envoy英文指南：https://www.envoyproxy.io/docs/envoy/latest/intro/what_is_envoy
一、什么是envoy?
Envoy 是一個 L7 代理和通信總線，專為大型現代面向服務的架構而設計。該項目的誕生源於以下信念：
網絡應該對應用程序透明。當確實發生網絡和應用程序問題時，應該很容易確定問題的根源。
二、envoy的核心功能
1）Out of process architecture: Envoy is a self contained process that is designed to run alongside every application server. All of the Envoys form a transparent communication mesh in which each application sends and receives messages to and from localhost and is unaware of the network topology. The out of process architecture has two substantial benefits over the traditional library approach to service to service communication:
2）Envoy works with any application language. A single Envoy deployment can form a mesh between Java, C++, Go, PHP, Python, etc. It is becoming increasingly common for service oriented architectures to use multiple application frameworks and languages. Envoy transparently bridges the gap.
3）As anyone that has worked with a large service oriented architecture knows, deploying library upgrades can be incredibly painful. Envoy can be deployed and upgraded quickly across an entire infrastructure transparently.
4）L3/L4 filter architecture: At its core, Envoy is an L3/L4 network proxy. A pluggable filter chain mechanism allows filters to be written to perform different TCP/UDP proxy tasks and inserted into the main server. Filters have already been written to support various tasks such as raw TCP proxy, UDP proxy, HTTP proxy, TLS client certificate authentication, Redis, MongoDB, Postgres, etc.
5）HTTP L7 filter architecture: HTTP is such a critical component of modern application architectures that Envoy supports an additional HTTP L7 filter layer. HTTP filters can be plugged into the HTTP connection management subsystem that perform different tasks such as buffering, rate limiting, routing/forwarding, sniffing Amazon’s DynamoDB, etc.
6）First class HTTP/2 support: When operating in HTTP mode, Envoy supports both HTTP/1.1 and HTTP/2. Envoy can operate as a transparent HTTP/1.1 to HTTP/2 proxy in both directions. This means that any combination of HTTP/1.1 and HTTP/2 clients and target servers can be bridged. The recommended service to service configuration uses HTTP/2 between all Envoys to create a mesh of persistent connections that requests and responses can be multiplexed over.
7）HTTP/3 support (currently in alpha): As of 1.19.0, Envoy now supports HTTP/3 upstream and downstream, and translating between any combination of HTTP/1.1, HTTP/2 and HTTP/3 in either direction.
8）HTTP L7 routing: When operating in HTTP mode, Envoy supports a routing subsystem that is capable of routing and redirecting requests based on path, authority, content type, runtime values, etc. This functionality is most useful when using Envoy as a front/edge proxy but is also leveraged when building a service to service mesh.
9）gRPC support: gRPC is an RPC framework from Google that uses HTTP/2 or above as the underlying multiplexed transport. Envoy supports all of the HTTP/2 features required to be used as the routing and load balancing substrate for gRPC requests and responses. The two systems are very complementary.
10）Service discovery and dynamic configuration: Envoy optionally consumes a layered set of dynamic configuration APIs for centralized management. The layers provide an Envoy with dynamic updates about: hosts within a backend cluster, the backend clusters themselves, HTTP routing, listening sockets, and cryptographic material. For a simpler deployment, backend host discovery can be done through DNS resolution (or even skipped entirely), with the further layers replaced by static config files.
11）Health checking: The recommended way of building an Envoy mesh is to treat service discovery as an eventually consistent process. Envoy includes a health checking subsystem which can optionally perform active health checking of upstream service clusters. Envoy then uses the union of service discovery and health checking information to determine healthy load balancing targets. Envoy also supports passive health checking via an outlier detection subsystem.
12）Advanced load balancing: Load balancing among different components in a distributed system is a complex problem. Because Envoy is a self contained proxy instead of a library, it is able to implement advanced load balancing techniques in a single place and have them be accessible to any application. Currently Envoy includes support for automatic retries, circuit breaking, global rate limiting via an external rate limiting service, request shadowing, and outlier detection. Future support is planned for request racing.
13）Front/edge proxy support: There is substantial benefit in using the same software at the edge (observability, management, identical service discovery and load balancing algorithms, etc.). Envoy has a feature set that makes it well suited as an edge proxy for most modern web application use cases. This includes TLS termination, HTTP/1.1 HTTP/2 and HTTP/3 support, as well as HTTP L7 routing.
14）Best in class observability: As stated above, the primary goal of Envoy is to make the network transparent. However, problems occur both at the network level and at the application level. Envoy includes robust statistics support for all subsystems. statsd (and compatible providers) is the currently supported statistics sink, though plugging in a different one would not be difficult. Statistics are also viewable via the administration port. Envoy also supports distributed tracing via thirdparty providers.
