Cilium is a Kubernetes-native networking, observability, and security solution built on eBPF. It provides CNI plugin functionality with overlay/native routing modes, distributed load balancing (replacing kube-proxy), cluster mesh for multi-cluster connectivity, identity-based network policies (L3-L7), service mesh with mutual authentication, and observability via Hubble (flow metrics, DNS insights). The architecture features a modular design using the Hive dependency injection framework, with components including the cilium-agent daemon, operator for CRD management, CLI tools for management/debugging, and API servers for inter-component communication. The data plane leverages eBPF/XDP for high-performance packet processing, while the control plane integrates deeply with Kubernetes through client-go, controller-runtime, and custom resource definitions.
gRPC is a high-performance, open-source universal RPC framework that enables client and server applications to communicate transparently and simplifies the building of connected systems. It provides language bindings for C++, Python, Ruby, PHP, Objective-C, and C#, uses protocol buffers for interface definition and serialization, and supports HTTP/2 transport with advanced features like authentication, load balancing, tracing, and health checking. The architecture consists of a core C++ implementation handling transport and channel management, language-specific wrappers, and a plugin/extension system for customizing behavior.
Istio is a service mesh platform that provides traffic management, security, and observability for microservices. It consists of a control plane (Istiod), data plane proxies (Envoy or Ztunnel), and operational tools (istioctl, operator). The system secures service-to-service communication via mTLS and authorization policies, manages traffic routing and load balancing, and collects telemetry data. Architecture follows a modular design with clear separation between control plane (configuration distribution, certificate management), data plane (traffic interception and policy enforcement), and plug-in points (CNI, WebAssembly, gateway APIs). Key entry points include istioctl CLI, pilot-discovery control plane, and CNI node agent. The codebase demonstrates strong engineering practices with extensive testing, interface-based abstractions, and reusable utility libraries.
Envoy is a cloud-native high-performance edge/middle/service proxy designed for service-to-service communication in modern microservices architectures. It provides traffic management (load balancing, routing, retries), observability (tracing, logging, metrics), security (TLS, authentication, authorization), and resilience features through a modular, extensible plugin architecture. The core is written in C++ with support for extensions in C++, Rust, Go, and WebAssembly. Configuration is managed via Protobuf-defined xDS APIs, enabling dynamic updates without restarts. The project emphasizes performance, security, and observability, with extensive testing and active maintenance. Architecturally, Envoy follows an event-driven, threaded model with worker threads handling connections. Key components include: a server manager for listener/worker lifecycle, network filter chains for connection-level processing, HTTP filter chains for L7 processing, and a configuration subsystem using xDS for dynamic discovery of listeners, clusters, routes, and extensions. Extension points (filters, transports, tracers, etc.) are implemented via a factory registration system, allowing runtime plugin loading through the dynamic module system. Data flow involves ingress connection acceptance, network filter processing, HTTP filter processing (if applicable), upstream connection establishment via load balancer and connection pool, and egress response transmission. Envoy relies on external dependencies including BoringSSL/OpenSSL for TLS, Protobuf for configuration, gRPC for xDS, Abseil for utilities, and various protocol-specific libraries (MongoDB, Redis, etc.) in contrib extensions. The build system is Bazel-centric with complex dependency management. The project shows strong maintenance activity with frequent releases, active issue triage, and ongoing dependency updates. Technical drift is low due to proactive compatibility layers (e.g., OpenSSL shims) and vigilant dependency tracking.
Apache SkyWalking is an open-source APM (Application Performance Monitoring) system designed for microservices, cloud-native, and container-based architectures. It provides distributed tracing, metrics aggregation, log analysis, and profiling capabilities (including eBPF, async-profiler, and JFR). The system features a modular, plugin-based architecture where receivers ingest telemetry data, analyzers process it, storage plugins persist it, and query services expose it via GraphQL, PromQL, LogQL, and TraceQL interfaces. Alarm mechanisms detect anomalies and trigger notifications through multiple channels. The codebase demonstrates strong engineering practices with clear separation of concerns, extensive use of interfaces and dependency injection, and reusable patterns like the module system, storage abstraction, and analysis listener framework.
Apache Dubbo-go is a production-grade Go RPC and microservices framework that implements the Apache Dubbo protocol family. It provides a full service governance stack: service registration and discovery (ZooKeeper, Nacos, etcd, Polaris), dynamic configuration centers (Apollo, ZooKeeper, Nacos, file), cluster strategies (failover, failfast, broadcast, forking, zone-aware), load balancing (random, round-robin, consistent hashing, P2C, alias method, IWRR), routing (tag, condition, script, affinity), and a filter chain for auth, tracing, TPS limiting, metrics, and graceful shutdown. The framework is library-oriented rather than a standalone application; users build services through server.NewServer and client.NewClient, with the imports package registering all default SPI extensions via init().
