Istio is a service mesh platform that provides traffic management, security, and observability for microservices. It consists of a control plane (Istiod), data plane proxies (Envoy or Ztunnel), and operational tools (istioctl, operator). The system secures service-to-service communication via mTLS and authorization policies, manages traffic routing and load balancing, and collects telemetry data. Architecture follows a modular design with clear separation between control plane (configuration distribution, certificate management), data plane (traffic interception and policy enforcement), and plug-in points (CNI, WebAssembly, gateway APIs). Key entry points include istioctl CLI, pilot-discovery control plane, and CNI node agent. The codebase demonstrates strong engineering practices with extensive testing, interface-based abstractions, and reusable utility libraries.
Envoy is a cloud-native high-performance edge/middle/service proxy designed for service-to-service communication in modern microservices architectures. It provides traffic management (load balancing, routing, retries), observability (tracing, logging, metrics), security (TLS, authentication, authorization), and resilience features through a modular, extensible plugin architecture. The core is written in C++ with support for extensions in C++, Rust, Go, and WebAssembly. Configuration is managed via Protobuf-defined xDS APIs, enabling dynamic updates without restarts. The project emphasizes performance, security, and observability, with extensive testing and active maintenance. Architecturally, Envoy follows an event-driven, threaded model with worker threads handling connections. Key components include: a server manager for listener/worker lifecycle, network filter chains for connection-level processing, HTTP filter chains for L7 processing, and a configuration subsystem using xDS for dynamic discovery of listeners, clusters, routes, and extensions. Extension points (filters, transports, tracers, etc.) are implemented via a factory registration system, allowing runtime plugin loading through the dynamic module system. Data flow involves ingress connection acceptance, network filter processing, HTTP filter processing (if applicable), upstream connection establishment via load balancer and connection pool, and egress response transmission. Envoy relies on external dependencies including BoringSSL/OpenSSL for TLS, Protobuf for configuration, gRPC for xDS, Abseil for utilities, and various protocol-specific libraries (MongoDB, Redis, etc.) in contrib extensions. The build system is Bazel-centric with complex dependency management. The project shows strong maintenance activity with frequent releases, active issue triage, and ongoing dependency updates. Technical drift is low due to proactive compatibility layers (e.g., OpenSSL shims) and vigilant dependency tracking.
Higress is a cloud-native, AI-native API gateway built on Istio and Envoy. In production, it operates as a Kubernetes ingress controller, an AI/LLM proxy gateway, and a Wasm plugin host. The system ingests Kubernetes resource definitions (Ingress, Gateway API, custom CRDs like WasmPlugin, Http2Rpc, McpBridge) and translates them into Envoy xDS configurations, managing the full lifecycle of gateway routes, policies, and plugins. It provides a rich set of Wasm plugins (Go, Rust, C++, AssemblyScript) for authentication, rate limiting, request/response transformation, AI proxy (with 15+ LLM providers), semantic caching, RAG, MCP server hosting, and security (WAF, bot detection, IP restriction). The architecture is microservices-oriented: a control plane (Go-based ingress controller) manages Kubernetes resources and pushes config to Envoy data planes; a CLI tool (hgctl) handles installation, plugin development, and debugging; and a plugin release pipeline manages OCI image distribution with provenance verification. External dependencies include Kubernetes (client-go, controller-runtime), Istio (pilot, networking APIs), Envoy (Go filter API), and various AI/vector DB providers (OpenAI, Milvus, Pinecone, etc.).