非侵入的架構（Out of process architecture） : Envoy 是一個獨立進程，設計為伴隨每個應用程序服務運行。所有的 Envoy
非侵入的架構有兩個實質性的好處：
Envoy 適用於任何應用程序語言。單個 Envoy 部署可以在 Java、C++、Go、PHP、Python 等之間形成網格。面向服務的架構使用多種應用程序框架和語言變得越來越普遍。Envoy 透明地彌合了差距。
Envoy 可以透明地跨整個基礎設施快速部署和升級。
L3/L4 過濾器架構： Envoy 的核心是一個 L3/L4 網絡代理。可插入的
HTTP L7 過濾器架構： HTTP 是現代應用程序架構的關鍵組件，Envoy
一流的 HTTP/2 支持：在 HTTP 模式下運行時，Envoy
HTTP/3 支持（目前處於 alpha 階段）：從 1.19.0 開始，Envoy 現在支持 HTTP/3 上游和下游，並在任意方向的 HTTP/1.1、HTTP/2 和 HTTP/3 之間進行轉換。
HTTP L7 路由：在 HTTP 模式下運行時，Envoy 支持一個
gRPC 支持：
服務發現和動態配置： Envoy 可選擇使用一組分層的
健康檢查： 構建 Envoy 網格的
高級負載均衡： 分布式系統中不同組件之間的
前端/邊緣代理支持：在邊緣使用相同的軟件（可觀察性、管理、相同的服務發現和負載平衡算法等）有很大的好處。Envoy 的功能集使其非常適合作為大多數現代 Web 應用程序用例的邊緣代理。這包括
一流的可觀察性：如上所述，Envoy 的主要目標是使網絡透明。然而，問題出現在網絡層和應用層。Envoy 包括對所有子系統的強大
envoy的顯著特性
1)性能、可擴展及動態配置 性能：除了大量功外， Envoy EnvoyEnvoyEnvoy還提供極高的 吞吐量和低尾延遲差異，同時消耗相對較少CPUCPUCPU和 RAMRAMRAM； 可擴展性： Envoy EnvoyEnvoyEnvoy在L4 和L7 上提供豐富的可插拔過濾器功能，允許用戶輕松添加新； API可配置性： Envoy提供了一組可由控制平面服務實現的管理 API，也稱為 xDS API 若控制平面實現了這所有的 API ，則可以使用通引導配置在整個基礎架構中運行 EnvoyEnvoy Envoy 所有進一步的配置更改都可通過管理服務器無縫地行動態傳遞，使得 Envoy永遠不需要重新啟動 於是，這使得 EnvoyEnvoy Envoy 成為一個通用數據平面，當與足夠復雜的控制相結合時可大降低整體操作性 2)Envoy xDS API 存在 v1 、v2 和v3 三個版本 v1 API 僅使用 JSON/RESTJSON，本質上是輪詢 v2 API 是 v1 的演進，而不是 革命它v1 功能的 超集，新API模式使用 proto3指定，並同時以 gRPC和 REST + JSON/YAML 端點實現 2021 年第 1季度結束支持 v3 API：當前支持 的版本，start_tls、拒絕傳入的 tcp 連接、 4096位的 tls 密鑰、 SkyWalking和WASM等 3) Envoy 業已 成為現代服務網格和邊緣關的 “ 通用數據平面 API ” ，Istio 、Ambassador和 Gloo 等項目均是為此數據平面代理提供 的控制平面 ；
1、envoy的結構
envoy data path
envoy的架構
envoy的基礎組件
主機（ HostHost ）：一個具有網絡通信能力的端點，例如服務器、移動智設備等(能夠進行網絡通信的實體（手機、服務器等上的應用程序）。在envoy中，主機是邏輯網絡應用程序。一個物理硬件可能有多個主機在其上運行，只要每個主機都可以獨立尋址。)
集群（ Cluster ）：集群是 Envoy Envoy 連接到的一組邏輯上相似端點；在 v2 中， RDSRDSRDS通過路由指向集群， CDS CDS提供集群 配置，而 Envoy 通過 EDS EDS發現集群成員，即端點；
下游（ DownstreamDownstream DownstreamDownstream DownstreamDownstream）：下游主機連接到 Envoy ，發送請求並接收響應它們是 Envoy 的客戶端；
上游（ Upstream UpstreamUpstream UpstreamUpstream）：上游主機接收來自 Envoy Envoy 的連接和請求並返回響應，它們是 Envoy Envoy 代理的后端服務器；
端點（ Endpoint Endpoint ）：端點即上游主機，是一個或多集群的成員可通過 EDS EDS發現；
偵聽器（ ListenerListenerListener Listener）：偵聽器是能夠由下游客戶端連接的命名網絡位置，例如口或 unix 域套接字等；
位置（ LocalityLocality LocalityLocalityLocalityLocalityLocality）：上游端點運行的區域拓撲，包括地、和子等；
管理服務器（ Management Server Management Server Management ServerManagement ServerManagement ServerManagement ServerManagement Server Management ServerManagement Server Management Server）：實現 v2 API v2 APIv2 API 的服務器，它支持復制和分片並且能夠在不同物理機上實 現針對不同 xDS API xDS API xDS API xDS API的API API服務；
地域（ Region Region ）：區域所屬地理位置；
區域（ Zone ）： AWS AWS中的可用區（ AZ ）或 GCPGCP 中的區域等；
子區域： Envoy 實例或端點運行的區域內位置，用於支持多個負載均衡目標；
