Learn Envoy Proxy - Pre-Requisites Skill & Environment Setup

#Introduction

Welcome to the Learn Envoy Proxy series! This series will take you through mastering Envoy — an open-source layer-7 data plane proxy used across thousands of platforms, including Istio, Gloo, and many major service meshes — from the conceptual foundation all the way to production hardening. There are 23 episodes in total, organized into six phases.

But before writing your first configuration, there are some basic skills and software you need to have. Why do these prerequisites matter? Because Envoy operates at the heart of the network: it accepts TCP connections, speaks HTTP and HTTP/2, performs TLS, and translates domains. If you don't yet understand basic networking terms, every Envoy feature will feel like a black box.

Episode 0 is your roadmap: we'll make sure your networking fundamentals are solid, understand the concepts of proxy and load balancer, set up the required software, and then run Envoy for the first time. Once this episode is done, the whole series can be followed comfortably.

#Networking Fundamentals You Must Master

#TCP, UDP, HTTP, TLS, and DNS

Envoy works at the transport and application layers, so you must understand the following basics:

• TCP: the stream-oriented connection protocol used by almost all internal services.
• UDP: the connectionless protocol, used for DNS and some real-time workloads.
• HTTP: the request-response protocol over TCP, plus the modern variants HTTP/2 and HTTP/3.
• TLS: the encryption layer that secures HTTP into HTTPS and that Envoy uses for certificates.
• DNS: the naming system that turns hostnames into IP addresses.

You don't need to memorize TCP header details, but you must understand the flow of a single request: the client opens a connection, sends an HTTP request, Envoy forwards it to the backend, then returns the response.

#Proxy, Reverse Proxy, Load Balancer, and Service Mesh Concepts

Some terms that will be used throughout the series:

• Proxy: an intermediary between client and server.
• Reverse proxy: a proxy in front of backend servers that receives requests from external clients.
• Load balancer: a distributor of traffic across several backends so the load stays even.
• Service mesh: a network layer for communication between services, usually using Envoy as a sidecar.

curl --version
openssl version
getent hosts envoyproxy.io

The getent hosts envoyproxy.io command tests your DNS resolution. If the three commands above run without errors, your networking foundation is ready.

#Software You Need to Prepare

#Envoy Binary or Docker Image

The easiest way to run Envoy in a lab is through the official image:

docker pull envoyproxy/envoy:v1.31.0
docker run -d --name envoy-lab -p 10000:10000 -p 9901:9901 envoyproxy/envoy:v1.31.0

This container, named envoy-lab, runs Envoy with the default config: port 10000 for traffic and 9901 for the admin interface. The docker run command is the fastest way to get Envoy without compiling from source.

If you prefer a direct binary, download it from the official Envoy GitHub releases and run envoy --version to make sure the binary works.

#Network Debugging Tools

Besides curl, prepare the following tools:

• openssl to inspect certificates and perform manual TLS handshakes.
• tcpdump to capture packets at the network level — optional but very helpful.
• wireshark for visual packet analysis, optional.
• dig or nslookup for DNS debugging.

which curl openssl tcpdump

If tcpdump is not yet on your system, run apt install tcpdump on Ubuntu/Debian or the equivalent for your distro. This tool will come in handy when we debug TCP connections in episodes 6 and 12.

#A Simple Kubernetes Cluster

Episodes 17 and 19 cover Envoy on Kubernetes. For a lab, you can use:

• minikube for a single-node local cluster.
• kind for a lightweight Docker-based cluster.
• k3s for a small, resource-efficient cluster.

Set up one of these now so you don't waste time in phase 6. Kubernetes is optional for the first 16 episodes, so you can continue without a cluster for now.

#Setting Up Your Workspace and Editor

#Project Directory Structure

Create a working directory for the entire series:

mkdir -p ~/envoy-lab/configs
mkdir -p ~/envoy-lab/certs
mkdir -p ~/envoy-lab/logs
cd ~/envoy-lab

I recommend the VS Code editor with the YAML extension. Envoy config is YAML-based with strict indentation, so the YAML extension helps you catch indentation errors early. Save all config files in the configs directory so they can be reused easily in later episodes.

#Testing the Envoy Admin Interface

Once the container is running, test the admin interface on port 9901:

curl -s localhost:9901/server_info
curl -s localhost:9901/stats | head -10
curl -s localhost:9901/config_dump

curl localhost:9901/server_info shows the Envoy version, and config_dump displays the currently active configuration. This admin interface is your best friend while learning Envoy — we'll use its endpoints in almost every episode.

#Summary of Prepared Prerequisites

Here's what you should have after episode 0:

• Basic networking skills: TCP, UDP, HTTP, TLS, and DNS.
• Proxy, reverse proxy, load balancer, and service mesh concepts.
• Envoy via Docker or binary, plus curl, openssl, and tcpdump.
• VS Code with the YAML extension for editing config.
• Kubernetes optional — set up minikube, kind, or k3s for phase 6.
• The Envoy admin interface on port 9901, already accessible.

If anything is still missing, stop and complete it before moving on. A strong foundation will make the next 22 episodes feel much lighter.

#Closing

In episode 0 you've laid the groundwork for the entire series: understanding basic networking skills, proxy and load balancer concepts, setting up Docker with the official Envoy image, enabling the admin interface, and organizing your project workspace.

Key takeaways:

• Envoy is a layer-7 proxy, so master TCP, HTTP, TLS, and DNS first.
• Understand the difference between proxy, reverse proxy, load balancer, and service mesh.
• Run Envoy via docker run with the envoyproxy/envoy image.
• The admin interface on port 9901 is your debugging hub: server_info, stats, config_dump.
• Prepare curl, openssl, and tcpdump for upcoming episodes.
• Kubernetes is optional, but set up minikube, kind, or k3s before phase 6.

In the next episode, episode 1, we'll discuss history, background, and why you need Envoy — from Envoy's birth at Lyft, its evolution into a modern layer-7 proxy for microservices, to its comparison with NGINX, HAProxy, and service mesh data planes. Make sure your environment is ready, because the Learn Envoy Proxy journey has just begun!