Emissary-ingress (formerly Ambassador) is a Kubernetes-native API gateway and ingress controller built on Envoy Proxy. It sits at the edge of a Kubernetes cluster, managing ingress traffic with self-service configuration via Custom Resource Definitions (CRDs) like Mapping, Host, Module, AuthService, RateLimitService, and TLSContext. The system is architected as a dual-language control plane: a Go-based main entrypoint (`cmd/entrypoint/`) handles Kubernetes resource watching, snapshot assembly, secret reconciliation, and Envoy lifecycle management, while a Python-based configuration engine (`python/ambassador/`) compiles the desired state into an Intermediate Representation (IR) and generates Envoy xDS configuration (v3). A separate Go API extension server (`cmd/apiext/`) provides conversion webhooks and certificate management for CRD versions (v1, v2, v3alpha1). The compiled Envoy configuration is served via gRPC and pushed to Envoy through the ambex package using go-control-plane. Key data flows: Kubernetes resources (CRDs, Ingresses, Services) are watched by Go watchers and accumulated into snapshots via the `pkg/kates/accumulator`. Snapshots are passed to the Python diagd process, which builds an IR (Intermediate Representation) and generates Envoy v3 configuration for listeners, clusters, routes, filters (auth, rate limiting, gzip, CORS, tracing), and TLS settings. The resulting config is written as JSON files, read by the ambex ADS server, and pushed to Envoy. The system supports dynamic updates without restart, canary deployments, circuit breaking, health checks, Istio and Consul integration, and extensive observability (Prometheus, StatsD, Datadog). The codebase demonstrates strong engineering practices with a comprehensive test suite including Go unit tests, Python unit tests, Kubernetes integration tests (KAT framework), and e2e tests using chainsaw and k3d. It has a mature build system with multi-architecture Docker images, Helm charts, and automated release pipelines. While the dual-language architecture introduces some complexity and duplication (e.g., service name normalization in both Python and Go), the project is actively maintained with regular releases and a large community (4.5k stars, 700+ forks).
Apache Dubbo is a mature, actively maintained Java-based RPC framework and microservices platform. It is not a data research project. The codebase implements a complete distributed service communication solution, including multiple RPC protocols (Dubbo2/TCP, Triple/gRPC-compatible, REST, WebSocket), service discovery and registration (ZooKeeper, Nacos, Apollo, multicast), traffic management (routing, load balancing, circuit breaking), observability (metrics, tracing, monitoring), security (authentication, TLS), and a large set of extension points via a custom SPI mechanism. The architecture is modular and layered, organized into distinct Maven modules for remoting, RPC, cluster, config, registry, metadata, metrics, serialization, and Spring Boot integration. Key entry points include DubboBootstrap for programmatic startup, ServiceConfig/ReferenceConfig for service export/import, and various protocol and registry factories loaded via SPI. The system relies heavily on URL-based configuration, extension loading, and a scope model (framework, application, module, service) for lifecycle and classloader isolation. The codebase is massive (4870 files), with extensive test coverage and active development (last commit 2026-06-29). It demonstrates strong engineering practices: clean abstractions, consistent patterns, backward-compatibility layers (dubbo-compatible), and support for modern Java versions and Spring Boot 3.
HashiCorp Consul is a distributed service mesh platform providing service discovery, health checking, dynamic configuration, and multi-datacenter federation. The codebase implements a full-stack system: a Go-based agent that runs as a server or client, a CLI tool for administration, a web UI built with Ember.js, and extensive gRPC/protobuf-based APIs for internal and external communication. The agent uses Raft consensus for state replication, maintains an in-memory database (memdb) for service and configuration state, and generates Envoy xDS configuration for service mesh gateways. Key entry points include the agent server (agent/consul/), CLI commands (command/), and the UI router (ui/packages/consul-ui/app/router.js). External dependencies include protobuf, gRPC, Envoy, and various cloud provider SDKs (AWS, Azure, GCP). The codebase is actively maintained with a large test suite covering unit, integration, and acceptance tests.
This repository implements a Kubernetes operator for managing egress traffic in Kubernetes clusters. It provides stable egress IP addresses for pods through a control plane/data plane architecture consisting of a controller (managing cluster state via custom resources) and an agent (applying network configuration on each node). The system uses VXLAN tunneling to encapsulate traffic between nodes and employs iptables/IP sets for policy enforcement. It includes features like IP allocation, failover mechanisms, dual-stack support, and comprehensive observability via Prometheus metrics.