xDS xDS：CDS CDS 、EDS EDS、HDS HDS HDS 、LDSLDSLDS、RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit) RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)RLS(Rate Limit)、 RDS RDS RDS 、 SDS SDS、VHDS VHDSVHDS和RTDSRTDSRTDSRTDS等API 的統稱；
Mesh Mesh和Envoy MeshEnvoy Mesh Envoy MeshEnvoy Mesh Envoy(一組主機，它們協調以提供一致的網絡拓撲。在本文檔中，“Envoy 網格”是一組 Envoy 代理，它們為由許多不同服務和應用程序平台組成的分布式系統形成消息傳遞基礎。)
運行時配置：與 Envoy 一起部署的帶外實時配置系統。可以更改配置設置以影響操作，而無需重新啟動 Envoy 或更改主要配置。
3、envoy的部署類型
Envoy is usable in a variety of different scenarios, however it’s most useful when deployed as a mesh across all hosts in an infrastructure.
Envoy可用於各種不同的場景，但是當它作為一個跨基礎設施中所有主機的網格部署時，它是最有用的。
常見的部署方式如下圖
僅服務到服務
(1)service to service egress listener
This is the port used by applications to talk to other services in the infrastructure. HTTP and gRPC requests use the HTTP/1.1 host header or the HTTP/2 :authority header to indicate which remote cluster the request is destined for. Envoy handles service discovery , load balancing , rate limiting , etc. depending on the details in the configuration. Services only need to know about the local Envoy and do not need to concern themselves with network topology, whether they are running in development or production, etc.
1、這是應用程序用來與基礎設施中的其他服務進行通信的端口。
3、Envoy根據配置中的細節處理服務發現、負載平衡、速率限制等。
4、 服務只需要了解本地Envoy，不需要關心網絡拓撲、它們是在開發中運行還是在生產中運行等等。
(2)service to service ingress listener
This is the port used by remote Envoys when they want to talk to the local service. ◆Incoming requests are routed to the local service on the configured port(s). ◆Multiple application ports may be involved depending on application or load balancing needs (for example if the service needs both an HTTP port and a gRPC port). The local Envoy performs buffering, circuit breaking, etc. as needed.
1、通過遠程訪問envoy的ip+port來訪問envoy后端的服務
根據應用或負載均衡的需要，可能涉及多個應用端口(例如，如果服務同時需要一個HTTP端口和一個gRPC端口)。
2、本地envoy根據需要執行緩沖、斷路等。
（3）Optional external service egress listener
本地服務通過envoy的egress listener訪問外部的服務。
2) Service to service Plus front proxy
服務到服務+前端代理
The above diagram shows the service to service configuration sitting behind an Envoy cluster used as an HTTP L7 edge reverse proxy. 終止TLS連接； 支持HTTP/1.1和HTTP/2； HTTP L7路由； 通過Front-Envoy的Ingress接入請求，並結合發現服務與Service-to-Service的Envoy網格進行通信； The front Envoy hosts work identically to any other Envoy host, other than the fact that they do not run collocated with another service.
上圖顯示了用作HTTP L7邊緣反向代理的Envoy集群背后的服務到服務配置。
支持HTTP / 1.1和HTTP / 2;
HTTP L7路由;
通過Front-Envoy的入口接入請求,並結合發現服務與service - to - service的特使網格進行通信;
envoy主機的工作與任何其他envoy主機相同，除了它們不與另一個服務並列運行之外。
3) Service to service, front proxy, and double proxy
服務到服務、前端代理和雙代理
雙代理的目標是盡可能接近用戶地終止 TLS 和客戶端連接會更高效