Pomerium is an identity-aware access proxy that provides zero-trust security for internal web applications and services. It acts as a reverse proxy that authenticates users via OIDC/OAuth2 providers, authorizes access based on policy rules (Pomerium Policy Language evaluated via OPA/Rego), and proxies HTTP, gRPC, WebSocket, and SSH traffic. The system is built as a multi-service architecture with gRPC-based inter-service communication, using Envoy as the underlying proxy engine. Key components include an authentication service, authorization service with policy evaluator, a distributed databroker for session/config storage (with Raft consensus), and a control plane that generates Envoy configuration dynamically. It supports multiple identity providers (Google, Okta, Azure, Auth0, etc.), mTLS client certificates, WebAuthn, and SSH tunneling with a TUI client. The codebase also includes a Model Context Protocol (MCP) implementation for AI tool access control, and a 'Zero' cloud-managed mode for enterprise deployments. External dependencies include Envoy, PostgreSQL, Pebble (RocksDB), and cloud blob storage (S3, GCS, Azure Blob). Architecturally, Pomerium follows a modular design with clear separation of concerns: configuration management (layered sources, validation, envoy config builders), policy engine (parser, generator, criteria matchers), storage abstraction (in-memory, file, postgres, blob with caching and querier patterns), telemetry (OpenTelemetry, Prometheus, health checks), and utility packages (cryptography, HTTP, gRPC, protobuf, retry, fanout). The system is highly configurable with runtime flags and supports hot-reload via config diffing. The codebase demonstrates strong engineering practices with extensive unit, integration, and end-to-end tests (Playwright-based acceptance suites). Data flows: Incoming requests are intercepted by Envoy, which forwards them to the Pomerium proxy service. The proxy authenticates the user via the authenticate service (OIDC/OAuth2 flows), then authorizes via the authorize service (policy evaluation with OPA/Rego). Session and user data are stored in the databroker (distributed key-value store with Raft replication). Configuration is managed centrally and distributed to all services via gRPC streams. Telemetry data (traces, metrics, logs) is exported via OpenTelemetry and Prometheus.
Emissary-ingress (formerly Ambassador) is a Kubernetes-native API gateway and ingress controller built on Envoy Proxy. It sits at the edge of a Kubernetes cluster, managing ingress traffic with self-service configuration via Custom Resource Definitions (CRDs) like Mapping, Host, Module, AuthService, RateLimitService, and TLSContext. The system is architected as a dual-language control plane: a Go-based main entrypoint (`cmd/entrypoint/`) handles Kubernetes resource watching, snapshot assembly, secret reconciliation, and Envoy lifecycle management, while a Python-based configuration engine (`python/ambassador/`) compiles the desired state into an Intermediate Representation (IR) and generates Envoy xDS configuration (v3). A separate Go API extension server (`cmd/apiext/`) provides conversion webhooks and certificate management for CRD versions (v1, v2, v3alpha1). The compiled Envoy configuration is served via gRPC and pushed to Envoy through the ambex package using go-control-plane. Key data flows: Kubernetes resources (CRDs, Ingresses, Services) are watched by Go watchers and accumulated into snapshots via the `pkg/kates/accumulator`. Snapshots are passed to the Python diagd process, which builds an IR (Intermediate Representation) and generates Envoy v3 configuration for listeners, clusters, routes, filters (auth, rate limiting, gzip, CORS, tracing), and TLS settings. The resulting config is written as JSON files, read by the ambex ADS server, and pushed to Envoy. The system supports dynamic updates without restart, canary deployments, circuit breaking, health checks, Istio and Consul integration, and extensive observability (Prometheus, StatsD, Datadog). The codebase demonstrates strong engineering practices with a comprehensive test suite including Go unit tests, Python unit tests, Kubernetes integration tests (KAT framework), and e2e tests using chainsaw and k3d. It has a mature build system with multi-architecture Docker images, Helm charts, and automated release pipelines. While the dual-language architecture introduces some complexity and duplication (e.g., service name normalization in both Python and Go), the project is actively maintained with regular releases and a large community (4.5k stars, 700+ forks).
Yggdrasil is an Envoy control plane that watches Kubernetes ingress resources across multiple clusters and generates dynamic configuration for Envoy proxies. It implements a modular architecture with separate packages for Kubernetes integration (pkg/k8s) and Envoy configuration generation (pkg/envoy). The system uses Kubernetes informers to watch resources, aggregates events from multiple clusters, translates ingress objects into Envoy listeners and clusters, and serves the configuration via xDS gRPC protocol. It also provides metrics and health endpoints for monitoring. The code demonstrates good separation of concerns, proper use of Kubernetes client-go patterns, and clean abstraction for handling multiple Kubernetes API versions.