# Envoy数据平面架构实践：xDS与WASM在微服务治理中的应用

在云原生微服务架构中，数据平面作为服务通信的核心组件，承担着流量转发、策略实施和可观测性数据收集等关键功能。Envoy作为服务网格领域广泛采用的数据平面代理，通过xDS动态配置协议和WebAssembly扩展机制，为微服务治理提供了强大而灵活的基础设施。

## Envoy核心架构与线程模型

Envoy采用多线程架构设计，每个工作线程独立运行事件循环，实现高性能的并发处理能力。这种设计确保了在流量高峰期间的稳定性。

```yaml

# envoy-bootstrap-thread.yaml - 线程配置示例

node:

id: envoy-proxy-1

cluster: service-cluster

locality:

region: us-west-2

zone: us-west-2a

admin:

address:

socket_address: { address: 0.0.0.0, port_value: 9901 }

static_resources:

listeners: []

clusters:

- name: xds_cluster

type: STATIC

typed_extension_protocol_options:

envoy.extensions.upstreams.http.v3.HttpProtocolOptions:

"@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions

explicit_http_config:

http2_protocol_options: {}

load_assignment:

cluster_name: xds_cluster

endpoints:

- lb_endpoints:

- endpoint:

address:

socket_address:

address: istiod.istio-system.svc.cluster.local

port_value: 15012

layered_runtime:

layers:

- name: static_layer

static_layer:

overload:

global_downstream_max_connections: 100000

concurrency: 4 # 工作线程数

reloadable_features:

enable_mutex_tracing: false

```

## xDS协议动态配置详解

xDS协议族是Envoy动态配置的核心，支持配置的热更新，无需重启即可应用新的路由策略、集群定义和服务发现信息。

```cpp

// xds-client-implementation.cpp - xDS客户端实现

#include <memory>

#include <string>

#include <vector>

#include "envoy/config/core/v3/config_source.pb.h"

#include "envoy/service/discovery/v3/discovery.pb.h"

#include "grpcpp/grpcpp.h"

class XdsClientImpl : public XdsClient {

public:

XdsClientImpl(const std::string& control_plane_endpoint)

: stub_(envoy::service::discovery::v3::AggregatedDiscoveryService::NewStub(

grpc::CreateChannel(control_plane_endpoint,

grpc::InsecureChannelCredentials()))) {}

void subscribeToClusters() {

envoy::service::discovery::v3::DiscoveryRequest request;

request.set_type_url("type.googleapis.com/envoy.config.cluster.v3.Cluster");

request.mutable_node()->set_id(node_id_);

// 设置资源名称（为空表示订阅所有）

request.add_resource_names("*");

// 启动gRPC流

auto stream = stub_->StreamAggregatedResources(&context_);

stream->Write(request);

// 处理响应流

envoy::service::discovery::v3::DiscoveryResponse response;

while (stream->Read(&response)) {

handleDiscoveryResponse(response);

// 发送ACK

envoy::service::discovery::v3::DiscoveryRequest ack;

ack.set_type_url(response.type_url());

ack.set_version_info(response.version_info());

ack.set_response_nonce(response.nonce());

stream->Write(ack);

}

private:

void handleDiscoveryResponse(const envoy::service::discovery::v3::DiscoveryResponse& response) {

if (response.type_url() == "type.googleapis.com/envoy.config.cluster.v3.Cluster") {

for (const auto& resource : response.resources()) {

envoy::config::cluster::v3::Cluster cluster;

if (cluster.ParseFromString(resource.value())) {

updateClusterConfig(cluster);

}

} else if (response.type_url() == "type.googleapis.com/envoy.config.route.v3.RouteConfiguration") {

// 处理路由配置更新

handleRouteConfigurationUpdate(response);

}

void updateClusterConfig(const envoy::config::cluster::v3::Cluster& cluster) {

std::cout << "更新集群配置: " << cluster.name() << std::endl;

// 应用新的集群配置

applyClusterChanges(cluster);

// 触发相关监听器更新

notifyListenersOfClusterChange(cluster.name());

}

std::unique_ptr<envoy::service::discovery::v3::AggregatedDiscoveryService::Stub> stub_;

grpc::ClientContext context_;

std::string node_id_ = "envoy-proxy-default";

};

