October 11, 2021
Los Angeles, California + Virtual
View More Details Registration

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for KubeCon + CloudNativeCon North America 2021 - Los Angeles, CA + Virtual and add this Co-Located event to your registration to participate in these sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

Please note: This schedule is automatically displayed in Pacific Standard Time (PST), UTC -7. To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date." The schedule is subject to change.

IMPORTANT NOTE: Timing of sessions and room locations are subject to change through Monday, September 13 due to schedule changes that will be made as speakers finalize whether speaking in person or virtually.
Monday, October 11

9:00am PDT

Opening Remarks - Matt Klein, Creator of Envoy & Engineer, Lyft
Join us as we kick off EnvoyCon North America 2021!


Matt Klein

Software Engineer, Lyft
Matt Klein is a software engineer at Lyft and the creator of Envoy. He has been working on operating systems, virtualization, distributed systems, networking, and making systems easy to operate for nearly 20 years across a variety of companies. Some highlights include leading the... Read More →

Monday October 11, 2021 9:00am - 9:10am PDT
Room 502 AB + Online

9:10am PDT

Using Envoy as an Egress Proxy for TLS Enabled Traffic - Amit Jain & Kiran Kumar, VMware
Modern apps are increasingly relying on using external 3rd party services (such as Twilio for e.g) and shared cloud services (such as S3 for e.g.). External interactions are important not only for security but for the app's continuity and resiliency as well. The use of Envoy as an egress proxy for external interactions has been limited though, mostly as the external interactions are TLS protected and Envoy is not able to decrypt the external TLS sessions. This session demos a solution that enables Envoy as an egress proxy for external access. It builds upon a combined approach of deploying Envoy as a transparent egress sidecar proxy along with the SSLproxy (github.com/sonertari/SSLproxy). In this approach, SSLproxy acts as a transparent TLS interception proxy and Envoy provides traffic management & security on the decrypted traffic. We dive into the traffic stitching mechanism and a new Envoy listener filter that acts as the glue between Envoy and SSLproxy and extends Envoy for the integrated solution.

avatar for Kiran Kumar

Kiran Kumar

Software Architect, VMware
Kiran is a software architect at VMware. Prior to joining VMware, worked at Mesh7 (acquired by VMware), a cloud-native application security company.
avatar for Amit Jain

Amit Jain

Director Of Research & Development, VMware
Amit Jain is currently leading App Security & Services team for Modern Cloud-Native apps at VMware. Prior to joining VMware, Amit Jain founded Mesh7 (acquired by VMware), a cloud-native application security company, and served as the CTO.Amit has 20+ yrs. of experience in architecting... Read More →

Monday October 11, 2021 9:10am - 9:40am PDT
Room 502 AB + Online

9:40am PDT

Lessons Learned: Four Years with Emissary-ingress and Envoy - Flynn, Ambassador Labs
The Emissary-ingress (née Ambassador API Gateway) project got its start in 2017, with the stated goal of making it easy for developers to harness the power and flexibility of Envoy, in Kubernetes, without needing to be experts on either Envoy or Kubernetes. Realizing that goal has been quite a journey: to bring Envoy to non-experts, the Emissary-ingress team has needed to learn an enormous amount about how Envoy, from the basics of how it works and how to configure it to best effect, to how to build it, test it, extend it, and debug it. The experience has been by turns challenging, surprising, frustrating, delightful, and ultimately extremely rewarding: after four years, Emissary-ingress is a CNCF project running in thousands of installations around the world, bringing Envoy into production use for organizations that wouldn't otherwise be able to take advantage of it. Join Flynn from Ambassador Labs to dive further into the challenges we've seen, the many lessons we've learned along the way, and the things we think anyone working with Envoy should know.

avatar for Flynn


Technical Evangelist, Buoyant
Flynn is a technology evangelist at Buoyant, spreading the good word and educating developers about the Linkerd service mesh, Kubernetes, and cloud-native development in general. He has spent four decades in software engineering from the kernel up through distributed applications... Read More →

Monday October 11, 2021 9:40am - 10:10am PDT
Room 502 AB + Online

10:10am PDT

Monday October 11, 2021 10:10am - 10:30am PDT

10:30am PDT

Health Checks: A Boon or a Curse? - Venil Noronha & John Murray, Stripe
Health checks are an essential part of distributed systems of today that allow one to operate services in a reliable manner. Without health checks, operating a large latency-sensitive system becomes impossible. However, as the composition of environments differ, it can become a real burden to support health checks. Additionally, as the system scales, users tend to face the dreaded N-square problem, and then hit a tipping point, and traditional solutions don't seem to work. In this talk, we will discuss the benefits of health checks in Envoy, some problems we have encountered at scale at Stripe, and options to mitigate such issues.

