Kubernetesdevops~5 mins

Sidecar proxy concept (Envoy) in Kubernetes - Commands & Configuration

Choose your learning style10 modes available

Learn Why Deep Visual Try Challenge Project Recall Time

Start learning this pattern below

Jump into concepts and practice - no test required

Recommended

Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong

Introduction

Sometimes applications need help managing network traffic and security. A sidecar proxy like Envoy runs alongside your app to handle these tasks without changing your app code.

When you want to add secure communication between microservices without changing their code

When you need to monitor and control traffic going in and out of your application

When you want to add retries or timeouts to your app's network calls easily

When you want to collect detailed logs and metrics about your app's network traffic

When you want to isolate network features from your app for easier updates and maintenance

Config File - pod.yaml

pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod
spec:
  containers:
  - name: my-app
    image: nginx:1.23
    ports:
    - containerPort: 80
  - name: envoy-proxy
    image: envoyproxy/envoy:v1.23.0
    ports:
    - containerPort: 9901 # Envoy admin port
    - containerPort: 10000 # Envoy listener port
    command:
    - /usr/local/bin/envoy
    - -c
    - /etc/envoy/envoy.yaml
    - --service-node
    - sidecar-proxy
    - --service-cluster
    - my-app-cluster
    volumeMounts:
    - name: envoy-config
      mountPath: /etc/envoy
  volumes:
  - name: envoy-config
    configMap:
      name: envoy-config

This YAML defines a Kubernetes Pod with two containers: your app container running nginx and a sidecar container running Envoy proxy.

The Envoy container uses a ConfigMap for its configuration, listens on ports 9901 (admin) and 10000 (proxy traffic), and runs with command-line arguments to identify itself.

This setup allows Envoy to intercept and manage network traffic for your app without changing the app itself.

Commands

This command creates the Pod with both your app and the Envoy sidecar proxy running together.

Terminal

kubectl apply -f pod.yaml

Expected OutputExpected

pod/my-app-pod created

Check that the Pod is running and both containers are ready.

Terminal

kubectl get pods

Expected OutputExpected

NAME READY STATUS RESTARTS AGE my-app-pod 2/2 Running 0 10s

View logs from the Envoy sidecar to see how it is managing traffic and if it started correctly.

Terminal

kubectl logs my-app-pod -c envoy-proxy

Expected OutputExpected

[2024-06-01T12:00:00.000Z] [info] Envoy proxy starting up [2024-06-01T12:00:01.000Z] [info] Listener started on 0.0.0.0:10000

→

-c - Specify the container name inside the Pod

Test that Envoy is listening on the proxy port inside the Pod by curling it from the app container.

Terminal

kubectl exec my-app-pod -c my-app -- curl -s http://localhost:10000

Expected OutputExpected

<!DOCTYPE html> <html> <head><title>Envoy Proxy</title></head> <body> <h1>Envoy Proxy is running</h1> </body> </html>

→

-c - Run command inside the app container

Key Concept

If you remember nothing else from this pattern, remember: a sidecar proxy runs alongside your app to handle network tasks without changing your app code.

Common Mistakes

Not defining both the app and Envoy containers in the same Pod spec

The sidecar proxy must run in the same Pod to intercept traffic properly; separate Pods won't work as a sidecar.

Always include the Envoy container alongside your app container in the same Pod YAML.

Forgetting to expose or map the ports Envoy listens on

Without exposing Envoy's ports, traffic cannot be routed through the proxy.

Define the necessary container ports for Envoy in the Pod spec.

Not mounting the Envoy configuration file correctly

Envoy needs its config file to know how to route and manage traffic; missing config causes startup failure.

Use a ConfigMap and mount it properly into the Envoy container.

Summary

Create a Pod with both your app and Envoy sidecar proxy containers defined together.

Use kubectl commands to deploy the Pod, check its status, and view Envoy logs.

Test Envoy's proxy port from inside the Pod to confirm it is running and managing traffic.

Practice

(1/5)

1. What is the main purpose of a sidecar proxy like Envoy in a Kubernetes pod?

easy

A. To manage network traffic for the application without changing its code

B. To replace the main application container

C. To store application data persistently

D. To run database services inside the pod

Sidecar proxy concept (Envoy) in Kubernetes - Commands & Configuration

Start learning this pattern below

Practice

Solution

Step 1: Understand the role of sidecar proxies

Step 2: Identify what sidecars do not do

Final Answer:

Quick Check:

Solution

Step 1: Identify the correct container name and image

Step 2: Check the options for correctness

Final Answer:

Quick Check:

Solution

Step 1: Understand Envoy's role as a sidecar proxy

Step 2: Trace the request flow

Final Answer:

Quick Check:

Solution

Step 1: Analyze Envoy sidecar traffic issues

Step 2: Evaluate other options

Final Answer:

Quick Check:

Solution

Step 1: Understand sidecar pattern in Kubernetes

Step 2: Evaluate alternatives

Final Answer:

Quick Check: