Envoy 1.7: xDS Consistency and HTTP/2 Resilience Upgrades

Introduction

Envoy 1.7.0 landed on June 21, 2018 with changes aimed squarely at production service meshes. From safer xDS updates to better gRPC/HTTP behavior and more operational visibility, Envoy 1.7 tightens reliability for Istio, Linkerd, and custom control planes alike.

Release Highlights

Smarter xDS Control Plane Interactions

• CDS/EDS updates now perform warm clusters before full promotion, preventing connection resets.
• Delta-based xDS pushes reduce configuration fan-out and speed incremental rollouts.
• Unified rate limiting service API supports multi-tenant quotas.

HTTP/2 & gRPC Hardening

• Adaptive concurrency protects upstreams under load by tuning connection pool sizes dynamically.
• Enhanced gRPC-Web support simplifies browser-to-mesh integrations.
• New retry policies for per-try timeouts prevent runaway gRPC streams.

Observability Boosts

• Tracing and stats plumbing continues to mature, making it easier to standardize dashboards across many sidecars.
• Extended envoy.cluster.upstream_rq_retry metrics offer per-route visibility.
• /stats admin endpoint now supports regex filtering for large clusters.

Implementation Tips

• Warm New Clusters: ensure your control plane sets initial_fetch_timeout and drain_type=MODIFY_ONLY to exploit warm CDS.
• gRPC Health Checks: enable the built-in gRPC health checker (grpc_health_check { service_name: "..." }) for L7-aware readiness.
• Tracing: enable an Envoy tracer and validate sampling early; in a mesh, tracing misconfigurations often look like “random latency” until you can correlate retries and upstream timeouts.
• Retry Budgets: pair the new retry_priority filters with circuit breakers to avoid thundering herds.

Sample Envoy Config Snippet

clusters:
- name: payments
  connect_timeout: 0.25s
  type: EDS
  eds_cluster_config:
    eds_config:
      api_config_source:
        api_type: GRPC
        grpc_services:
        - envoy_grpc:
            cluster_name: xds-cluster
  circuit_breakers:
    thresholds:
    - max_connections: 1024
      retry_budget:
        budget_percent:
          value: 20

Ecosystem Impact

• Istio 1.0 and Consul Connect adopt the warm cluster workflow to eliminate intermittent 503s during config pushes.
• Works seamlessly with Prometheus 2.3 for metric scraping and Knative 0.1 for ingress routing.
• Pairs with Cilium 1.0 to deliver L3-L7 policy enforcement.

Summary

Envoy 1.7 is all about operational serenity—keeping traffic flowing smoothly as control planes update routes, policies, and downstream clusters. The release earns its spot as the steady proxy underpinning 2018’s mesh explosion.