avatar for John Murray

John Murray

Software Engineer, Stripe
John is an infrastructure Engineer working on the Service Networking team at Stripe. He is an occasional contributor to Envoy proxy and has spent most of his career working with web-services.
avatar for Venil Noronha

Venil Noronha

Software Engineer, Stripe
Venil Noronha is an engineer with the Service Networking team at Stripe. He contributes upstream to open source projects in the service mesh domain, like Istio and Envoy proxy. In the past, he has contributed to several open source projects including Kubernetes, Spring, and Golan... Read More →

Monday October 11, 2021 10:30am - 11:00am PDT
Room 502 AB + Online

11:00am PDT

Dedicated Infrastructure in a Multitenant World - Carlos Sanchez, Adobe
Running multitenant Kubernetes clusters is challenging, particularly when different tenants require their own dedicated infrastructure. At Adobe Experience Manager Cloud Service we built solutions to provide customers with their own dedicated infrastructure, such as ips, DNS, VPN connectivity,... while running most services in multitenant Kubernetes clusters. We make extensive use of Envoy to run networking tunnels between Kubernetes pods and customer dedicated infrastructure, enforcing encryption and mutual authentication using certificates. This allows, for example, different pods to have their own dedicated egress ip instead of the cluster's, or connections from pods to multiple customer on-premise services using VPN. The solution is provisioned automatically using Terraform, Kubernetes operators and other services. We have previously shown the architecture we built to run this service, and we will provide updates on what worked well, what didn't and the lessons we learned running it in production.

avatar for Carlos Sanchez

Carlos Sanchez

Principal Scientist, Adobe
Carlos Sanchez is a Principal Scientist at Adobe Experience Manager, specializing in software automation, from build tools to Continuous Delivery and Progressive Delivery. Involved in Open Source for over 15 years, he is the author of the Jenkins Kubernetes plugin and a member of... Read More →

Monday October 11, 2021 11:00am - 11:30am PDT
Room 502 AB + Online

11:30am PDT

HTTP/3 in Envoy: End to End Acceleration - Alyssa Wilk & Ryan Hamilton, Google
With HTTP/3 support going alpha in the Envoy 1.19.0 release, the team that launched HTTP/3 is excited to explain what HTTP/3 is, and talk about Envoy’s HTTP/3 integration: what is supported today, what is upcoming, and what best practices there are for testing and deploying HTTP/3 for your own Envoy instances, client side or server side.

avatar for Alyssa Wilk

Alyssa Wilk

Senior Staff Software engineer, Google
Alyssa is an Envoy Senior Maintainer and a software engineer at Google. She spent over a decade at Google writing and enhancing the GFE, Google's front-line HTTP proxy, before setting her sights on making Envoy even more awesome than the GFE is.

Ryan Hamilton

Software Engineer, Google

Monday October 11, 2021 11:30am - 12:00pm PDT
Room 502 AB + Online

12:00pm PDT

Monday October 11, 2021 12:00pm - 1:15pm PDT

1:15pm PDT

Lightning Talk: Connecting the (Proxy) Dots: A Beginners Guide to Reading Envoy Debug Logs - Casey Kurosawa, Ambassador Labs
In the world of support engineering, one of the most valuable questions you can answer is "where is this problem coming from?" When it comes to debugging Envoy Proxy-based applications -- where the traffic can be coming in and out, backwards and sideways -- it can be particularly difficult to answer this question when you’re trying to figure out why a request is failing. This talk will provide a brief overview of how Envoy is structured, and then conduct a live walk through of the debug logs of a request. Attendees will learn how the information in these logs relate to Envoy's internal mechanics.


