Envoy Gateway: Operating a Modern L7 Gateway on Kubernetes

"Envoy Gateway: Operating a Modern L7 Gateway on Kubernetes"

Envoy Gateway is rapidly becoming the pragmatic choice for teams that want a Kubernetes-native, Gateway API–driven path to a high-performance L7 edge. This book is written for experienced platform engineers, SREs, and senior application operators who already run Kubernetes in production and need a gateway they can reason about under pressure—during outages, upgrades, and multi-team change. The focus is operational clarity: what Envoy Gateway owns, how it behaves, and how to build confidence in day-2 workflows.

You’ll build a precise mental model of the Kubernetes Gateway API (GatewayClass, Gateway, Routes), attachment semantics, and “status-first” operations. From there, the book dives into Envoy Gateway’s control plane/data plane architecture and reconciliation pipeline, then establishes a repeatable bootstrap baseline: CRDs, RBAC, first-route validation, and version/compatibility expectations. You’ll master HTTP routing semantics, progressive delivery with weighted backends, traffic shaping and reliability controls, plus the decision framework for L4 and TLS passthrough. Security chapters cover TLS termination and upstream mTLS, authentication and authorization blast-radius choices, and rate limiting that works in real networks.

Differentiators include disciplined governance for policies and escape hatches, production-grade telemetry and SLO design, scaling/HA and upgrade playbooks, and a unified incident response workflow that moves from symptoms to root cause using the fastest discriminators. Prerequisites: