NGINX, Envoy and Service Mesh
Reverse proxies and service proxies route traffic, manage connections and enforce cross-cutting network policy.
NGINX, Envoy and Service Mesh
Reverse proxies and service proxies route traffic, manage connections and enforce cross-cutting network policy. NGINX commonly serves as a high-performance web server and reverse proxy. Envoy provides programmable L4/L7 proxying, filters, telemetry and dynamic configuration. A service mesh places proxies alongside workloads or at gateways to standardize mTLS, retries, timeouts, routing and observability. These controls still need application-aware idempotency and deadline rules.
Mechanism and worked example
A request passes through an edge proxy, then an Envoy sidecar, then a service. Each hop has connection pools, retry policy, timeout and telemetry. Propagate one deadline; avoid configuring three retries at every layer, which can multiply attempts.
| Capability | Proxy responsibility | Application still owns |
|---|---|---|
| L4/L7 routing | Select destination and route | Business correctness |
| mTLS | Authenticate workload channel | User authorization |
| Retries/timeouts | Bound transport attempts | Idempotency and end-to-end deadline |
| Telemetry | Record spans and connection metrics | Meaningful business outcomes |
Failure modes and operations
Proxy retries can duplicate mutations. Idle timeouts can break long-lived streams. Connection pools can become the hidden queue. Misconfigured health checks can eject all endpoints. Mesh control-plane outages may leave data-plane behavior dependent on last known configuration.
Trade-offs and design boundary
Centralized proxy policy improves consistency and visibility but adds hops, configuration complexity and resource overhead. A mesh is not necessary for a small service set. Application code still owns business authorization, idempotency and transaction semantics.
Interview transfer exercise
Compare client-side load balancing with an Envoy-based mesh. Include mTLS, retries, telemetry, failure behavior and the operational cost of sidecars.
Read the diagram
Client connects to edge proxy → Edge routes through service proxy → Proxy enforces transport policy and telemetry → Service validates identity and business contract