devopsy.kinsta.cloud

Tag: Envoy Gateway

  • Envoy Gateway Makes Using Envoy Proxy Easier for Developers and Reverses Fragmentation

    San Francisco, CA and Valencia, SPAIN — May 16, 2022 — Members of the steering group for Envoy Gateway (EG), including Envoy creator Matt Klein and representatives from Ambassador Labs, Fidelity Investments, Tetrate, and VMware, Inc. today announced their joint commitment to the project, which launched today at KubeCon + CloudNativeCon, Europe 2022, under the auspices of the Cloud Native Computing Foundation® (CNCF®). Envoy Gateway is a new effort within the Envoy proxy open source project to simplify Envoy use in cloud-native application development. 

    Envoy Gateway will reduce existing, redundant efforts around Envoy and make it much easier for application developers to use Envoy as a basic API gateway “out of the box” and as a Kubernetes Ingress controller. Exposing a simplified set of APIs, and implementing the Kubernetes Gateway API, EG makes it easier to extend Envoy. Developers will now have a cost-free, unfettered way to provide external access to their work in progress. At the same time, Envoy Gateway will not replace API management features currently found in commercial products.  

    “Envoy has achieved a great deal of success since we first released it in 2016,” said Matt Klein, founder of the Envoy proxy project. “And community has been at the heart of Envoy from the beginning. With the community-driven Envoy Gateway project, we see the opportunity to make Envoy accessible to many more users through the addition of simplified APIs and new capabilities explicitly targeted at north-south / edge proxy use cases.”

    Envoy is already widely used for traffic between separate services in a microservices application – that is, east-west traffic. With Envoy Gateway, Envoy will also be easy to use for north-south traffic—that traffic between an application and the outside world, as with consumers of an application’s APIs. 

    Envoy Gateway—Core Open Source Infrastructure for the Cloud-Native Future

    IT organizations worldwide want to establish and use a rich, robust, modern stack of open source software for cloud-native application development and delivery, under the management of organizations such as the Linux Foundation and the CNCF. Commercial offerings and projects within each IT team can then add value on top of this core infrastructure.  

    Envoy is fast becoming the go-to networking substrate within this modern, cloud-native stack. However, recently, the need for API access, traffic routing, and other ingress capabilities has led to fragmentation in the Envoy ecosystem. Envoy Gateway will bring this needed functionality back into the main Envoy project and make it less confusing and time-consuming for developers to access Envoy. 

    Implementation Via Kubernetes Gateway API

    Envoy Gateway will expose a version of the Kubernetes-native Gateway API, with Envoy-specific extensions. This is an expressive, extensible, role-oriented API well-suited to use by developers. Gateway API is either implemented, or in progress, for Istio, the Contour project (which originated at VMware), Emissary-Ingress (which originated at Ambassador Labs), and others. 

    When users create Gateway API resources, they will be translated into native Envoy API calls, so Envoy and its native API, xDS, will not need to be changed to add this new support. 

    Advantages for Developers, Infrastructure Administrators and Business Decision-Makers

    Application developers will experience the most positive impact from Envoy Gateway. They will be able to run Envoy Gateway and begin routing traffic to their applications. They will no longer need to build their own control plane, or extend an existing control plane such as a Go or Java control plane, or bring in a vendor solution at the early stages of their projects. They can just configure routes for the application and share them.  

    Infrastructure administrators will be able to easily offer an Envoy-native experience to application teams, without needing to adopt a vendor solution just to get basic gateway functionality. They will be able to manage instances of Envoy Gateway without interfering with developer access to them. Envoy Gateway will allow them to deliver consistent application networking capabilities across heterogeneous environments.  

    Executives and decision makers will have Envoy as a standard and, we expect, widely used solution for API access and Kubernetes ingress. They will also benefit from faster and easier development and delivery of more secure and robust software and services. 

    Additional Resources

    • Explore CNCF announcements. 
    • Review the official blog of the Envoy project.
    • Learn more about Envoy Gateway goals.

