Envoy 面试题

1. CDS 下发 Cluster 列表（如 backend-cluster）
2. EDS 下发各 Cluster 的 Endpoint（如 10.0.1.5:8080, 10.0.1.6:8080）
3. LDS 下发 Listener（如 0.0.0.0:80）
4. RDS 下发 Route（如 /api/* 路由到 backend-cluster）

dynamic_resources:
  ads_config:
    api_type: GRPC
    transport_api_version: V3
    grpc_services:
    - envoy_grpc:
        cluster_name: xds_cluster
  cds_config: { ads: {}, resource_api_version: V3 }
  lds_config: { ads: {}, resource_api_version: V3 }

Listener (0.0.0.0:80)
  └── Filter Chain (SNI/transport_protocol 匹配)
       └── HTTP Connection Manager
            └── Route Configuration
                 └── Virtual Host (host 匹配)
                      └── Route (path/header 匹配)
                           └── Cluster (后端服务)
                                └── Endpoint (具体 IP:Port)

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 10000 }
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: backend
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { cluster: service_cluster }
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

  clusters:
  - name: service_cluster
    connect_timeout: 5s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: service_cluster
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: backend.svc, port_value: 8080 }

virtual_hosts:
- name: api
  domains: ["api.example.com"]
  routes:
  # 灰度发布（权重路由）
  - match: { prefix: "/v1/" }
    route:
      weighted_clusters:
        clusters:
        - { name: api_v1_stable, weight: 90 }
        - { name: api_v1_canary, weight: 10 }

  # Header 匹配（按用户标签路由）
  - match:
      prefix: "/v2/"
      headers:
      - name: x-user-tier
        string_match: { exact: "premium" }
    route: { cluster: api_v2_premium }

  # 重试 + 超时
  - match: { prefix: "/payment/" }
    route:
      cluster: payment_cluster
      timeout: 3s
      retry_policy:
        retry_on: "5xx,reset,connect-failure"
        num_retries: 3
        per_try_timeout: 1s
        retry_back_off:
          base_interval: 0.1s
          max_interval: 1s

  # 流量镜像（影子流量）
  - match: { prefix: "/order/" }
    route:
      cluster: order_v1
      request_mirror_policies:
      - cluster: order_v2_shadow
        runtime_fraction:
          default_value: { numerator: 50, denominator: HUNDRED }

  # 重定向
  - match: { prefix: "/old/" }
    redirect:
      path_redirect: "/new/"
      response_code: MOVED_PERMANENTLY

clusters:
- name: user_service
  connect_timeout: 1s
  type: EDS
  lb_policy: LEAST_REQUEST
  eds_cluster_config:
    eds_config:
      ads: {}
    service_name: user_service

  # 健康检查
  health_checks:
  - timeout: 1s
    interval: 5s
    unhealthy_threshold: 3
    healthy_threshold: 2
    http_health_check:
      path: "/healthz"

  # 熔断
  circuit_breakers:
    thresholds:
    - priority: DEFAULT
      max_connections: 1024
      max_pending_requests: 1024
      max_requests: 1024
      max_retries: 3

  # 异常点检测（Passive 健康检查）
  outlier_detection:
    consecutive_5xx: 5
    interval: 10s
    base_ejection_time: 30s
    max_ejection_percent: 50

                Istiod (Control Plane)
                /  |  \
               /   |   \
            xDS  xDS  xDS  (gRPC ADS Stream)
            /     |     \
        Pod A   Pod B   Pod C
       [Envoy]  [Envoy] [Envoy]
       [App ]   [App ]  [App ]

# 查看 Sidecar 收到的配置
istioctl proxy-config listener <pod>
istioctl proxy-config route    <pod>
istioctl proxy-config cluster  <pod>
istioctl proxy-config endpoint <pod>
istioctl proxy-config secret   <pod>

# 实时配置 dump
kubectl exec <pod> -c istio-proxy -- pilot-agent request GET config_dump

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: add-custom-header
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: gateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inline_code: |
            function envoy_on_response(response_handle)
              response_handle:headers():add("x-custom-header", "from-envoyfilter")
            end

http_filters:
- name: envoy.filters.http.lua
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
    default_source_code:
      inline_string: |
        function envoy_on_request(request_handle)
          local headers = request_handle:headers()
          if headers:get("x-bypass") == "true" then
            request_handle:respond(
              { [":status"] = "403" },
              "Forbidden by Lua filter"
            )
          end
          headers:add("x-trace-id", os.time())
        end

http_filters:
- name: envoy.filters.http.wasm
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
    config:
      name: custom_auth
      root_id: custom_auth
      vm_config:
        runtime: envoy.wasm.runtime.v8
        code:
          remote:
            http_uri:
              uri: https://registry.example.com/wasm/auth.wasm
              cluster: wasm_registry
              timeout: 5s
            sha256: "abc123..."

http_filters:
- name: envoy.filters.http.ext_authz
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
    grpc_service:
      envoy_grpc: { cluster_name: ext_authz_cluster }
      timeout: 0.5s
    failure_mode_allow: false

listeners:
- name: ingress
  address:
    socket_address: { address: 0.0.0.0, port_value: 443 }
  filter_chains:
  - transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
        require_client_certificate: true
        common_tls_context:
          tls_certificate_sds_secret_configs:
          - name: server_cert
            sds_config: { ads: {} }
          validation_context_sds_secret_config:
            name: client_ca
            sds_config: { ads: {} }
    filters: [...]

