Envoy Proxy Crash Course, Architecture, L7 & L4 Proxying, HTTP/2, Enabling TLS 1.2/1.3 and more

[@hnasr]

If you liked these deep dives into proxies and other backend tech hit that like button and subscribe for more. Do suggest what should I discuss next 👇🏽

[@germwire90]

Do you have a video on how you created the cert for your noip domain?

[@subhadippahari1244]

make more videos on Envoy-filters ... those are really hard to understand

[@eyad880]

@hussein json is a valid yaml syntax btw.. yea it blew my mind too

[@AmanKumar-l1i1b]

I am getting this error "upstream connect error or disconnect/reset before headers. reset reason: remote connection failure, transport failure reason: delayed connect error: 61 envoy" can you please help me? Also on making some changes most of the time I am getting "No healthy upstream" error. Can anyone help?

[@cramhead]

I love how approachable your demo was. Great video, thanks for sharing

[@rihanpereira5812]

This is great! Keeping going Hussein, we are your fanbase!

[@hnasr]

rihan pereira 😍😍

[@zahraghandi1361]

i wish i could like it more than once. you're a real life saver!

[@ChristofferLilja]

You are hilarious :-D No boring voice here, just a happy guy who want's to spread knowledge and does it great!

[@sammyj29]

I didn't even realize and more than an hour has passed watching this video. Learnt a lot!

[@dimitrivasilev2905]

Happy unless it comes to yaml

[@vincentnonnenmacher9352]

Looking you fuming on Yaml (which by the way is very pleasing to see you fighting vocally against :-)) I would suggest (see you on Mac with brew) to look at ‘babashka’ and ‘jet’. Jet could allow you to convert between json , yaml and a very nice format called ‘edn’ that is VERY simple to tackle and then you will be able to edit your edn (or json) and convert it back and forth to yaml without pain. Detrimental to us as you we could not anymore enjoy you ranting about it :-)

[@rajranjan8291]

Hey I like the way you are cribbing about the yaml syntax and still doing it. Too much funny man

[@hnasr]

YAML is painful but It won't beat me!

[@phillipguzman9071]

No you dont ssh into the container, you can customize by creating a new dockerfile and build or use runtime env files. You should look at containers.

[@ravi115ranjan]

quite an informative session. very funny style to explain the things.. really enjoyed watching this.

[@helloworld7313]

In my company, we write python scripts to generate yaml configs which're eventually used by nginx/envoy, this is much more enjoyable to write and less error-prone

[@hnasr]

I like this

[@Stephendenham]

What language do you use to generate the Python to ensure its indented correctly? ;)

[@andreykarayvansky9549]

I haven’t watched till the end yet, but so far “I lufv it”!

[@2sourcerer]

Well it's two years ago. But copy and paste from the beginning of the line in YAML can help. Thanks for this video it is very helpful.

[@jjames7206]

Awsome Hussein! Man I'd love your PLAN!!!!

[@hnasr]

J James 👍👍

[@jackma6083]

Very interesting tutorial, very humorous teacher

[@abessesmahi4888]

ما شاء الله لا قوة الا بالله مدهش! بارك الله فيك أخي حسين

[@hnasr]

Abesse Smahi الله يبارك فيك عزيزي شكر جزيلا 🙏

[@Eminemmc007]

Hi Hussein, could you also make a video on Consul service mesh and how to handle its sidecar proxy?

[@hnasr]

Nice idea almost forgot about Consul

[@bofletcher444]

Really good video. You are also very entertaining to listen to.

[@teunohooijer6788]

Personally I collapse the yml I don't need. It gives me more clarity. Maby that helps.

[@dimtass]

Thanks for the time you spend on this video. Although, I lost the count of how many puppies you've killed.

[@ibraheemalsaady3216]

Very fun video man, amazing job

[@priteshthakkar4802]

I am new to envoy and now think have good understanding of it. Thank you for doing it step by step, it was very interesting. I am trying to install / configure envoy and work with consul for service discovery. Please let me know if you have any document / video about it.

[@codersworld2598]

Hey Hussein, my brother you're amazing!

[@sagamp3]

Hey ! Hope you like a bit more Yaml now than 2 years ago. something great with yaml are anchor and reference to not duplicate everything all the time. If you hate yaml... JSON is 100% Yaml compatible so you can write it as JSON and load it as yaml

[@AbhishekPandey-ud3fe]

Hi Hussein , It was a great learning from this video. I have a request for you to create or share any demo for rate limit using Envoy

[@michaelmwebaze7310]

Awesome...awesome... thanks a lot!

[@lachieyoung1374]

Would love to see a video on Hashicorp Consul!