This repository is a comprehensive personal R&D platform implementing a polyglot microservices architecture. It hosts a personal website/web application (React/Vite), multiple API servers in different languages (Rust/Axum, Go/Gin/gRPC, Python/FastAPI, Node.js/Express), mobile applications (iOS/Android/React Native), and desktop applications (Qt). The platform includes extensive data processing infrastructure (Kafka, Pulsar, NATS, Spark, Flink), machine learning capabilities (model training/serving/fine-tuning), monitoring and observability tools, and infrastructure as code (Terraform/OpenTofu, Kubernetes). Services communicate via messaging systems and APIs, with a clear separation of concerns and standardized patterns for configuration, health checks, logging, and error handling across language implementations.
Yggdrasil is an Envoy control plane that watches Kubernetes ingress resources across multiple clusters and generates dynamic configuration for Envoy proxies. It implements a modular architecture with separate packages for Kubernetes integration (pkg/k8s) and Envoy configuration generation (pkg/envoy). The system uses Kubernetes informers to watch resources, aggregates events from multiple clusters, translates ingress objects into Envoy listeners and clusters, and serves the configuration via xDS gRPC protocol. It also provides metrics and health endpoints for monitoring. The code demonstrates good separation of concerns, proper use of Kubernetes client-go patterns, and clean abstraction for handling multiple Kubernetes API versions.
This repository is primarily an open-source technical book and architecture knowledge base written in Chinese, rendered as a heavily customized VuePress static site. The core deliverable is the book itself — chapters spanning architecture history, distributed systems foundations, transactions, security, observability, service mesh, containers, and cloud-native infrastructure — rather than a runnable software service. It is best classified as a documentation/application hybrid: the only application code is the VuePress site infrastructure, custom plugins, CI/CD scripts, and an embedded resume slide-deck framework. The repository also links to external companion demo projects (Spring Boot, Spring Cloud, Kubernetes, Istio, serverless) rather than hosting them in-tree.
Apache Dubbo for Kubernetes is a service mesh control plane that extends Apache Dubbo's capabilities to Kubernetes-native environments. It provides an xDS-based control plane (dubbod) for dynamic configuration of gRPC proxies, sidecar injection via a mutating webhook and CNI plugin, mTLS with a built-in certificate authority, and integration with the Kubernetes Gateway API for traffic management. The system also includes a KEDA-based activation mechanism for scale-to-zero workloads, multi-cluster support, and an operator for lifecycle management. The codebase is heavily inspired by Istio, with many packages adapted from that project, and includes a reactive collections framework (krt) for building incremental state from Kubernetes resources. It is in an active development phase with some incomplete features and generated code dependencies.
This repository hosts the source code for '深入高可用系统原理与设计' (Deep dive into high availability system principles and design), a technical book covering system architecture, networking, distributed systems, and cloud-native technologies. The content is organized as a VuePress documentation site, transforming markdown files into a navigable web book with features like dark mode toggle, star tracking, and comment integration. The application architecture follows a standard VuePress static site generator pattern: markdown content is processed through VuePress with custom plugins and styling to produce a deployable static website. Key components include a customized layout that adds book-specific elements (purchase QR code, star counter) and implements reactive dark mode detection using MutationObserver. The site is built and deployed via GitHub Actions to an Aliyun server. While the repository excels in content organization and documentation clarity, the underlying VuePress implementation shows some technical drift due to reliance on outdated release-candidate versions of core dependencies. Nevertheless, it demonstrates solid engineering practices in its customizations, particularly in the reusable styling enhancements found in .vuepress/styles/index.scss which address documentation-specific needs like image centering, responsive content width, and print optimization.
This repository implements an API Gateway based on Openresty and NGINX with LuaJIT for high-performance request processing. The system provides service discovery via Marathon integration, API key validation, HMAC/OAuth authentication, rate limiting, request/response transformation, and metrics collection. Architecture-wise, it uses a modular design with NGINX configuration files defining request processing phases, Lua modules for extensible functionality (validation, tracking, metrics), and external dependencies for service discovery (Marathon), caching (Redis), and metrics reporting (StatsD). Key entry points include the health-check endpoint (/health-check), metrics endpoint (/api-gateway-stats), and admin API (/tracking/* on port 5000). The gateway processes client requests through validation phases, proxies them to backend services, collects metrics throughout, and returns responses while supporting dynamic configuration reloading and remote config sync from S3.