Envoy

What Envoy Is

 a high-performance L7 proxy, originally from Lyft,
 now the de-facto mesh data plane (istio et al):

 - C++, production-hardened at massive scale
 - L4 AND L7: TCP proxying + full HTTP understanding
 - dynamically configurable via xDS APIs (no restarts)
 - first-class observability: stats/tracing on everything

 you rarely CONFIGURE envoy by hand in a mesh — the control
 plane compiles policy into envoy config. but reading it
 and reasoning about its MODEL is an operational superpower.

The Config Model

 four nouns describe everything:

 LISTENER:  where traffic arrives (ip:port)
   ↓ filters process bytes/requests
 ROUTE:     match rules → destination selection
   (path/host/header matching, weighted clusters)
 CLUSTER:   logical upstream + endpoints + policies
   (load balancing, health checks, outlier ejection)
 FILTERS:   processing chain (TLS, authz, ratelimit...)

 request journey:
 [in :15006] → listener → http filter chain (authz, ratelimit)
             → route table matches /orders/* 
             → cluster orders → pick endpoint → forward ✓

Filters Worth Knowing

Filter	Role
TLS termination / origination	mTLS half each side
ext_authz	delegate authn/z to external service
local rate limit	token-bucket in-proxy
router	retries, timeouts, mirroring
wasm extensions	custom logic safely embedded

Why Envoy Won the Mesh Wars

 □ xDS NATIVE: designed for dynamic control — meshes needed
   exactly this; nginx-class retrofits struggled
 □ HOT RECONFIG: listeners/routes/clusters update live,
   atomically, without dropping connections
 □ OBSERVABILITY DEFAULTS: per-route/per-cluster metrics
   with tagged dimensions from day one
 □ EXTENSIBILITY: filters + wasm for bespoke needs
 □ NEUTRAL GOVERNANCE: CNCF-adjacent ecosystem trust

 competitors exist (linkerd's rust proxy, cilium's eBPF
 approach) — knowing WHY envoy dominates helps evaluate them.

Interview Framing

“What runs inside your mesh’s data plane?” scored shape: identify envoy, sketch listener→route→cluster flow, xDS-dynamic-config property emphasized, filter-chain extensibility mentioned, “control plane writes config; humans read it” positioning. Deep envoy internals aren’t required — fluent MODEL vocabulary is what separates mesh operators from mesh installers.