[@piyushranjan5327]

Loved it... Saved my day ++subscribe

[@AmanKumar-l1i1b]

I am getting this error "upstream connect error or disconnect/reset before headers. reset reason: remote connection failure, transport failure reason: delayed connect error: 61 envoy" can you please help me? Also on making some changes most of the time I am getting "No healthy upstream" error. Can anyone help?

[@kidistabraham49]

How do you configure TLS on the cluster service

[@kitkarson4226]

man you are very funny! I have seen some yaml haters. I never understood that. after seeing envoy config, I hate yaml myself now.

[@javedalishaikh4472]

This was really helpful, and agree with good documentation but really sucks in samples. Could you please do a video of Envoy Redis Proxy and Redis Cluster support.

[@m0aravindkarthik]

Is it possible to setup 2 listeners, one for http and another for https on same envoy?

[@68naveeng]

Hi, I have crl(certificate revocation list) cert in envoy /etc/ssl/crl/crl.pem. Its size is too big around 100MB. that's why not not using as secret (max secret size is 1 MB). every two day crl.pem refresh and I have to upload new crl.pem in envoy and restart envoy pod to activate new envoy configuration. Is there a way to reload crl without restart envoy pod? plz guide me I tries SDS, but not working

[@MrZerged]

This was very deep and a really great introduction for beginners thank you for putting it together. 2 questions, what would a general architecture look like with Envoy if you were using this as an internal load balancer for Microservices that receive heavy internal load (I.e. from other services) and 2) when are you going to do a live stream?!!

[@hnasr]

MrZerged thanks !! 1) assuming HTTP services one suggestion could be as L7 HTTP proxy However envoy performs better win the backend is H2 so having those services on H2 could be better (didn’t test it) 2) haha it might be soon I have been thinking about it

[@a_k__]

As always very useful! It would be a good next step if you can make a video about Linkerd

[@sagartyagi2450]

Quick question: Why didn't we saw the Thread issue(not being able to load balance properly) in Layer7, did we just got lucky?

[@Cobe299]

great and funny thing to watch, thank you

[@ClearlyCero]

Reverse prox-ies gotta catch em all!

[@can9]

If you think about the word "Cloud", the way Envoy uses downstream/upstream terminology makes sense. Just think like your packet goes to a server in a cloud.

[@ChristianAltamiranoAyala]

Man this video is sooo awesomeeeee.... Thanks so much...

[@hnasr]

Glad it helped!

[@ChristianAltamiranoAyala]

@@hnasr why does envoy throw error when the cluster upstream is localhost?

[@vitornesello]

Man, what about copying the whole line, including the whitespace. Then paste it on the first column, so you are sure to keep the same number of spaces. Great video btw

[@vitornesello]

😂😂😂 just after I wrote the comment you did exactly this at kzbin.info/www/bejne/amHKfK1-hryahpI

[@pollathajeeva23]

@hnasr I got some confusion around APIGatway vs DataMesh and Data plane vs control plane and so Envoy vs Consul. Please provide some insight about the same. Thanks!

[@sadeghhosseini6381]

Since yaml is a superset of json you could have also written the configs in json

[@jithutube]

Hi, thanks for the wonderful explanations. Can you give an example of how to use a listener filter per cluster?.. For ex, I'm trying to use original_Src filter, so that Envoy generates the upstream request packet with the actual downstream client IP. Is it possible to configure this per cluster/route ?

[@uberwebd9824]

We have 2500 lines of envoy config in yaml 😢 tell me about it

[@sadeghhosseini6381]

Nice job. Is it possible to break down the envoy.yaml to multiple separate files for the sake of keeping the config clean and maintainable?

[@saikrishna3374]

can implement envoy with docker swarm, will it work or not

[@thisis-zu5bo]

regarding downstream vs upstream terminology confusion water flows from top of the mountain downhill so similarly in computing data flows from upstreams to downstreams #copied from internet

[@khssky321]

I wanted to use envoy in case of outbound. just for forwarding. but envoy replied "no healthy upstream". I don't know how to make it.. I want to use envoy just for proxy to outbound(variable address, not static like inbound). anyone help me plz!! I already made inbound Architecture with lb. but outbound is not yet....

[@MartinsTalbergs]

FYI any JSON is perfeclty valid YAML (according to latest YAML specification)

[@vbs273]

hahaha Ash ketchum. Awesome video thanks

[@chengdongliao9875]

Hi Hussein, Thanks for the awesome demo! I have little knowledge about proxy settings, so a bit confused by your infra setting, 1. are you running envoy and app server both on your Mac? Because I see you run certbot locally...and 2. do you configure your browser and curl to use envoy as a proxy, otherwise how do they be aware of it? Thanks!

