NGINX, Envoy and Service Mesh
Reverse proxies and service proxies route traffic, manage connections and enforce cross-cutting network policy.
NGINX, Envoy and Service Mesh
Reverse proxies and service proxies route traffic, manage connections and enforce cross-cutting network policy. NGINX commonly serves as a high-performance web server and reverse proxy. Envoy provides programmable L4/L7 proxying, filters, telemetry and dynamic configuration. A service mesh places proxies alongside workloads or at gateways to standardize mTLS, retries, timeouts, routing and observability. These controls still need application-aware idempotency and deadline rules.
Mechanism and worked example
A request passes through an edge proxy, then an Envoy sidecar, then a service. Each hop has connection pools, retry policy, timeout and telemetry. Propagate one deadline; avoid configuring three retries at every layer, which can multiply attempts.
| Capability | Proxy responsibility | Application still owns |
|---|---|---|
| L4/L7 routing | Select destination and route | Business correctness |
| mTLS | Authenticate workload channel | User authorization |
| Retries/timeouts | Bound transport attempts | Idempotency and end-to-end deadline |
| Telemetry | Record spans and connection metrics | Meaningful business outcomes |
Failure modes and operations
Proxy retries can duplicate mutations. Idle timeouts can break long-lived streams. Connection pools can become the hidden queue. Misconfigured health checks can eject all endpoints. Mesh control-plane outages may leave data-plane behavior dependent on last known configuration.
Trade-offs and design boundary
Centralized proxy policy improves consistency and visibility but adds hops, configuration complexity and resource overhead. A mesh is not necessary for a small service set. Application code still owns business authorization, idempotency and transaction semantics.
Interview transfer exercise
Compare client-side load balancing with an Envoy-based mesh. Include mTLS, retries, telemetry, failure behavior and the operational cost of sidecars.
Read the diagram
Client connects to edge proxy → Edge routes through service proxy → Proxy enforces transport policy and telemetry → Service validates identity and business contract
Compare client-side load balancing with an Envoy-based mesh. Include mTLS, retries, telemetry, failure behavior and the operational cost of sidecars.
Your design draft
Clarify assumptions, explain your approach, and test the difficult cases. Save your draft, then compare it with the study notes.
Self-review checklist
Self-guided practice. Automated AI feedback and code execution are not connected.