clusters:
- name: backend
  transport_socket:
    name: envoy.transport_sockets.tls
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
      common_tls_context:
        tls_certificate_sds_secret_configs:
        - name: client_cert
          sds_config: { ads: {} }
        validation_context_sds_secret_config:
          name: server_ca
          sds_config: { ads: {} }
      sni: backend.svc

# 查看 Sidecar 上的证书有效期、链路
istioctl proxy-config secret <pod> -o json | jq

# 验证 mTLS 连通性
istioctl authn tls-check <pod>.<ns>.svc.cluster.local

# GatewayClass
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata: { name: eg }
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass
# Gateway
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: { name: prod-gw }
spec:
  gatewayClassName: eg
  listeners:
  - name: https
    protocol: HTTPS
    port: 443
    tls:
      mode: Terminate
      certificateRefs:
      - { name: tls-secret }
# HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: api }
spec:
  parentRefs: [{ name: prod-gw }]
  hostnames: ["api.example.com"]
  rules:
  - matches: [{ path: { type: PathPrefix, value: /v1 } }]
    backendRefs: [{ name: api-v1-svc, port: 8080 }]
# 自定义 Envoy 参数
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata: { name: custom-proxy }
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 3
        resources:
          requests: { cpu: 500m, memory: 512Mi }

http_filters:
- name: envoy.filters.http.router
  typed_config: { "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router }
access_log:
- name: envoy.access_loggers.file
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
    path: /dev/stdout
    log_format:
      json_format:
        time: "%START_TIME%"
        method: "%REQ(:METHOD)%"
        path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
        protocol: "%PROTOCOL%"
        response_code: "%RESPONSE_CODE%"
        response_flags: "%RESPONSE_FLAGS%"
        bytes_received: "%BYTES_RECEIVED%"
        bytes_sent: "%BYTES_SENT%"
        duration: "%DURATION%"
        upstream_service_time: "%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%"
        x_forwarded_for: "%REQ(X-FORWARDED-FOR)%"
        user_agent: "%REQ(USER-AGENT)%"
        request_id: "%REQ(X-REQUEST-ID)%"
        authority: "%REQ(:AUTHORITY)%"
        upstream_host: "%UPSTREAM_HOST%"
        upstream_cluster: "%UPSTREAM_CLUSTER%"

access_log:
- name: envoy.access_loggers.http_grpc
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
    common_config:
      log_name: ingress
      grpc_service:
        envoy_grpc: { cluster_name: als_cluster }
      transport_api_version: V3

access_log:
- name: envoy.access_loggers.file
  filter:
    status_code_filter:
      comparison:
        op: GE
        value: { default_value: 400, runtime_key: access_log.min_status }
  typed_config: {...}

admin:
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }

# 直接采集 /stats/prometheus
# curl localhost:9901/stats/prometheus

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata: { name: envoy }
spec:
  selector: { matchLabels: { app: envoy } }
  endpoints:
  - port: admin
    path: /stats/prometheus
    interval: 30s

stats_sinks:
- name: envoy.stat_sinks.statsd
  typed_config:
    "@type": type.googleapis.com/envoy.config.metrics.v3.StatsdSink
    address:
      socket_address: { address: 127.0.0.1, port_value: 8125 }

tracing:
  http:
    name: envoy.tracers.opentelemetry
    typed_config:
      "@type": type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig
      grpc_service:
        envoy_grpc: { cluster_name: otel_collector }
      service_name: edge_envoy

http_filters:
- name: envoy.filters.http.router
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
    start_child_span: true

http_connection_manager:
  tracing:
    random_sampling: { value: 100 }       # 100% 采样
    client_sampling: { value: 100 }
    overall_sampling: { value: 100 }
    custom_tags:
    - tag: user.id
      request_header:
        name: x-user-id
    - tag: env
      literal:
        value: production

# 启动参数
envoy --concurrency 8 --cpuset-threads

clusters:
- name: backend
  connect_timeout: 1s
  per_connection_buffer_limit_bytes: 1048576   # 1MiB
  upstream_connection_options:
    tcp_keepalive:
      keepalive_probes: 3
      keepalive_time: 30
      keepalive_interval: 10

  # HTTP/2 连接复用
  typed_extension_protocol_options:
    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
      "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
      explicit_http_config:
        http2_protocol_options:
          max_concurrent_streams: 100
          initial_stream_window_size: 65536
          initial_connection_window_size: 1048576

  # 熔断与连接上限
  circuit_breakers:
    thresholds:
    - priority: DEFAULT
      max_connections: 4096
      max_pending_requests: 4096
      max_requests: 65536
      max_retries: 3
      track_remaining: true

listeners:
- name: ingress
  per_connection_buffer_limit_bytes: 1048576
  socket_options:
  - level: 1            # SOL_SOCKET
    name: 9             # SO_KEEPALIVE
    int_value: 1
    state: STATE_PREBIND
  - level: 6            # IPPROTO_TCP
    name: 7             # TCP_DEFER_ACCEPT
    int_value: 1
    state: STATE_LISTENING

overload_manager:
  refresh_interval: 0.25s
  resource_monitors:
  - name: envoy.resource_monitors.fixed_heap
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
      max_heap_size_bytes: 4294967296   # 4 GiB
  actions:
  - name: envoy.overload_actions.shrink_heap
    triggers:
    - name: envoy.resource_monitors.fixed_heap
      threshold: { value: 0.85 }
  - name: envoy.overload_actions.stop_accepting_requests
    triggers:
    - name: envoy.resource_monitors.fixed_heap
      threshold: { value: 0.95 }