[@hnasr]

Chengdong Liao hey Thanks for your message ! Yes envoy and the services are both running locally on my mac (husseinmac) 2) no I have not setup proxy settings since I am using envoy as a revese proxy .. that is why the target destination is husseinmac:8080 which is envoy reverse proxy Proxy setup is completely different and this is not what I am presenting in this demo

[@chengdongliao9875]

@@hnasr Thanks for clarity!

[@chengdongliao9875]

Another question I have is how do you use no-ip hostname to access the service running locally in a private network where your laptop is running (192.168.0.x)? I guess you have somehow configured a public IP to access your laptop? 😂

[@milad9900]

hussein plz add a comparison video between envoy , krakend and kong

[@wsh4and]

Is this part of the Udemy course? Great job btw, I kind of need this.

[@alexinflux]

Awesome! Very helpful

[@hnasr]

Glad it was helpful!

[@rbsrafa]

Great video!

[@nicoladellino8124]

Nice video bro, tnx 👏 👏 👏

[@jimbo-dev]

Upstream = "up in the cloud", quite good terminology I think

[@rashmikhandelwal2597]

How to route on basis of http header in envoy proxy? I am sending an http request with below header. Header = {"InstanceId" : "1"} How to route to an cluster(endpoint) using this header value i.e. 1 What i actually want to do in envoy.yaml : If (header. InstanceId == 1) Route to cluster A Else If (header. InstanceId == 2) Route to cluster B Can someone please help me out. Thanks in advance.

[@68naveeng]

Hi ,Could you please put video or any link, how to use envoy mysql proxy (select command go to read DB and rest of all liek insert,delete etc etc go to RW DB). Thanks in Advance

[@Jayadeepkm]

Fyi, a valid json is also a valid yaml file. Yaml is designed like that. So you can just create your config in json.

[@hnasr]

Didn’t know that thanks!

[@germwire90]

Do you have a video on how you created the cert for your noip domain?

[@hnasr]

Its using lets encrypt certbot , I show it here kzbin.info/www/bejne/eanEnnuEmJiIaqM

[@aneyashasarkar201]

Do we need to download envoy..if yes can u share the link?

[@hnasr]

Yes here is the link www.getenvoy.io/install/envoy/macos/

[@aneyashasarkar201]

How can I install envoy in windows?

[@brijchavda]

super like and subscribed.

[@AshutoshKumar-ue3dr]

Hussein bro, could you make a video explaining the deep differences between Layer 4 and Layer 7 Proxy? I have read the general stuff but I want to know how exactly they effects an application in production.

[@hnasr]

Ashutosh Kumar hey! I actually made a detailed video here check it out Layer 4 vs Layer 7 Proxying In Details Explained with Examples kzbin.info/www/bejne/r53OcpZvrNJ-nsU

[@AshutoshKumar-ue3dr]

@@hnasr Thanks.

[@Pic14Kk]

How about envoy proxy integration with other software ?

[@princekumar5235]

Sir, how to create our own custom filter and integrate it with envoy?

[@hnasr]

Here is an example will have to write c++ based filter and link it github.com/envoyproxy/envoy-filter-example

[@princekumar5235]

@@hnasr thank you sir

[@stshenyan]

LUA too. maybe we could have WASM some day.

[@evans8245]

AYYEEEE RATE THESE in term of ease of learning, & developer experience 0(worst) - 10(best) envoy - traefik - HA Proxy - NGINX -

[@hnasr]

DELT Envoy: 6 Traefik: 2 HAPROXY 9 NGINX 7

[@evans8245]

@@hnasr yas ! thanks for the video mate !

[@YunikMaharjan]

@@hnasr i agree with traefik's 2 point , i have spent countless hours trying to figure out how to get my docker container service working. There is multiple ways of doing the same thing with docker labels and dynamic config file and for me that's confusing, I mostly blame the docs for this PS: I still haven't been able to auto-reload dynamic config on file changes

[@rumanHuq]

Turn on caption, go at 21:34, "beautiful, beautiful ......* "

[@dplameras]

I'm trying to understand what you mean about the threading model and its not truely load balanced? If its useing native threads or LWP in Linux it still uses multiple cores if available. In fact its more efficent then forking which has to copy the stack, heap. With LWP you can share the same memory space but create a seperate execution thread. Perhaps your thinking about Pythons threading model which is Green Threads and not Native threads? Green threads are not the same as OS threads. Green threads are managed in userspace and not at the OS level. Ruby, Python have a GiL which is why they will proably be never have native threads. Thats why its more desireable to Fork then Thread in those languages. A C++ program with native threads will beat a forked Python, Ruby script any day.

