{"id":23719604,"url":"https://github.com/maksim-paskal/envoy-control-plane","last_synced_at":"2026-03-11T00:33:09.002Z","repository":{"id":39756100,"uuid":"285810766","full_name":"maksim-paskal/envoy-control-plane","owner":"maksim-paskal","description":"Lightweight Envoy control plane","archived":false,"fork":false,"pushed_at":"2024-11-04T08:38:27.000Z","size":608,"stargazers_count":3,"open_issues_count":1,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-11-04T09:27:14.816Z","etag":null,"topics":["control-plane","envoy","service-mesh"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/maksim-paskal.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-07T11:16:26.000Z","updated_at":"2024-11-04T08:38:05.000Z","dependencies_parsed_at":"2024-06-19T19:13:40.146Z","dependency_job_id":null,"html_url":"https://github.com/maksim-paskal/envoy-control-plane","commit_stats":null,"previous_names":[],"tags_count":74,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maksim-paskal%2Fenvoy-control-plane","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maksim-paskal%2Fenvoy-control-plane/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maksim-paskal%2Fenvoy-control-plane/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maksim-paskal%2Fenvoy-control-plane/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/maksim-paskal","download_url":"https://codeload.github.com/maksim-paskal/envoy-control-plane/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":231918548,"owners_count":18445746,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["control-plane","envoy","service-mesh"],"created_at":"2024-12-30T21:52:55.243Z","updated_at":"2026-03-11T00:33:08.938Z","avatar_url":"https://github.com/maksim-paskal.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Lightweight Envoy control plane\n\n## Motivation\n\nPopular Istio or Linkerd is very complex to do something simple with kubernetes service discovery and use all Envoy benefits (circuit_breakers, retry_policy, health_checks or zone aware routing)\n\n### Generate TLS certificates for secure envoy to envoy-control-plane connection\n\nenvoy-control-plane always start in secured mode, it use mTLS for securing traffic between envoy-control-plane and envoy. To start envoy-control-plane you need to create CA certificates that will be used in mTLS communication, also envoy need client certificate to connect envoy-control-plane\n\nsimple way to create CA certificate and envoy certificate\n\n```bash\nmake sslInit\n```\n\nfiles `./certs/envoy.key`, `./certs/envoy.crt` and `./certs/CA.crt` must be used in envoy to establish secure connection to envoy-control-plane, files `./certs/CA.key` and `./certs/CA.crt` must be used in envoy-control-plane\n\n### Run control plane in your application namespace\n\n```bash\nhelm repo add maksim-paskal-envoy-control-plane https://maksim-paskal.github.io/envoy-control-plane/\nhelm repo update\n\nhelm upgrade envoy-control-plane \\\n  --install \\\n  --create-namespace \\\n  --namespace envoy-control-plane \\\n  maksim-paskal-envoy-control-plane/envoy-control-plane \\\n  --set withExamples=true \\\n  --set ingress.enabled=true \\\n  --set-file certificates.caKey=./certs/CA.key \\\n  --set-file certificates.caCrt=./certs/CA.crt \\\n  --set-file certificates.envoyKey=./certs/envoy.key \\\n  --set-file certificates.envoyCrt=./certs/envoy.crt\n\n# get NAME of envoy POD, must be in Ready state\nkubectl -n envoy-control-plane get pods -lapp=envoy -o wide\n\n# port forward to envoy pod, open browser http://127.0.0.1:8000, success result `Hello World`\nkubectl -n envoy-control-plane port-forward \u003cenvoy-pod-name\u003e 8000\n\n# port forward to envoy pod, open browser https://127.0.0.1:18000, envoy administration interface\n# https://www.envoyproxy.io/docs/envoy/latest/operations/admin\nkubectl -n envoy-control-plane port-forward \u003cenvoy-pod-name\u003e 18000\n\n# to uninstall\nhelm uninstall envoy-control-plane -n envoy-control-plane\nkubectl delete ns envoy-control-plane\n```\n\n### To integrate your POD to envoy-control-plane\n\nTo integrate your application to envoy-control-plane - you need to add sidecar container, and certificates that will be used to secure connection between envoy and envoy-control-plane\n\n```yaml\nvolumes:\n- name: certs\n  configMap:\n    name: envoy-certs # ConfigMap that store CA.crt, envoy.crt, envoy.key\ncontainers:\n- name: envoy\n  lifecycle:\n    preStop:\n      exec:\n        # gracefully drain all connection and shutdown\n        command:\n        - cli\n        - -drainEnvoy\n        - -timeout=10s\n  image: paskalmaksim/envoy-docker-image:latest\n  imagePullPolicy: Always\n  args:\n  - /bin/sh\n  - -c\n  - |\n    /usr/local/bin/envoy \\\n    --config-path /etc/envoy/envoy.yaml \\\n    --log-level warn \\\n    --service-cluster test \\\n    --service-node test1-id\n  resources:\n    requests:\n      cpu: 10m\n      memory: 100Mi\n  env:\n  - name: MY_POD_NAMESPACE\n    valueFrom:\n      fieldRef:\n        apiVersion: v1\n        fieldPath: metadata.namespace\n  # this will be send all traces to jaeger agent (daemonset)\n  - name: OTLP_COLLECTOR_HOST\n    valueFrom:\n      fieldRef:\n        apiVersion: v1\n        fieldPath: status.hostIP\n  # jaeger traces service name\n  - name: ENVOY_SERVICE_NAME\n    value: \"test-envoy-service\"\n  readinessProbe:\n    httpGet:\n      path: /ready\n      port: 18001\n    initialDelaySeconds: 3\n    periodSeconds: 5\n  livenessProbe:\n    httpGet:\n      path: /server_info\n      port: 18001\n    initialDelaySeconds: 60\n    periodSeconds: 10\n\n  ports:\n  - containerPort: 8000   # application proxy\n  - containerPort: 18000  # envoy admin\n```\n\n### Configurate your envoy sidecars with simple ConfigMap\n\nSample configuration [here](chart/envoy-control-plane/templates/envoy-test1-id.yaml)\n\n### Prometheus metrics\n\nenvoy-control-plane expose metrics on `/api/metrics` endpoint in web interface - for static configuration use this scrape config:\n\n```yaml\nscrape_configs:\n- job_name: envoy-control-plane\n  scrape_interval: 1s\n  metrics_path: /api/metrics\n  static_configs:\n  - targets:\n    - \u003cenvoy-control-plane-ip\u003e:18081\n```\n\nor just add pod annotation\n\n```yaml\nannotations:\n  prometheus.io/path: '/api/metrics'\n  prometheus.io/scrape: 'true'\n  prometheus.io/port: '18081'\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaksim-paskal%2Fenvoy-control-plane","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmaksim-paskal%2Fenvoy-control-plane","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaksim-paskal%2Fenvoy-control-plane/lists"}