```

## WebAssembly过滤器开发实践

WebAssembly为Envoy提供了安全的扩展机制，允许在运行时加载和执行自定义的流量处理逻辑。

```rust

// wasm-auth-filter.rs - 认证过滤器示例

use proxy_wasm::traits::*;

use proxy_wasm::types::*;

use serde::{Deserialize, Serialize};

use std::collections::HashMap;

#[derive(Serialize, Deserialize)]

struct FilterConfig {

allowed_tokens: Vec<String>,

require_auth_header: bool,

}

#[derive(Default)]

struct AuthContext {

config: Option<FilterConfig>,

request_headers: HashMap<String, String>,

}

impl Context for AuthContext {}

impl RootContext for AuthContext {

fn on_vm_start(&mut self, _vm_configuration_size: usize) -> bool {

true

}

fn on_configure(&mut self, config_size: usize) -> bool {

if let Some(config_bytes) = self.get_configuration() {

match serde_json::from_slice::<FilterConfig>(&config_bytes) {

Ok(config) => {

self.config = Some(config);

true

}

Err(e) => {

self.log(LogLevel::Error, &format!("配置解析失败: {}", e));

false

}

} else {

false

}

fn create_http_context(&self, context_id: u32) -> Option<Box<dyn HttpContext>> {

Some(Box::new(HttpAuthFilter {

context_id,

config: self.config.clone(),

}))

}

struct HttpAuthFilter {

context_id: u32,

config: Option<FilterConfig>,

}

impl Context for HttpAuthFilter {}

impl HttpContext for HttpAuthFilter {

fn on_http_request_headers(&mut self, _num_headers: usize, _end_of_stream: bool) -> Action {

if let Some(config) = &self.config {

// 检查认证头

if config.require_auth_header {

if let Some(auth_header) = self.get_http_request_header("Authorization") {

if !self.validate_token(&auth_header, config) {

self.send_http_response(

401,

vec![("Content-Type", "text/plain")],

Some(b"未授权的访问")

);

return Action::Pause;

}

} else {

self.send_http_response(

401,

vec![("WWW-Authenticate", "Bearer realm=\"api\"")],

Some(b"需要认证")

);

return Action::Pause;

}

// 添加请求追踪信息

self.add_http_request_header("X-Request-Id", &format!("req-{}", self.context_id));

self.add_http_request_header("X-Wasm-Processed", "true");

Action::Continue

}

fn on_http_response_headers(&mut self, _num_headers: usize, _end_of_stream: bool) -> Action {

// 添加响应头

self.add_http_response_header("X-Wasm-Version", "1.0");

self.add_http_response_header("X-Processing-Time",

&format!("{}ms", self.get_current_time_nanos() / 1_000_000));

<"gre.j9k5.org.cn"><"otr.j9k5.org.cn"><"rth.j9k5.org.cn">

Action::Continue

}

impl HttpAuthFilter {

fn validate_token(&self, token: &str, config: &FilterConfig) -> bool {

// 验证Bearer Token

if token.starts_with("Bearer ") {

let token_value = &token[7..];

config.allowed_tokens.iter().any(|t| t == token_value)

} else {

false

}

proxy_wasm::main! {{

proxy_wasm::set_log_level(LogLevel::Info);

proxy_wasm::set_root_context(|_| -> Box<dyn RootContext> {

Box::new(AuthContext::default())

});

}}

```

## 动态路由与流量管理

```yaml

# envoy-dynamic-routing.yaml - 动态路由配置

static_resources:

listeners:

- name: http_listener

address:

socket_address: { address: 0.0.0.0, port_value: 8080 }

filter_chains:

- filters:

- name: envoy.filters.network.http_connection_manager

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

stat_prefix: ingress_http

http_filters:

- name: envoy.filters.http.router

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

route_config:

virtual_hosts:

- name: api_service

domains: ["api.example.com"]

routes:

- match:

prefix: "/v1/users"

route:

cluster: user_service

prefix_rewrite: "/api/users"

timeout: 5s

retry_policy:

retry_on: "5xx,gateway-error"

num_retries: 3

per_try_timeout: 2s

weighted_clusters:

clusters:

- name: user_service_v1

weight: 70

- name: user_service_v2

weight: 30

dynamic_resources:

cds_config:

resource_api_version: V3

api_config_source:

api_type: GRPC

transport_api_version: V3

grpc_services:

- envoy_grpc:

cluster_name: xds_cluster

lds_config:

resource_api_version: V3

api_config_source:

api_type: GRPC

transport_api_version: V3

grpc_services:

- envoy_grpc:

cluster_name: xds_cluster

