Plain Envoy as the Central Front Door

Why Start Without Auth?

Before adding security filters, you need to know where traffic enters, which route matches, and which upstream service receives the request. If routing is confusing, auth debugging becomes painful.

Plain Envoy Pieces

• Listener: where Envoy accepts traffic.
• HTTP connection manager: the HTTP processing pipeline.
• Route: how a path such as /dashboard maps to a product service.
• Cluster: the upstream service Envoy forwards to.
• HTTP filters: the ordered checks that run before routing, such as JWT authn, ext_authz, and router.

Starter Envoy YAML

This is a small teaching config. It shows where product routes and filters live; a production config should be generated, reviewed, and deployed through your platform pipeline.

static_resources:
  listeners:
  - name: product_edge
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 8080
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: product_edge
          route_config:
            name: product_routes
            virtual_hosts:
            - name: products
              domains: ["*"]
              routes:
              - match: { prefix: "/dashboard" }
                route: { cluster: dashboard_service }
              - match: { prefix: "/data" }
                route: { cluster: data_explorer_service }
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: dashboard_service
    connect_timeout: 1s
    type: STRICT_DNS
    load_assignment:
      cluster_name: dashboard_service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: dashboard.default.svc.cluster.local, port_value: 8080 }

Where Auth Filters Go

Auth filters must run before the router filter. If the router runs first, the request reaches the product before identity and policy checks happen. The normal order is JWT validation, external authorization if needed, then router.

Kubernetes Deployment Shape

In Kubernetes, Envoy can run as an ingress-like edge deployment, a dedicated gateway, or part of a larger platform entry layer. This course uses a plain Envoy gateway mental model so you can understand the filters before adding a service mesh or managed gateway.