[@hnasr]

This is what I was referring to, nothing to do with the thread itself but the lack of coordination between the load balancer and the siloed threads www.envoyproxy.io/docs/envoy/latest/faq/load_balancing/concurrency_lb

[@srk-techblog627]

its not one thread per connection model. its multiple connections per thread. Please make correction in your video and slides.

[@hnasr]

From the doc “Once a connection is accepted by a listener, the connection spends the rest of its lifetime bound to a single worker thread. “ www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/intro/threading_model

[@srk-techblog627]

@@hnasr connection always is tied to that single thread, but then that thread is NOT tied to that single connection. its not 1-1 relation from both sides.

[@dejfcold]

for A+ in ssllabs you probably need HSTS.

[@eddiegangware6710]

OMG 36 minutes in you spelled listeners wrong!

[@stiqsify]

ctrl-a to go to start of line on shell prompt

[@hnasr]

Nice tip! Thanks

[@robot0763]

the issue with copy and past is that your editor tries to be smart and fix the indention for what you past. This is messing it up.

[@prs314]

sudo !!

[@kirkhutchinson364]

Your voice volume starts a sentence at one volume, but by the end is much quieter. That works fine in a 1x1 conversation but not so well for a training video.

[@AdriaPrado0]

"Traefik's documentation is atrocious" - couldn't agree more

[@remusprimus2392]

yeah YAML indentation sux....

[@jjames7206]

YAML for docker and kubernetes it's very readable, but use for configuration like envoy.............man! really like be tortured!

[@hnasr]

It was torture 😅

[@SweetHomeSydney]

Poor Commentary quality, doesn't keep audience engaged. Down vote.

[@elysweyr7987]

Can’t relate to your yaml pain.

[@notnull01]

This config type is so ugly

[@youtubegarbage4u]

if you were to deploy a $10k/month revenue production app today, what proxy server will you use Hussein?

[@hnasr]

haproxy

[@michaszajbe6829]

Ever heard of rivers? Downstream is the direction that the water in a river flows, upstream is towards the original source, where the river begins. Here, the original source is the backend node - the upstream. And the data flows downstream towards the client.

[@Hi_Chew]

awesome video!

[@krzysztofkaminski6474]

Great job. Going through proxies one by one gives us cool overview of the landscape. Caddy2 video would be awesome ;)

[@kentogisu4382]

This was a great watch. Your enjoyment and attitude towards this made it really refreshing. You made the concepts easy to understand and follow. Looking forward to your next videos.

[@hnasr]

kent thank you Kent I appreciate your comment 😊 I am happy you enjoyed the video despite it being long

[@venkateswaran8752]

awsome Hussein bro

[@sephiros9883]

This config file is out of control!! why are they making this so complicated! Also YAML is the devil incarnate. Every time I use Ansible i want to choke the guy who thought "YAML IS GREAT FOR THIS". HCL is 1000x better....

[@MimKhan-t2f]

Garcia Brenda Gonzalez Mark Lee Maria

[@veeramm]

Lively video.. great presentation

[@cabc74]

I used to hate yaml until I spent one hour learning it. It's everywhere so better learn it.

[@fardinhakimi]

How long to cook new york streak medium rate haha

[@nsmkhn]

dude, you are cool! :)

[@romangalochkin2564]

Thanks for the knowledge transfer videos, it is really useful.

[@hnasr]

Roman Galochkin my pleasure 😇

[@kenhan168]

This is a great video! Thanks so much for your sharing!

[@DavidHawlin]

Hussein, great videos! Anyone run envoy with allbackend.yaml and get "no healthy upstream"? you are lucky to have a Mac, with Windoze you have to install WSL 2 (Windows LINUX subsystem), i chose the Debian frontend. Not sure if this is a side effect of that? The upstream in envoy is the cluster allbackend_cluster correct? When i hear cluster, in this case I think Kubernetis. Do i need to install kubernetis inside the Debian linux created using WSL 2? I also did this the way you said was difficult running Kubernetis and Docker, from Docker Desktop, then running the envoy from Dockerhub. In this case I'm wondering how to get the envoy inside the Docker container to use a different config file, envoy is PID 1, if you kill envoy the Container crashes using the envoyproxy/proxy-dev from Docker Hub. I know, I know RTFM but the answer might help others.

[@shyirtt]

One and only best video available about envoy. Thank you. I have one question. I am not able to understand Why l7 proxying was doing the load balancing between endpoints. I know that we got lucky but what is special about l7 proxying which gives this behavior vs l4?

[@hinome5406]

Hey! Nice video but I got a question. Is it possible to split X and Y (my backend) and access to them but with only one port? But not like in the video; I mean, not with the prefix (/x or /y) but with the URL like service_name with Nginx.