```

## 安全策略实施

Envoy提供了多层次的安全机制，包括TLS终止、认证授权和速率限制等。

```yaml

# envoy-security-policy.yaml - 安全策略配置

static_resources:

listeners:

- name: https_termination

address:

socket_address:

address: 0.0.0.0

port_value: 8443

filter_chains:

- filter_chain_match:

server_names: ["secure-api.example.com"]

transport_socket:

typed_config:

"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext

common_tls_context:

tls_certificates:

- certificate_chain: { filename: "/etc/ssl/certs/server.crt" }

private_key: { filename: "/etc/ssl/private/server.key" }

validation_context:

trusted_ca: { filename: "/etc/ssl/certs/ca-bundle.crt" }

require_client_certificate: true

filters:

- name: envoy.filters.network.http_connection_manager

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

stat_prefix: https_ingress

http_filters:

- name: envoy.filters.http.rbac

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC

rules:

action: ALLOW

policies:

"api-access":

permissions:

- any: true

principals:

- authenticated:

principal_name:

exact: "spiffe://cluster.local/ns/default/sa/api-client"

- name: envoy.filters.http.jwt_authn

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication

providers:

auth0_provider:

issuer: "https://auth.example.com/"

audiences:

- "api.example.com"

remote_jwks:

http_uri:

uri: "https://auth.example.com/.well-known/jwks.json"

cluster: auth_service

timeout: 5s

cache_duration: { seconds: 300 }

forward: true

- name: envoy.filters.http.rate_limit

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit

domain: api_gateway

stage: 0

request_type: external

rate_limit_service:

grpc_service:

envoy_grpc:

cluster_name: rate_limit_service

timeout: 0.25s

- name: envoy.filters.http.router

clusters:

- name: rate_limit_service

type: STRICT_DNS

lb_policy: ROUND_ROBIN

load_assignment:

cluster_name: rate_limit_service

endpoints:

- lb_endpoints:

- endpoint:

address:

socket_address:

address: ratelimit.rate-limit.svc.cluster.local

port_value: 8081

```

## 可观测性与监控

Envoy内置了丰富的指标收集和追踪功能，支持与主流可观测性平台集成。

```yaml

# envoy-telemetry-config.yaml - 遥测配置

admin:

access_log_path: "/dev/stdout"

address:

socket_address: { address: 0.0.0.0, port_value: 9901 }

<"mg.j9k5.org.cn"><"uhj.j9k5.org.cn"><"sef.j9k5.org.cn">

stats_config:

stats_tags:

- tag_name: "service"

regex: "^service=(.+)$"

- tag_name: "method"

regex: "^method=(.+)$"

- tag_name: "status_code"

regex: "^status_code=(.+)$"

use_all_default_tags: true

stats_matcher:

inclusion_list:

patterns:

- prefix: "cluster."

- prefix: "listener."

- safe_regex:

regex: "http\\..*\\.downstream_rq_.*"

stats_sinks:

- name: envoy.stat_sinks.prometheus

typed_config:

"@type": type.googleapis.com/envoy.extensions.stat_sinks.prometheus.v3.PrometheusSinkConfig

emit_tags_as_labels: true

histogram_emit_mode: SUMMARY_AND_HISTOGRAM

- name: envoy.stat_sinks.open_telemetry

typed_config:

"@type": type.googleapis.com/envoy.extensions.stat_sinks.open_telemetry.v3.OpenTelemetrySinkConfig

grpc_service:

envoy_grpc:

cluster_name: otel-collector

timeout: 5s

tracing:

http:

typed_config:

"@type": type.googleapis.com/envoy.extensions.tracers.opentelemetry.v3.OpenTelemetryConfig

grpc_service:

envoy_grpc:

cluster_name: otel-collector

timeout: 5s

service_name: "envoy-proxy"

sampler:

constant_sampler:

decision: DECISION_RECORD_AND_SAMPLED

access_log:

- name: envoy.access_loggers.file

typed_config:

"@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog

path: "/dev/stdout"

log_format:

json_format:

timestamp: "%START_TIME%"

method: "%REQ(:METHOD)%"

path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"

protocol: "%PROTOCOL%"

response_code: "%RESPONSE_CODE%"

response_flags: "%RESPONSE_FLAGS%"

bytes_received: "%BYTES_RECEIVED%"

bytes_sent: "%BYTES_SENT%"

duration: "%DURATION%"

upstream_cluster: "%UPSTREAM_CLUSTER%"

upstream_host: "%UPSTREAM_HOST%"

```

基于xDS协议和WebAssembly的Envoy数据平面，为现代微服务架构提供了强大的流量治理能力。通过动态配置和可扩展的过滤器机制，企业能够构建灵活、安全、可观测的服务通信基础设施。在实际应用中，建议结合具体业务需求设计合理的流量策略，建立完善的监控体系，确保持续的服务质量和系统稳定性。

ITPub博客

Envoy数据平面架构实践：xDS与WASM在微服务治理中的应用

最新文章