demonstrates verification with the hey load‑testing tool, and shows how these mechanisms improve system resilience in microservice architectures.
Kubernetes announced the deprecation of Ingress NGINX with limited maintenance until March 2026, urging users to adopt the GA‑ready Gateway API—offering better scalability, clear status fields, and native support for AI workloads—while providing migration guidance, code examples, and performance benchmarks.
This guide explains Kgateway’s design as a fully standards‑compliant Kubernetes Gateway API solution, detailing its core features, performance advantages, deployment steps, production best practices, comparison with alternatives, and future roadmap for teams seeking a lightweight, high‑performance ingress and API gateway.
This article translates and expands Anton Putra's benchmark, detailing how to deploy Nginx and Envoy on AWS with Terraform and Ansible, run HTTP, HTTPS, and gRPC load tests using K6, measure CPU and latency with Prometheus, and compare the resulting throughput and stability of both proxies.
This guide shows how to configure Envoy Gateway's URLRewrite filter to transform request prefixes, replace full paths, and rewrite hostnames, providing step‑by‑step YAML examples, kubectl commands, and validation screenshots for microservice integration on Kubernetes.
This tutorial walks you through installing Envoy Gateway as a CNCF sandbox project on a Kubernetes cluster, compares it with other gateway solutions, and shows how to configure a simple HTTP route, verify the deployment, and access the service using the Gateway API.
This article explains Envoy's request mirroring feature, shows how it copies live HTTP requests to a test backend without affecting the original response, and provides step‑by‑step configuration examples for mirroring all traffic, selective paths, percentage‑based sampling, and header‑driven routing, plus practical tips and typical use cases.
This article translates and expands Anton Putra’s Nginx vs. Envoy performance benchmark, detailing the AWS test environment, Terraform and Ansible provisioning, proxy configurations, load‑testing methodology with K6, and the resulting request‑per‑second and latency comparisons across HTTP, HTTPS, and gRPC workloads.
This guide explains how to enable Envoy's admin interface, register the service with Nacos, scrape metrics using Prometheus, and visualize them in Grafana, providing a complete observability pipeline for cloud‑native deployments.
This guide explains why TLS and mTLS are essential for modern microservice communication, then walks through configuring Envoy for both simple TLS termination and full mutual TLS, covering listeners, clusters, certificate management, and provides runnable examples with verification commands.
Learn how to replace Envoy's default, limited access log format with a powerful custom configuration using log_format, including JSON output and detailed fields, enabling precise monitoring, tracing, and troubleshooting in modern cloud‑native environments.
This guide walks through diagnosing Envoy WebSocket proxy issues, explains the required backend environment, provides step‑by‑step configuration snippets, and shows how to verify the setup, ensuring reliable WebSocket traffic in cloud‑native deployments.
This article explains why backend services often see proxy IPs instead of the true client address in modern cloud‑native architectures, and provides a detailed walkthrough of configuring Envoy—including X‑Forwarded‑For handling, code snippets, testing, and security recommendations—to ensure the original client IP is correctly propagated.
This article explains how to implement safe, incremental gray releases in a microservice architecture using Envoy Proxy, covering weight‑based traffic splitting, header‑based canary routing, and cookie‑based routing with full configuration examples and testing commands.
This article explains how Envoy Proxy’s HTTP Router Filter maps incoming requests to upstream clusters, walks through a basic routing setup, then demonstrates URL‑based routing with path stripping and prefix rewriting, and concludes with strategic insights for cloud‑native operations.
This article explains how Envoy’s circuit‑breaker and outlier‑detection features protect micro‑service architectures from avalanche failures by limiting concurrent connections, ejecting unhealthy instances, and provides configuration examples, testing methods, and best‑practice tips for building resilient cloud‑native systems.
Envoy, the high‑performance edge and service‑mesh proxy, offers three core mechanisms—service discovery, load balancing, and health checking—each with multiple configurable options and code examples, enabling operators and developers to optimize distributed systems for scalability, reliability, and performance in cloud‑native environments.
