Rethinking the Proxy Model: Implementing Envoy as a Node-Scoped Agent
Talkat EnvoyCon North America 2025 · on Monday, 2025-11-10· at 11:15· Building B | Level 4 | B406b-407·
summary
Envoy is reimplemented as a node-scoped daemonset proxy that listens into pod network namespaces using network namespace-aware sockets and setns to create sockets in other namespaces, with per-pod listeners, CNI-driven nftables rules, and bind-by-namespace for upstream connects. Key tunings: reduce default 1MB per-connection buffers to 32KB buffers, tweak kernel socket buffers, and use SO_REUSEPORT for rolling upgrades. Tests: ~150 listeners/4,000 clusters, 25,000 connections, 12–32 Gbit/s, ~4.75 GB total for four Envoys (~1+ GB each), beating ZTunnel memory usage and functioning in practice.
AI-written summary · about
chapters (9)
- 0:00The sidecar model
- 2:09Moving to node-scoped proxies
- 4:52Technical design challenges
- 7:03Traffic redirection mechanics
- 10:23Implementing namespace awareness
- 13:38Upstream binding implementation
- 16:51Performance testing and optimization
- 20:17Comparative analysis
- 24:37Q&A and future plans