    About Envoy

    Originally created by Matt Klein and built at Lyft, Envoy is a high performance C++ distributed proxy designed for single services and applications, as well as a communication bus and “universal data plane” designed for large microservice “service mesh” architectures. Built on the learnings of solutions such as NGINX, HAProxy, hardware load balancers, and cloud load balancers, Envoy runs alongside every application and abstracts the network by providing common features in a platform-agnostic manner. When all service traffic in an infrastructure flows via an Envoy mesh, it becomes easy to visualize problem areas via consistent observability, tune overall performance, and add substrate features in a single place. 

    Contact Matt Klein at mattklein123@gmail.com. 

    About Ambassador Labs

    Ambassador Labs, the cloud native developer experience leader, enables developers to code, test, ship, and run applications faster and easier than ever. Maker of top Cloud Native Computing Foundation (CNCF) open source projects, including Emissary-ingress and Telepresence, Ambassador Labs delivers a developer control plane for Kubernetes that integrates the development, deployment, and production infrastructure for developers and organizations worldwide including Microsoft, PTC, NVidia, and Ticketmaster. Ambassador Labs is backed by top investors including Insight Partners and Matrix Partners. Learn more and get started for free at www.getambassador.io.

    Contact Lisa Williams of Ambassador Labs at lisawilliams@datawire.io.

    About Fidelity Investments

    Fidelity’s mission is to inspire better futures and deliver better outcomes for the customers and businesses we serve. With assets under administration of $11.3 trillion, including discretionary assets of $4.2 trillion as of March 31, 2022, we focus on meeting the unique needs of a diverse set of customers. Privately held for over 75 years, Fidelity employs more than 57,000 associates who are focused on the long-term success of our customers. For more information about Fidelity Investments, visit www.fidelity.com/about-fidelity/our-company. 

    Contact Kathleen Bentley of Fidelity Investments at kathleen.bentley@fmr.com. 

    About Tetrate

    Started by Istio founders to reimagine application networking, Tetrate is an enterprise service mesh company managing the complexity of modern, hybrid cloud application infrastructure. Its flagship product, Tetrate Service Bridge, provides an edge-to-workload application connectivity platform to deliver business continuity, agility, and security for enterprises on the journey from traditional monoliths to the cloud. Customers get consistent, baked-in observability, runtime security and traffic management in any environment. Tetrate remains a top contributor to the open-source projects Istio and Envoy Proxy. Find out more at www.tetrate.io. 

    Contact Annie Fink of Bospar at annie@bospar.com. 

    About VMware 
    VMware is a leading provider of multi-cloud services for all apps, enabling digital innovation with enterprise control. As a trusted foundation to accelerate innovation, VMware software gives businesses the flexibility and choice they need to build the future. Headquartered in Palo Alto, California, VMware is committed to building a better future through the company’s 2030 Agenda. For more information, please visit www.vmware.com/company.

    Contact Eloy Ontiveros of VMware Global Communications at eontiveros@vmware.com.

  • Introducing Envoy Gateway

    Today we are thrilled to announce Envoy Gateway, a new member of the Envoy Proxy family aimed at significantly decreasing the barrier to entry when using Envoy for API Gateway (sometimes known as “north-south”) use cases.

    History

    Envoy was released as OSS in the fall of 2016, and much to our amazement quickly gained traction throughout the industry. Users were drawn to many different aspects of the project including its inclusive community, extensibility, API-driven configuration model, powerful observability output, and increasingly extensive feature set.

    Although in its early history Envoy became synonymous with “service mesh,” its first use at Lyft was actually as an API gateway / edge proxy, providing in-depth observability output that aided Lyft’s migration from a monolithic to a microservice architecture.

    Over the last 5+ years, we have seen Envoy adopted by a tremendous number of end users, both as an API gateway and as a sidecar proxy in “service mesh” roles. At the same time we have seen a large vendor ecosystem spring up around Envoy, providing a multitude of solutions both in the OSS and proprietary domains. Envoy’s vendor ecosystem has been critical to the project’s success; without funding for all of the employees that work part or full-time on Envoy the project would certainly not be what it is today.

