Troubleshooting on Envoy Gateway

Admin Console

Mon, 01 Jan 0001 00:00:00 +0000

Envoy Gateway provides a built-in web-based admin console that offers a comprehensive interface for monitoring, debugging, and managing your Envoy Gateway deployment. The admin console provides real-time visibility into the control plane status, configuration state, performance metrics, and debugging capabilities.

Prerequisites

Follow the steps below to install Envoy Gateway and the example manifest. Before proceeding, you should be able to query the example backend using HTTP.

Expand for instructions

Install the Gateway API CRDs and Envoy Gateway using Helm:

Advanced: Envoy Proxy Admin Interface

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Platform admins looking to troubleshoot low level aspects of the data plane such as xDS config and heap dump, can directly connect to the Envoy Proxy Admin Interface.

Note: Application Developers may not have access to the namespace where the Envoy Proxy fleet is running and should rely on exported telemetry instead for troubleshooting.

Prerequisites

Follow the steps below to install Envoy Gateway and the example manifest. Before proceeding, you should be able to query the example backend using HTTP.

Configuration Issues

Mon, 01 Jan 0001 00:00:00 +0000

Overview

After configuring and applying resources, you might find that Envoy Gateway does not behave as expected. This guide helps troubleshoot configuration issues.

Many syntax errors and simple semantic issues are caught during resource validation by the Kubernetes API Server, which rejects invalid resources. However, more complex configuration issues require additional debugging.

Prerequisites

Follow the steps below to install Envoy Gateway and the example manifest. Before proceeding, you should be able to query the example backend using HTTP.

FAQ

Mon, 01 Jan 0001 00:00:00 +0000

Answers to recurring questions from GitHub issues and community discussions. If your question isn’t covered here, check the rest of the Troubleshooting section or open a GitHub issue.

Why does `kubectl exec`/`port-forward` fail when exposing kube-apiserver through Envoy Gateway?

You’ve routed the Kubernetes API server through Envoy Gateway, and plain calls work fine (kubectl get, list, watch), but kubectl exec, attach, or port-forward fail with:

error: unable to upgrade connection: empty server response

The Envoy Gateway access log for the failing request shows a protocol error followed by a rejected upgrade:

Troubleshooting on Envoy Gateway

Admin Console

Prerequisites

Advanced: Envoy Proxy Admin Interface

Overview

Prerequisites

Configuration Issues

Overview

Prerequisites

FAQ

Why does kubectl exec/port-forward fail when exposing kube-apiserver through Envoy Gateway?

Why does `kubectl exec`/`port-forward` fail when exposing kube-apiserver through Envoy Gateway?