Configuring Envoy as an edge proxy

Envoy is a production-ready edge proxy, however, the default settings are tailored for the service mesh use case, and some values need to be adjusted when using Envoy as an edge proxy.

TCP proxies should configure:

HTTP proxies should additionally configure:

The following is a YAML example of the above recommendation.

  1. overload_manager:
  2.   refresh_interval: 0.25s
  3.   resource_monitors:
  4.   - name: "envoy.resource_monitors.fixed_heap"
  5.     typed_config:
  6.       "@type": type.googleapis.com/envoy.config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig
  7.       # TODO: Tune for your system.
  8.       max_heap_size_bytes: 2147483648 # 2 GiB
  9.   actions:
  10.   - name: "envoy.overload_actions.shrink_heap"
  11.     triggers:
  12.     - name: "envoy.resource_monitors.fixed_heap"
  13.       threshold:
  14.         value: 0.95
  15.   - name: "envoy.overload_actions.stop_accepting_requests"
  16.     triggers:
  17.     - name: "envoy.resource_monitors.fixed_heap"
  18.       threshold:
  19.         value: 0.98
  21. admin:
  22.   access_log_path: "/var/log/envoy_admin.log"
  23.   address:
  24.     socket_address:
  25.       address: 127.0.0.1
  26.       port_value: 9090
  28. static_resources:
  29.   listeners:
  30.   - address:
  31.       socket_address:
  32.         address: 0.0.0.0
  33.         port_value: 443
  34.     listener_filters:
  35.     - name: "envoy.listener.tls_inspector"
  36.       typed_config: {}
  37.     per_connection_buffer_limit_bytes: 32768 # 32 KiB
  38.     filter_chains:
  39.     - filter_chain_match:
  40.         server_names: ["example.com", "www.example.com"]
  41.       tls_context:
  42.         common_tls_context:
  43.           tls_certificates:
  44.           - certificate_chain: { filename: "example_com_cert.pem" }
  45.             private_key: { filename: "example_com_key.pem" }
  46.       # Uncomment if Envoy is behind a load balancer that exposes client IP address using the PROXY protocol.
  47.       # use_proxy_proto: true
  48.       filters:
  49.       - name: envoy.http_connection_manager
  50.         typed_config:
  51.           "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
  52.           stat_prefix: ingress_http
  53.           use_remote_address: true
  54.           common_http_protocol_options:
  55.             idle_timeout: 3600s # 1 hour
  56.           http2_protocol_options:
  57.             max_concurrent_streams: 100
  58.             initial_stream_window_size: 65536 # 64 KiB
  59.             initial_connection_window_size: 1048576 # 1 MiB
  60.           stream_idle_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
  61.           request_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
  62.           route_config:
  63.             virtual_hosts:
  64.             - name: default
  65.               domains: "*"
  66.               routes:
  67.               - match: { prefix: "/" }
  68.                 route:
  69.                   cluster: service_foo
  70.                   idle_timeout: 15s # must be disabled for long-lived and streaming requests
  71.   clusters:
  72.     name: service_foo
  73.     connect_timeout: 15s
  74.     per_connection_buffer_limit_bytes: 32768 # 32 KiB
  75.     hosts:
  76.       socket_address:
  77.         address: 127.0.0.1
  78.         port_value: 8080
  79.     http2_protocol_options:
  80.       initial_stream_window_size: 65536 # 64 KiB
  81.       initial_connection_window_size: 1048576 # 1 MiB