    The flip side of Envoy’s success as a component of many different architecture types and vendor solutions is that it is inherently low level; Envoy is not an easy piece of software to learn. While the project has had massive success being adopted by large engineering organizations around the world, it is only lightly adopted for smaller and simpler use cases, where nginx and HAProxy are still dominant.

    The Envoy Gateway project was born out of the belief that bringing Envoy “to the masses” in the API gateway role requires two primary things:

    • A simplified deployment model and API layer aimed at lighter use cases.
    • Merging the existing CNCF API gateway projects (Contour and Emissary) into a common core that can provide the best possible onboarding experience, while still allowing vendors to build value-added solutions based on Envoy Proxy and Envoy Gateway.

    We strongly believe that if the community converges around a single Envoy branded API gateway core, it will:

    • Reduce duplicative efforts around security, control plane technical details, and other shared concerns.
    • Allow vendors to focus on layering value added functionality on top of Envoy Proxy and Envoy Gateway in the form of extensions, management plane UI, etc.
    • Lead to a “rising tide lifts all boats” phenomenon in which more users around the world enjoy the benefits of Envoy, whether their organization is large or small. More users feed the virtuous cycle of more potential customers, more support for the core Envoy project, and a better overall experience for all.

    Project outline

    At a high level, Envoy Gateway can be thought of as a wrapper around the Envoy Proxy core. It will not change the core proxy, xDS, go-control-plane, etc. in any way (other than potentially driving features, bug fixes, and general improvements!). It will provide the following functionality:

    • A simplified API for the gateway use case. The API will be the Kubernetes Gateway API with some Envoy-specific extensions. This API was chosen because deployment on Kubernetes as an ingress controller is the initial focus for the project and because the API has broad industry buy-in.
    • A “batteries included” experience that will enable users to get up and running as fast as possible. This includes tooling to provision controller resources, control plane resources, proxy instances, etc.
    • An extensible API surface. While the project will aim to make common API gateway functionality available out of the box (e.g., rate limiting, authentication, Let’s Encrypt integration, etc.), vendors will be able to provide SaaS versions of all APIs, provide additional APIs and value added functionality such as WAF, enhanced observability, chaos engineering, etc.
    • High quality documentation and getting started guides. Our primary goal with Envoy Gateway is to make the most common gateway use cases trivial to stand up for the average user.

    On the topic of APIs, we believe that one area that has led to significant confusion is the effective reimplementation of Envoy’s xDS APIs in other projects when targeting advanced use cases. This pattern causes users to have to learn multiple sophisticated APIs (which ultimately translate back to xDS) in order to get their job done. As such, Envoy Gateway is committed to a “hard line in the sand” in which the Kubernetes Gateway API (and any permissible extensions within that API) is the only additional API that will be supported. More advanced use cases will be served by an “xDS mode” in which existing API resources will be automatically translated for the end user, who can then switch to utilizing the xDS APIs directly. This will lead to a crisper primary API while allowing an escape hatch for organizations that might outgrow the expressiveness of the primary API and wish to utilize the full power of Envoy via xDS.

    Next steps

    Today we are thankful for the initial sponsors of Envoy Gateway (Ambassador Labs, Fidelity, Tetrate, and VMware) and are excited to start on this new journey with all of you. The project is very early with the focus so far having been to agree on goals and high level design, so it’s a great time to get involved, either as an end user or as a system integrator.

    We also want to make it extremely clear that existing users of Contour and Emissary will not be left behind. The project (and VMware and Ambassador Labs) is completely committed to ensuring a smooth eventual migration path for users of those projects to Envoy Gateway, either via translation and replacement or via those projects becoming wrappers around the Envoy Gateway core.

    We are extremely excited about bringing Envoy to a larger group of users via the Envoy Gateway project, and we hope you will join us on our journey!