This tutorial introduces Envoy Proxy, explains its core building blocks—listeners, routes, clusters, and filters—demonstrates a quick Docker-based setup, and walks through a complete configuration that routes traffic based on URI paths, providing a practical five‑minute overview of service‑mesh fundamentals.
This article explains how Istio's sidecar proxy uses Envoy, iptables rules, and the xDS API to intercept and redirect traffic between Kubernetes pods, detailing the startup injection, traffic hijacking process, and how configuration is dynamically generated by istiod.
This article explains how Alibaba Cloud Service Mesh (ASM) can be extended using EnvoyFilter, Lua scripts, WebAssembly plugins, External Processing filters, and custom authorization services, detailing their capabilities, limitations, and recommended use cases for cloud‑native microservice environments.
In many Envoy‑based gateways, enabling HTTP/2 can cause intermittent 404 errors because the :authority header and the TLS SNI value differ, especially when using wildcard certificates and multi‑domain routing, and this article explains the root cause and multiple mitigation strategies.
This article shares Soul's two‑year practice of using the cloud‑native Envoy proxy for high‑performance, high‑throughput, and highly available traffic management across north‑south and east‑west flows, covering architecture, dynamic service discovery, load balancing, health checks, WASM extensions, service‑mesh integration, Redis proxying, and future directions.
The Cloud Development gateway’s evolution from a dual‑layer design—separating encryption/decryption from Envoy—to a single‑layer architecture that embeds encryption directly into Envoy filters streamlines traffic handling, strengthens protection against MITM attacks, reduces CPU and operational overhead, and unifies monitoring for a more efficient cloud‑native solution.
This article explains what Istio and its sidecar proxy are, how they are injected into Kubernetes pods, the iptables rules they use to hijack traffic, the xDS APIs that drive dynamic configuration, and how to inspect the resulting Envoy settings.
This article explains the concept of Service Mesh, its sidecar architecture, and why it’s essential for cloud‑native microservices, then compares leading implementations such as Istio, Linkerd, and Envoy, highlighting their features and deployment models.
This article walks through the complete lifecycle of a request handled by Envoy, covering terminology, network topology, configuration details, listener and filter chain processing, TLS transport sockets, HTTP/2 encoding/decoding, routing, load balancing, and post‑request cleanup, illustrated with diagrams and sample YAML configuration.
Sealos public cloud faced massive multi‑tenant Ingress demands, security concerns, and performance bottlenecks, leading the team to systematically test Nginx, Envoy, APISIX, Cilium, Envoy Gateway, and finally adopt Higress for its stability, fast route activation, and low resource footprint.
This guide walks you through installing the Envoy proxy on Ubuntu, creating a YAML configuration with listeners, filters, clusters, and routes, running the service, and testing it with curl and a simple Python HTTP server to verify traffic forwarding.
This article explains why Istio runs on Kubernetes, compares their roles in cloud‑native architectures, details how Istio extends Kubernetes with Envoy sidecars and xDS, and examines traffic management, load balancing, and the advantages and drawbacks of using a service mesh alongside kube‑proxy.
The article by delphisfang offers a concise, step‑by‑step guide to mastering Istio’s locality‑aware routing, explaining the three‑evidence learning method, the priority algorithm, required DestinationRule and outlier detection settings, how Envoy discovers locality, and tips for simplifying the Pilot‑Envoy mesh architecture.
This article traces the evolution of service mesh from its early concepts through microservice 1.0 and 2.0, analyzes the shortcomings of Envoy‑based sidecars, and explores future directions such as Go‑based data planes, WASM plugins, eBPF/VPP acceleration, QUIC transport, and on‑demand xDS delivery.
Higress 1.0, the GA‑ready open‑source cloud‑native gateway, unifies traffic, security and microservice routing on Kubernetes by leveraging Envoy, hot‑update capabilities, extensive service‑discovery, Wasm plugins and Helm deployment, while detailing its evolution, technical advantages, performance benchmarks, and community roadmap.
This article details the collaborative effort between Intel and F5 to redesign and implement dual‑stack networking support in Istio 1.17, covering the background challenges, new RFC design, key Envoy changes, step‑by‑step experimental setup, listener and endpoint modifications, and ways for the community to contribute.
