Envoy Service Mesh Traffic Management in Practice

Envoy is a high-performance L7 proxy and service mesh data plane, open-sourced by Lyft. In modern cloud-native architectures, Envoy is deployed as a sidecar proxy alongside each service instance, intercepting all north-south and east-west traffic to provide unified traffic management, observability, and security capabilities for microservices.

Sidecar Proxy Architecture

Each service instance is paired with an Envoy proxy that handles all incoming and outgoing traffic. This architecture allows services to remain agnostic of network-level complexity, effectively decoupling infrastructure logic from business code.

Traffic Splitting and Routing

Envoy supports fine-grained traffic management through dynamic configuration. The following example demonstrates a canary release that routes 10% of traffic to a new version:

yaml
# envoy-config.yaml — Traffic splitting configuration
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: backend
              domains: ["*"]
              routes:
              - match: { prefix: "/api/v1/" }
                route:
                  weighted_clusters:
                    clusters:
                    - name: service_v1
                      weight: 90
                    - name: service_v2
                      weight: 10
          http_filters:
          - name: envoy.filters.http.router
  clusters:
  - name: service_v1
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: service_v1
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: service-v1, port_value: 8080 }
  - name: service_v2
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: service_v2
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: service-v2, port_value: 8080 }

Observability and Security

Envoy natively supports distributed tracing (compatible with Zipkin and Jaeger), Prometheus metrics export, and structured access logging. On the security front, it supports mutual TLS (mTLS), RBAC access control, and rate limiting. These capabilities form the foundation of a production-grade service mesh, empowering SRE teams with full visibility and control over microservice communication quality and security.