Envoy at Square
summary
Square moves its service mesh to Envoy with a custom centralized control plane built on the Java XDS library, using lazy snapshot generation and a snapshot cache to avoid precomputing configs. Sidecars use UNIX sockets/no TLS in apps while mTLS is enforced at the proxy. Migration preserves legacy behavior with a VIP-to-mesh feature flag, locality/priority routing, metadata labels and cross-datacenter retries. Rollout is partial: ~120–140 services, ~2,000 sidecars now, aiming for ~10,000; the setup is live and working.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:02Motivation
- 1:22Infrastructure Overview
- 13:18Control Plane Design
- 14:16Facilitating Migration
- 15:58Vip-to-Mesh Feature Flag
- 17:35Client/Sidecar Contract
- 17:56Offloading TLS to Proxy
- 18:58Service Discovery Model
- 19:57Datacenter Priority Routing
- 20:13Virtual Datacenters
- 20:58Locality Weighting
- 21:35Cluster Targeting
- 22:13Cross-Datacenter Retries
- 23:00What's next?
related talks
34mIntro: Envoy
31mEnvoy Project Intro – Matt Klein & Jose Nino, Lyft
28mEnvoy Project Intro
38mPanel Discussion: Ask Us Anything: Microservices and Service Mesh
47mService Mesh and Sidecars with Istio and Envoy
28mService Mesh and Sidecars with Istio and Envoy
38mAsk Me Anything About Service Mesh
43mService Mesh and the future of networking