Casey Kurosawa

Solutions Engineer, Ambassador Labs

Monday October 11, 2021 1:15pm - 1:25pm PDT
Room 502 AB + Online

1:25pm PDT

Lightning Talk: State of Go Control Plane: What Does the Future Behold? - Alec Holmes, greymatter.io
In the recent years of Envoy’s lifecycle, the service mesh landscape has matured drastically. With the industry growing and utilizing the xDS APIs, the products coming to market and the various solutions designed around the complexities of envoys discovery mechanisms, control plane bifurcation and disparity are more relevant than ever. Go Control Plane has become a targeted part of the Envoy ecosystem, and this talk will walk through what's planned in the pipeline, and what has been merged in this year.

avatar for Alec Holmes

Alec Holmes

Software Engineer, greymatter.io
My name is Alec Holmes, I'm a core engineer at Greymatter.io working on our product and love growing the Envoy project. I'm actively maintaining go-control-plane and deeply enjoy experiencing world wide collaboration in the Envoy ecosystem . Talk to me about anything! I love Go, xDS... Read More →

Monday October 11, 2021 1:25pm - 1:35pm PDT
Room 502 AB + Online

1:35pm PDT

Load Shedding for Evil Wizards - Tony Allen, Unaffiliated
Envoy has a number of different load shedding mechanisms available out-of-the-box. Circuit breaking, rate limiting, admission control, adaptive concurrency-- how do they work? When should you use them? How can they fail spectacularly? Let's find out!

This one's a deep-dive into the different load shedding mechanisms available in Envoy. Come watch Tony gush about how each one is implemented, the queuing/scheduling concepts behind them, and how they can fail to protect us from noisy-neighbor problems. He'll conclude with some experimental results based on his previous work on FBThrift and how we (as a community) can apply those ideas to improve Envoy.

avatar for Tony Allen

Tony Allen

Software Engineer, Unaffiliated
Tony is a software engineer and Envoy contributor!

Monday October 11, 2021 1:35pm - 2:05pm PDT
Room 502 AB + Online

2:05pm PDT

Extending Envoy Using WebAssembly (Wasm) - Daneyon Hansen, Tetrate
If you’ve ever wondered what WebAssembly (Wasm) is and how it works with Envoy, this session is for you. At the heart of Envoy lies a variety of filters that provide features such as network routing, observability, and security. Did you know that you can also write your own filters to extend Envoy functionality? In this session, you will learn about Envoy extensibility and the details of extending Envoy with Wasm.

avatar for Daneyon Hansen

Daneyon Hansen

Principal Software Engineer, Solo.io
Daneyon has been a contributor and maintainer for several CNCF projects since the early days of the foundation. He focuses on advancing application networking for cloud-native environments.

Monday October 11, 2021 2:05pm - 2:35pm PDT
Room 502 AB + Online

2:35pm PDT

The Trials and Success of Adopting Envoy at Tinder - Yuki Sawa & Cooper Jackson, Tinder
Tinder adopted an Envoy based service mesh for their Kubernetes based infrastructure a few years ago. Our implementation is custom to Tinder's architecture but the lessons we picked up along the way are universal. Whether it's how we store and represent our routing configuration, building out a robust monitoring pipeline for all our Envoy metrics, utilizing Envoy's global rate limiting capabilities to protect our infrastructure, meshing our database and microservice requests, retry and timeout do’s and don’ts, and more, there is plenty of knowledge to share. We will explore our bespoke features like deadline propagation, multi-cluster Envoy metric monitoring, and how we implemented our own xDS control plane. From the early struggles of our service mesh migration, to cautionary tales and best practices, we're excited to walk through the process of building out an Envoy topology that powers Tinder's infrastructure worldwide.

avatar for Yuki Sawa

Yuki Sawa

Engineering Manager, Tinder
Yuki is a Software Engineer at Tinder on the Cloud Infrastructure team. There he drives the adoption of Envoy, building an xDS control plane that integrates with Kubernetes and implementing a full featured service mesh platform. He also contributes to various open source projects... Read More →

Cooper Jackson

Senior Site Reliability Engineer, Tinder

Monday October 11, 2021 2:35pm - 3:05pm PDT
Room 502 AB + Online

3:05pm PDT

Monday October 11, 2021 3:05pm - 3:25pm PDT

3:25pm PDT

The Evolution of Twitter's Edge - Ryland Degnan, Twitter
Each day, Twitter responds to hundreds of billions of requests from users around the world. Today, Envoy is the point of entry for 100% of these requests. This hasn't always been the case. Not long ago, requests to Twitter passed through an ancient and highly bespoke edge proxy that was created internally and predated the open-source Envoy. In this talk, Ryland will describe how Twitter runs Envoy at the edge at scale, some of the unique benefits that Envoy provides in Twitter's edge architecture, and highlight features that Twitter has contributed to Envoy to support the edge use-case. He will outline how Twitter's edge architecture has evolved over time as the number of users and services has grown, what the next steps are for Twitter's edge, and the role Envoy will play in the future.

