Envoy is an open-source proxy for edge and service traffic, built for cloud-native applications. It runs alongside applications or as a gateway and handles networking and observability in one place. It supports HTTP/2, HTTP/3 and gRPC, load balancing with retries, circuit breaking and rate limiting, TLS termination, mutual TLS, JWT authentication and external authorisation. Its xDS APIs let operators change routing and policy at runtime without restarts, and it can be extended with Wasm, Lua or dynamic modules. Envoy serves as the data plane of service meshes and as the basis of gateways such as Envoy Gateway. It is software that you deploy and operate yourself.
Envoy was originally built at Lyft and is now a graduated project of the Cloud Native Computing Foundation, with copyright held by the Envoy Project Authors under the Linux Foundation. As there is no vendor-hosted service, traffic and configuration stay in the infrastructure where you run it, including EU data centres. A European organisation controls where data flows, in return for operating the proxy itself.