This report details Soul's challenges with a multi‑layer gateway chain, evaluates Envoy, MSE and ALB, presents performance test results, outlines short‑term and long‑term migration plans, and shares post‑migration improvements and lessons learned for a cloud‑native gateway solution.
This article shares Tubi’s experience using Elixir‑gRPC in production, covering performance optimizations, stability measures, HTTP/2 edge‑case handling, and practical code examples for efficient Protobuf processing; it also discusses Envoy sidecar integration, interceptor usage, and lessons learned from real‑world deployments.
This article explains Istio’s core networking concepts, detailing how sidecar and init containers are injected into a Kubernetes cluster, the roles of the data and control planes, and provides step‑by‑step commands and YAML examples for manual and automatic sidecar injection.
This article chronicles Bilibili Live's eight‑year journey from a simple LAMP monolith to a sophisticated microservice architecture, detailing the migration to Swoole‑based services, Docker containerization, Golang adoption, hot‑key handling, request amplification mitigation, and the creation of a high‑performance Envoy‑based gateway.
WebAssembly (Wasm) is a binary instruction format for a stack-based virtual machine, designed as a portable compilation target for programming languages, enabling deployment on the web for client and server applications. It offers high efficiency, safety, openness, and standardization, allowing programs to run with near-native performance in web browsers. Wasm addresses the limitations of JavaScript, such as dynamic typing, by providing a more efficient and secure execution environment. It has applications in various scenarios, including AutoCAD, and can be used to extend functionalities in platforms like Envoy.
This article chronicles Alibaba's three‑stage evolution of Envoy Gateway—from the 1.0 incubation that powered Double‑11 traffic, through the 2.0 growth phase adding north‑south routing and hybrid‑cloud support, to the mature 3.0 release that unifies traffic and micro‑service gateways with high performance and community‑driven extensions.
This article examines how eBPF can enhance service‑mesh data planes, compares four deployment models—including sidecar, node‑shared, service‑account‑shared, and micro‑proxy architectures—and evaluates each model’s memory, isolation, security, and upgrade trade‑offs while emphasizing Envoy’s continued L7 responsibilities.
This article provides a detailed source‑code walkthrough of Envoy's outbound request processing, explaining how the proxy receives client data, parses HTTP requests, selects routes and clusters, forwards traffic upstream, handles retries and shadowing, and finally returns responses to downstream clients.
This article provides an in‑depth analysis of Envoy's outbound request processing, covering listener initialization, the use of SO_REUSEPORT for load distribution, original destination handling, and the detailed steps of connection creation and filter chaining within the Envoy proxy architecture.
This article provides a detailed technical analysis of Envoy's traffic hijacking mechanisms, covering sidecar and gateway modes, REDIRECT and TPROXY interception, iptables rule generation, port handling, conntrack limitations, and eBPF acceleration within Kubernetes service meshes.
This guide explains what an Envoy CORS filter is, details its configuration options, and provides step‑by‑step VirtualService and EnvoyFilter examples for simple, credentialed, prefix, regex, exposed‑header, non‑simple requests and shadow logging in Istio.
This article details Baidu's internal adoption of a service mesh built on Istio and Envoy, covering the motivations, architectural design, low‑invasion integration methods, extreme performance tuning, stability and traffic governance capabilities, surrounding ecosystem tools, and the resulting operational benefits.
Baidu created an internally‑built, Istio‑based service mesh that decouples governance from language‑specific RPCs, offering low‑intrusion integration, ultra‑low latency via a brpc coroutine data plane, advanced fault‑tolerance and fine‑grained traffic scheduling, and now powers over 80 % of its core microservices handling more than a trillion daily requests.
This guide explains how to push WebAssembly modules to an OCI‑compatible ACR registry using the ORAS client, enable Wasm support in Alibaba Cloud Service Mesh (ASM), and deploy Envoy filters via the ASMFilterDeployment CRD, covering Envoy filter types, pros and cons of Wasm, required CLI commands, and verification steps.