avatar for Ryland Degnan

Ryland Degnan

Engineering Manager, Twitter

Monday October 11, 2021 3:25pm - 3:55pm PDT
Room 502 AB + Online

3:55pm PDT

Speeding up Istio: Our Journey Implementing Delta xDS - Aditya S Prerepa, Tetrate & John Howard, Google
xDS is the way config is distributed to Envoy. Most of the ways the xDS API is implemented today (and in Istio) is through the state-of-the-world design. If one out of a thousand clusters changes and Envoy needs to know about the change, most control planes (including Istio) will send all of the thousand clusters to reflect the configuration change. On top of that, every configuration type is converged into one stream with Istio (ADS), which does not do the network any favors. This is the “quick and dirty” way, when logically, there should be no reason to send configuration when it hasn’t changed. This is what the delta xDS API aims to solve. Delta (or incremental) xDS is a variant of ADS/xDS, which has a different interface. If one configuration changes, that is the only configuration that will be sent. Istio is having quite a journey implementing delta xDS, sending only the “deltas” in configuration changes. Especially in a service mesh like Istio, which is the largest and most in-use mesh, there are quite a few caveats that need to be covered. This talk will be about the journey of Istio in implementing delta xDS, along with the expected benefits & apparent struggles that we had, along with guidance for future implementers of this amazing API.

avatar for John Howard

John Howard

Staff Software Engineer, Google
John is a Software Engineer at Google working on Istio, and member of the Istio TOC and Steering committee.
avatar for Aditya Prerepa

Aditya Prerepa

SWE @ Aviatrix & Undergrad @ UIUC, Aviatrix
Aditya is an Engineer @ Aviatrix and an Undergrad & Researcher at UIUC. He is an Istio networking mainatiner.

Monday October 11, 2021 3:55pm - 4:25pm PDT
Room 502 AB + Online

4:25pm PDT

Closing Remarks - Matt Klein, Creator of Envoy & Engineer, Lyft
Join us for closing remarks and a wrap-up of the day's content!


Matt Klein

Software Engineer, Lyft
Matt Klein is a software engineer at Lyft and the creator of Envoy. He has been working on operating systems, virtualization, distributed systems, networking, and making systems easy to operate for nearly 20 years across a variety of companies. Some highlights include leading the... Read More →

Monday October 11, 2021 4:25pm - 4:35pm PDT
Room 502 AB + Online

5:00pm PDT

CNCF-hosted Co-located Events Happy Hour
Join us onsite for drinks and appetizers with fellow co-located attendees from Monday's CNCF-hosted Co-located Events. Network with attendees from:
  • Cloud Native eBPF Day North America hosted by CNCF
  • EnvoyCon North America hosted by CNCF
  • Production Identity Day: SPIFFE + SPIRE North America hosted by CNCF
  • PromCon North America hosted by CNCF
  • SupplyChainSecurityCon hosted by CNCF + CDF

The CNCF-hosted Co-located Events Happy Hour on Monday evening will be held at the JW Marriott, Gold Ballroom Foyer - a short 7 minute walk from the LACC.  
To access the Happy Hour, please follow the directions below:
  • 1. From the LACC please proceed out the West Lobby exit, take a left and proceed NE around the Staples Center to Chick Hearn Court.
  • 2. Cross Chick Hearn Court and continue NE on Georgia St. one block. 
  • 3. Take a right on West Road and continue a half block until you see the JW Marriott entrance on your left, between Savoca and The Mixing Room.  
  • 4. Upon arrival at the JW Marriott, walk through the lobby to the escalators behind the lobby bar and take them to level 3. Take a right to enter the Skybridge where you will need to show your badge with your Monday vaccination approval. 
  • 5. Once your badge is verified you will be directed down another set of escalators to the Gold Ballroom Foyer. You've arrived!

Monday October 11, 2021 5:00pm - 6:30pm PDT
JW Marriott L.A. LIVE
  • Timezone
  • Filter By Venue Los Angeles, CA, USA
  • Filter By Type
  • Breakout Sessions
  • Closing Remarks
  • Lightning Talks
  • Networking
  • Opening Remarks
  • Content Experience Level
  • Talk Type

Filter sessions
Apply filters to sessions.