envoy proxy 入门

什么是envoy

nvoy 是一个开源的边缘和服务代理，专为现代云原生应用程序设计。它可以被认为是网络流量的通用数据平面。Envoy 最初由 Lyft 构建，现在是云原生计算基金会 (CNCF) 的毕业项目

为什么选择envoy 而不是nginx

1. envoy 更现代化
2. envoy 使用yaml 配置可读性更高
3. ngnix 通常只支持http/https ， 1.9.0 支持stream模块后也支持udp/tcp， 而envoy天生支持http/ssh/mysql/redis/mongodb/kafka… 等服务的代理
4. envoy 可以通过插件临时生成动态token 带上并转发到目标服务， 这点nginx难以做到

envoy的配置文件

与nginx的天生多配置文件模式不同， envoy默认只支持1个配置文件/etc/envoy/envoy.yaml

当然有好有不好啦，好处当然是配置简单， 十分适合利用configmap 作为sidecar 配合主容器部署
如果你喜欢多配置， 模块化模式

envoy 的做法有点粗暴， 就是用–config-yaml 参数传入合并后的配置内容

例如

envoy -c /dev/null --config-yaml "$(cat config1.yaml config2.yaml)"

又如：

#!/bin/bash
# merge-envoy.sh
MAIN_CONFIG="base_config.yaml"
ROUTE_CONFIG="routes.yaml"
CLUSTER_CONFIG="clusters.yaml"

# merge
cat $MAIN_CONFIG $ROUTE_CONFIG $CLUSTER_CONFIG | envoy -c /dev/null --config-yaml "$(cat)"

编写一个简单的配置文件

需求很简单，我的服务ip是10.0.1.223

当我访问http://10.0.1.223 时转发到https://www.bilibili.com

envoy.yaml

admin:  # Admin interface configuration
  access_log_path: /tmp/admin_access.log  # Path for admin access logs
  address:  # Admin interface address
    socket_address:  # Socket address configuration
      address: 0.0.0.0  # Listen on all network interfaces
      port_value: 9901  # Admin dashboard port

static_resources:  # Static resources configuration
  listeners:  # List of listeners
  - name: listener_0  # Listener name
    address:  # Listener address
      socket_address:  # Socket address
        address: 0.0.0.0  # Bind to all IPv4 addresses
        port_value: 10000  # Listen on port 10000
    filter_chains:  # Filter chains configuration
    - filters:  # List of filters
      - name: envoy.filters.network.http_connection_manager  # HTTP connection manager filter
        typed_config:  # Typed configuration
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager  # HTTP connection manager v3 type
          stat_prefix: ingress_http  # Statistics prefix
          access_log:  # Access log configuration
          - name: envoy.access_loggers.file  # File access logger
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog  # File access log type
              path: "/tmp/envoy_access.log"  # Access log file path
          - name: envoy.access_loggers.stdout  # Stdout access logger
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog  # Stdout access log type
          http_filters:  # HTTP filters chain
          - name: envoy.filters.http.router  # HTTP router filter
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router  # Router filter type
          route_config:  # Route configuration
            name: local_route  # Route configuration name
            virtual_hosts:  # Virtual hosts list
            - name: bilibili_redirect  # Virtual host name
              domains: ["*"]  # Match all domains
              routes:  # Route rules
              - match:  # Match conditions
                  prefix: "/"  # Match all paths (prefix)
                redirect:  # Redirect action
                  host_redirect: "www.bilibili.com"  # Redirect target host
                  scheme_redirect: "https"  # Redirect to HTTPS scheme
                  response_code: TEMPORARY_REDIRECT  # 302 temporary redirect

  clusters:  # Upstream clusters configuration
  - name: bilibili_cluster  # Cluster name
    connect_timeout: 5s  # Connection timeout
    type: LOGICAL_DNS  # Service discovery type: logical DNS
    dns_lookup_family: V4_ONLY  # Use only IPv4 for DNS lookups
    lb_policy: ROUND_ROBIN  # Load balancing policy: round robin
    load_assignment:  # Load assignment configuration
      cluster_name: bilibili_cluster  # Cluster name reference
      endpoints:  # Endpoints list