xDS Control Plane the Hard Way

English | 日本語

This is a set of chapters that build an Envoy xDS control plane from scratch, in the spirit of Kubernetes the Hard Way. No Istio, no service mesh framework. Just Envoy, the xDS protocol, and a control plane you write by hand in Rust.

It is optimized for learning, which means taking the long route so that LDS, RDS, CDS, EDS, ACK/NACK, ADS, Delta, xdstp://, and ORCA stop being words you nod along to.

These chapters are a lab, not a framework. Don't run them in production.

The stack

• Envoy as the data plane, in Docker.
• A control plane you write by hand with tonic, using the xds-api crate only for the generated protobuf.
• A small upstream HTTP server in Rust (hyper).
• docker compose and make to wire it together.

The ADS server, the snapshot, and the ACK/NACK handling are written by hand on purpose. xds-api does nothing but generate code from the protobuf.

Chapters

Each chapter is a complete stack. Start it with make up and tear it down with make down.

1. Hello, xDS. The smallest stack that earns the name: one listener, route, cluster, and endpoint served over ADS. Curl the upstream and watch the four ACKs go by.
2. Snapshot swaps and rollback. Push a broken listener, watch the version roll back on NACK.
3. Static SDS to start mTLS. Inject a cert over SDS and watch it hot-rotate.
4. Delta xDS. The same stack on the Delta protocol.
5. xdstp:// and multiple authorities. xdstp:// naming and glob collections across two authorities on one Delta stream (Envoy does not yet support per-authority control planes).
6. ORCA out-of-band load reports. Backends report synthetic load over ORCA; the control plane (Envoy doesn't consume ORCA itself) turns it into EDS weights and the lighter backend wins.

License

MIT. See LICENSE.