Envoy Proxy
3 Reviews and Ratings
What is Envoy Proxy?
Envoy Proxy is an open-source Layer 7 (and Layer 4) proxy. It runs as a sidecar next to services, as an edge proxy in front of a cluster, or as the data plane under a control plane. In a Service Mesh, every hop of east-west traffic can flow through Envoy so routing, retries, mutual TLS, and observability sit in one process instead of in each application. It does not execute application business logic and it does not run model weights.
CNCF graduated. Current public line on the project site: 1.39.1. Originally built at Lyft.
Key Capabilities
- Out-of-process sidecar or edge process: A standalone C++ server with a small memory footprint. It sits beside any language or framework; the application does not embed a library.
- Service mesh data plane: When deployed next to every service, Envoy is the communication bus for the mesh: consistent L7 stats, access logs, and distributed tracing across the fleet.
- Load balancing: Zone-aware load balancing, automatic retries, circuit breaking, global rate limiting, and request shadowing. The same binary is used as an edge load balancer, not only as a sidecar.
- HTTP/2, HTTP/3, and gRPC: First-class support inbound and outbound, including HTTP/1.1 ↔ HTTP/2 translation.
- xDS APIs: Dynamic configuration of listeners, clusters, routes, and secrets without process restarts or dropped connections.
- Security filters: TLS termination and origination, mutual TLS, SNI, JWT authentication, RBAC, and external authorization.
- Extensibility: Wasm, Lua, Go, Rust dynamic modules, or out-of-process external processing on the data path (auth, custom policy) without forking the proxy.
- Streaming HTTP: Long-lived, streaming responses (including LLM token streams) are ordinary L7 traffic. Envoy AI Gateway and Envoy Gateway are separate projects that use this engine; they are not this listing.
Audience & Use Cases
- Audience: Platform and site reliability (SRE) teams operating Kubernetes or VM service fleets who need a language-agnostic data plane.
- Use Case: Istio/Consul-style sidecar mesh; edge ingress in front of microservices; gRPC load balancing; mTLS between services; a programmable proxy that a higher-level gateway (Envoy Gateway, Envoy AI Gateway) configures via xDS.
Technical Specifications
- Source / site: github.com/envoyproxy/envoy, envoyproxy.io. Apache-2.0.
- Architecture: Out-of-process proxy; configured statically or via xDS from a control plane.
- Protocols: HTTP/1.1, HTTP/2, HTTP/3, gRPC; TLS; additional L7 filters (including database wire protocols such as MongoDB).
- Vendor: Open Source / CNCF. Commercial meshes and gateways embed it; those remain separate products.
Categories & Use Cases
Product Demos
Technical Details
| Deployment Types | On-Premise |
|---|---|
| Mobile Application | No |
FAQs
What is Envoy Proxy?
Envoy Proxy is an open-source Layer 7 (and Layer 4) proxy. It runs as a sidecar next to services, as an edge proxy in front of a cluster, or as the data plane under a control plane. In a Service Mesh, every hop of east-west traffic can flow through Envoy so routing, retries, mutual TLS, and observability sit in one process instead of in each application. It does not execute application business logic and it does not run model weights.