This guide shows how to set up a self‑hosted Docker registry proxy using Docker's registry image, Kubernetes (k3s), and Envoy to accelerate access to public image repositories like gcr.io, quay.io, and Docker Hub from within China, covering prerequisites, custom Dockerfile, deployment manifests, Envoy configuration, authentication, and cache cleanup.
This article explains Istio’s architecture, detailing how its control‑plane components (Pilot, Mixer, Citadel, Galley) manage traffic, policies, and security while the Envoy sidecar forms the data plane, and it walks through static and dynamic configuration methods with concrete examples.
This article details Alibaba's practical experience deploying Service Mesh at massive scale, covering architectural evolution, key challenges, traffic interception, hot‑upgrade mechanisms, performance optimizations, and operational tooling that together enable reliable, low‑overhead service communication in a cloud‑native environment.
Envoy 1.15 introduces a Postgres filter that transparently parses the PostgreSQL wire protocol, extracts rich metrics without any server‑side changes, and exports them to Prometheus, while outlining its design goals, current capabilities, usage steps, limitations, and future roadmap.
Alibaba’s large‑scale Service Mesh deployment faces challenges such as smooth technology evolution, business‑technical balance, technical debt, massive sidecar operations, and scaling, which it addresses through staged architecture evolution, traffic‑transparent interception, hot upgrades, and open‑source contributions to Istio and Envoy.
This article chronicles Yanxuan's API gateway evolution—from the early ServiceMesh 1.0 and Ianus (Kong‑based) gateway, through edge‑gateway transitions, to the cloud‑native Envoy gateway—detailing architecture choices, deployment patterns, plugin development, and the operational benefits gained.
This article explains the fundamentals of cloud native computing, introduces service mesh architectures such as Istio and Envoy, explores chaos engineering with Chaos Mesh, and details how eBPF/XDP‑based user‑space container networking can accelerate data‑plane performance in modern microservice environments.
The article explains Microsoft’s Open Service Mesh (OSM), a lightweight, SMI‑compatible service mesh built on Envoy for Kubernetes, covering its design principles, features, deployment steps, and its role in the broader cloud‑native service‑mesh ecosystem.
This article explains the concept of Service Mesh, why it emerged from micro‑service challenges, its evolution, and compares the main open‑source implementations such as Linkerd, Envoy, Istio, and Conduit, helping readers grasp its role in modern cloud‑native architectures.
This article explains how Envoy, a lightweight high‑performance L7 proxy and communication bus, provides non‑intrusive sidecar architecture, multi‑layer networking, HTTP/2 support, dynamic configuration, gRPC and special protocol handling, and built‑in observability for cloud‑native systems.
This article explains how RocketMQ’s network filter was merged into the CNCF Envoy project, details the message flow and stateful networking challenges within a service mesh, describes on‑demand CDS handling, and outlines future enhancements such as Pull support and broker‑side proxying.
Explore the fundamentals of Envoy, the lightweight L7 proxy for modern SOA architectures, through a detailed walkthrough of its architecture, configuration structure, filter chain, and key components such as xDS, listeners, clusters, and runtime settings, illustrated with diagrams and practical examples.
This article explains Envoy's hot‑restart capability, various dynamic configuration options—including static, SDS/EDS, CDS, RDS, and LDS—and the initialization and drain processes that enable seamless updates and graceful connection handling in cloud‑native deployments.
The article explains Envoy's circuit‑breaking mechanisms, global rate‑limiting integration, and TLS support, detailing configuration options, limits, and example YAML snippets for deploying secure and resilient service‑mesh proxies.
Envoy provides active and passive health checks—including HTTP, L3/L4, and Redis types—configurable intervals and failure thresholds, along with a health‑check filter that can bypass, forward, or cache requests, and detailed connection‑pool handling for HTTP/1.1 and HTTP/2 to ensure reliable service routing.
This article explains Envoy’s service discovery mechanisms—including static, strict DNS, logical DNS, original‑destination, and Service Discovery Service—detailing how they work, their consistency models, and how health‑checking influences routing decisions in production environments.
