Envoy技术架构介绍

1、Envoy IntroEnvoy技术架构介绍State of microservice networking in industry2Languages and frameworks.Protocols (HTTP/1, HTTP/2, gRPC, databases, caching, etc.).Infrastructures (IaaS, CaaS, on premise, etc.).Intermediate load balancers (AWS ELB, F5, etc.).Observability output (stats, tracing, and logging).Imp

2、lementations (often partial) of retry, circuit breaking, rate limiting, timeouts, and other distributed systems best practices.Authentication and Authorization.Per language libraries for service calls.State of microservice networking in industry3Likely already in a world of hurt or rapidly approachi

3、ng that point.Debugging is difficult or impossible (each application exposes different stats and logs with no tracing).Limited visibility into infra components such as hosted load balancers, databases, caches, network topologies, etc.).Multiple and partial implementations of circuit breaking, retry,

4、 and rate limiting (If I had a $ for every time someone told me that retries are “easy” ).Furthermore, if you do have a good solution, you are likely using a library and are locked into a particular technology stack essentially forever.Libraries are incredibly painful to upgrade. (Think CVEs).What i

5、s Envoy?The network should be transparent to applications.When network and application problems do occur it should be easy to determine the source of the problem.4Service mesh refresherService ASidecar proxyService BSidecar proxyService ASidecar proxyService ASidecar proxyService ASidecar proxyServi

6、ce CSidecar proxyService ASidecar proxyService DSidecar proxy5Envoy design goals6Out of process architectureHigh performance / low latency code baseL3/L4 filter architectureHTTP L7 filter architectureHTTP/2 firstService discovery and active/passive health checkingAdvanced load balancingBest in class

7、 observability (stats, logging, and tracing)Authentication and authorizationEdge proxyEnvoy config management via xDS APIs7Envoy is a universal data planexDS = * Discovery Service (various configuration APIs). E.g.,:LDS = Listener Discovery ServiceCDS = Cluster Discovery ServiceBoth gRPC streaming a

8、nd JSON/YAML REST via proto3!Central management system can control a fleet of Envoys avoiding per-proxy config file hellGlobal bootstrap config for every Envoy, rest taken care of by the management serverEnvoys + xDS + management system = fleet wide traffic management distributed systemEnvoy archite

9、ctureConnectionListener filtersL4 Read FiltersL4 Write filtersHTTP/L7conn managerHTTP/L7codecHTTP/L7read filtersHTTP/L7write filtersService RouterUpstream conn poolBackendservicesStatsAdminCluster/Listener/Route/Secret ManagerxDS APIWorkerFilter ChainsExtension and pluggabilityEnvoy is designed to h

10、ave multiple extension point. E.g.:L4/L7 filtersAccess loggersTracersHealth checkersTransport socketsRetry policyResource monitorsStats sinkEnvoy Adoption10Adoption in ChinaNetEase, Inc.Envoy 在网易内部的实践163目录Envoy 在内部微服务框架中的应用适配扩展Envoy 实现微服务多环境治理现状以Nginx作为流量出口代理与Consul紧密结合服务发现基本实现业务无感知挑战数据面能力弱，无控制面维护成本

11、高开源社区偏离整体基于Envoy+Istio方案Outbound指向SidecarInbound可配置流量拦截控制面以Pilot为核心注册中心以K8S原生方式通过MCP机制扩展架构方案 说明适配原有服务调用配置:8550/proxy/servicea/path/xxx :8550/hash/serviceb/path/xxx proxy 和 hash 为prex ，可配置Istio 适配默认下发8550的LDS至Envoy，其中route_cong_name 配置为80Envoy适配在http_connection_manager 下增加url_transformer 配置选 项，针对类似UR

12、L :8550/proxy/servicea/path/xxx 更改http请求的host 和 path 分别为 “servicea“ 和 “path/xxx”Rewrite Host 和 Path 、默认路由适配Rewrite Host 和 Path 、默认路由适配8550service1:8550/proxy/servicea/path/xxx15001LDS:listenersroute_cong: 80-virtual hosts:servica/ servicea:80 xxxRDS:routesserviceaCDS:clustersEDS:endpoints18:808017:8

13、080Envoy XDSRewrite hostname and path163需求：流量染色流量穿梭业务无感知内部多环境治理控制面通过sourceLabels 下发定向 路由，环境较多时配置太 麻烦，而且不能解决 subset 不存在时cluster 降级问题多环境治理-实现方案1支持L4&L7支持流量染色支持流量穿梭应用无侵入多环境治理-实现方案2Sidecar 通过header (x-prefer-color) 、 Proxy protocol 协议的扩展字段传递 color 属性多环境治理-实现方案2原理多环境治理-example注意：类似分布式追踪应用回传x-request-id相关头，流量穿梭功能需 要业务应用回传x-prefer-color 头多环境治