● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
E

Envoy

GraduatedOrchestration
Open source · CNCF · CNCF Graduated · Apache-2.0

Envoy is a high-performance, L3/L4/L7 proxy built for cloud-native applications. It handles service-to-service communication, load balancing, TLS termination, observability (metrics, tracing, logging), rate limiting, and traffic shaping.

updated 2026-07-01

What it is

Envoy is a high-performance, L3/L4/L7 proxy built for cloud-native applications. It handles service-to-service communication, load balancing, TLS termination, observability (metrics, tracing, logging), rate limiting, and traffic shaping. It's not an orchestrator in the Kubernetes-controller sense — it's the data plane that sits in front of or beside your services, and it's the underlying proxy that powers most modern service mesh implementations (Istio, Consul Connect) and API gateways (Contour, Gloo, Ambassador). If you've used a service mesh, you've used Envoy whether you knew it or not.

Who builds it and why

Originally built at Lyft to solve internal microservices networking problems (retries, circuit breaking, observability across a polyglot service fleet), Envoy was open-sourced in 2016 and became a CNCF graduated project. Today it's maintained by a broad contributor base — 1,652 contributors is a serious number, reflecting the fact that Envoy isn't a side project for anyone using it; it's core infrastructure. Google, Salesforce, Lyft, and dozens of other companies with production traffic riding on Envoy fund and staff its development because they can't afford it to stagnate.

Production readiness signal

This is about as production-hardened as infrastructure software gets. CNCF graduated status, 28,505 GitHub stars, active commits through 2026, and a release cadence (currently v1.38.x) that's disciplined about backward compatibility and security patching. Envoy powers ingress and service mesh for some of the largest production traffic volumes on the internet — Lyft, Google Cloud's mesh offerings, and countless enterprise platform teams. The C++ codebase means performance is excellent, but it also means the contribution bar is higher and debugging requires real systems knowledge — this isn't a weekend Go project you can casually patch.

Who should use this

  • Platform teams building or operating a service mesh who need a proven data plane, not something to build from scratch.
  • Teams running API gateways or ingress controllers at scale where L7 features (retries, circuit breaking, rate limiting, detailed telemetry) matter more than simplicity.
  • Organizations with polyglot service fleets who need consistent network behavior (timeouts, retries, observability) enforced outside application code.
  • Anyone already committed to Istio, Consul Connect, Contour, or similar — you're using Envoy whether you name it explicitly or not.

Who should NOT use this

  • Small teams running a handful of services behind a simple load balancer — Envoy's configuration surface (xDS APIs, listener/cluster/route config) is overkill and will cost you more in operational overhead than it saves.
  • Anyone expecting to hand-write Envoy config directly in production without tooling — raw Envoy config is verbose and unforgiving; most teams need Istio, Contour, or a control plane on top of it.
  • Teams without dedicated platform/SRE capacity — Envoy failures manifest as network failures across your entire fleet, and debugging them requires real proxy and networking expertise.
  • Shops that just need basic reverse-proxy or simple ingress — Nginx or Traefik will get you there with far less operational complexity.
  • If you need a managed, hands-off solution with vendor support baked in and no interest in owning proxy internals, look at cloud-native managed load balancers/API gateways instead.

Alternatives

  • HAProxy — simpler, extremely mature L4/L7 proxy with less built-in observability and dynamic config but far lower operational complexity.
  • Nginx — the default choice for simpler reverse-proxy/ingress needs; less suited to dynamic service mesh use cases.
  • Linkerd (with its own lightweight proxy) — if you want service mesh benefits without adopting Envoy's complexity, Linkerd's Rust-based micro-proxy is a deliberate simpler alternative.

Pricing

Fully open source under Apache-2.0. No license fees, no paid tier from the Envoy project itself. Cost is entirely operational — the engineering time to configure, run, and debug it, or the cost of a commercial platform (e.g., Istio-based managed mesh offerings from cloud providers) built on top of it.

Frequently asked

What is Envoy?+
Envoy is a high-performance, L3/L4/L7 proxy built for cloud-native applications. It handles service-to-service communication, load balancing, TLS termination, observability (metrics, tracing, logging), rate limiting, and traffic shaping.
Who builds Envoy?+
Originally built at Lyft to solve internal microservices networking problems (retries, circuit breaking, observability across a polyglot service fleet), Envoy was open-sourced in 2016 and became a CNCF graduated project.
Is Envoy production ready?+
This is about as production-hardened as infrastructure software gets. CNCF graduated status, 28,505 GitHub stars, active commits through 2026, and a release cadence (currently v1.38.x) that's disciplined about backward compatibility and security patching.
Who should use Envoy?+
Platform teams building or operating a service mesh who need a proven data plane, not something to build from scratch. Teams running API gateways or ingress controllers at scale where L7 features (retries, circuit breaking, rate limiting, detailed telemetry) matter more than simplicity.
Who should not use Envoy?+
Small teams running a handful of services behind a simple load balancer — Envoy's configuration surface (xDS APIs, listener/cluster/route config) is overkill and will cost you more in operational overhead than it saves.
What are the alternatives to Envoy?+
HAProxy — simpler, extremely mature L4/L7 proxy with less built-in observability and dynamic config but far lower operational complexity. Nginx — the default choice for simpler reverse-proxy/ingress needs; less suited to dynamic service mesh use cases.
How much does Envoy cost?+
Fully open source under Apache-2.0. No license fees, no paid tier from the Envoy project itself. Cost is entirely operational — the engineering time to configure, run, and debug it, or the cost of a commercial platform (e.g., Istio-based managed mesh offerings from cloud providers) built on top of it.