This article explains Envoy's core terminology, thread model, listener architecture, network (L3/L4) filters, HTTP connection manager, and routing configuration, providing a concise technical overview of how the service proxy operates within cloud‑native environments.
This article details Alibaba's large‑scale Service Mesh deployment for Double‑11 core applications, covering the three‑plane architecture, key challenges such as SDK‑free mesh, complex routing, rate limiting, Envoy overhead, and the performance impact on latency, CPU and memory, while outlining future roadmap and open‑source collaboration.
This article details Alibaba's large‑scale deployment of a Service Mesh for the Double‑11 shopping event, covering the underlying architecture, four key technical challenges, the solutions implemented with Envoy, Istio, and Sentinel, and the resulting performance impact on latency, CPU, and memory.
This article provides a comprehensive overview of Service Mesh technology, covering its origins, the problems it solves in microservice governance, architectural patterns such as sidecar and local gateways, the evolution from early projects like Linkerd to modern solutions like Istio and Envoy, and the remaining performance, portability, and standardization challenges that shape its future.
This guide explains how to replace Docker with Podman for hosting a static Hugo site, using a sidecar Envoy proxy, shared network namespaces, Kubernetes‑compatible pod definitions, and systemd services to achieve automatic startup and reliable service discovery.
Istio 1.3 introduces automatic protocol detection, no‑Mixer telemetry, removal of required containerPort declarations, enhanced custom Envoy configuration, region‑aware load balancing and numerous monitoring and debugging improvements, all while keeping the service mesh transparent to applications.
This tutorial explains how to install the Contour Ingress controller backed by Envoy on Kubernetes, configure IngressRoute resources, examine Envoy's static and dynamic configuration, and integrate Prometheus and Grafana monitoring with proper RBAC and ServiceMonitor setup.
This article provides a detailed analysis of Envoy’s filter architecture within Istio 1.1, explaining the async event model, each filter type, their registration interfaces, and the key processing steps from listener selection to load‑balancing and Mixer integration.
This article introduces the fundamentals of Istio as a service mesh, explains its data‑plane and control‑plane architecture, and details the roles of the Pilot component—including pilot‑agent and pilot‑discovery—in providing service discovery, traffic management, and integration with Kubernetes for microservice deployments.
This article explains what a Service Mesh is, how FangDuoduo adopted Envoy and macvlan/overlay networks to solve Dubbo IP registration issues, built an XDS configuration service for both containers and VMs, and dramatically improved development efficiency and infrastructure agility.
The article describes how the Nitro team designed and implemented a Go‑based consistent‑hashing router that leverages Nginx, the Redis protocol, Envoy sidecars, and Mesos to provide low‑latency, high‑throughput request routing and caching for compute‑intensive services.
This article outlines three increasingly complex Envoy deployment patterns for service‑mesh environments—service‑to‑service, service with a front‑proxy, and service‑to‑service with front‑proxy and double‑proxy—detailing listener configurations, external service handling, discovery integration, and provided configuration templates.
Envoy’s extensible filters enable detailed access logging and database sniffing for MongoDB, DynamoDB, and Redis, offering customizable log formats, per‑operation statistics, health checks, and future enhancements such as circuit breaking and retries, while providing configuration guidance for each filter.
This article explains Envoy's HTTP filter architecture, routing capabilities, gRPC integration, WebSocket handling, and cluster manager functions, detailing how each component operates without needing knowledge of underlying protocols and how they enable advanced traffic management, observability, and service mesh features.
Envoy is a cloud‑native L7 proxy and communication bus designed for modern service‑oriented architectures, offering out‑of‑process deployment, language‑agnostic operation, modern C++11 implementation, extensive L3/L4 and HTTP L7 filtering, HTTP/2, gRPC, database protocol support, service discovery, health checking, advanced load balancing, edge proxy capabilities, observability, and dynamic configuration.
This article introduces Envoy as the core sidecar proxy in Service Mesh, explains its terminology, thread model, filters, routing, health checking, circuit breaking, hot restart, and presents multiple deployment patterns for cloud‑native microservice environments.
