Alek's Blog - envoy

Istio AuthorizationPolicy & HTTP/2 Coalescing

aleks — Mon, 13 Jul 2026 00:00:00 +0000

Isolating an admin surface behind its own hostname and an IP-restricted Istio</a> AuthorizationPolicy</code> sounds like a Tuesday-afternoon change: add a second HTTPRoute</code>, add a DENY</code> policy with an allowlist, done. Two non-obvious Envoy behaviors turned it into a two-day debugging exercise instead — one in how AuthorizationPolicy</code> resolves “the client’s IP,” and one in how browsers reuse HTTP/2 connections across hostnames that share a certificate. Neither is specific to Keycloak or to this particular setup; both apply to any Istio or Envoy Gateway API ingress sitting behind a cloud load balancer with a shared wildcard certificate.</p>

This post walks through both bugs, how they were root-caused, and the fix for each — so the next person hitting either symptom can skip straight to the cause.</p>


SigNoz on OVH MKS: Access Log Reports with Vector and ClickHouse
aleks — Mon, 18 May 2026 00:00:00 +0000
Posts 1</a> and 2</a> of this series set up the SigNoz observability stack on OVH MKS and demonstrated metrics, traces, and Kubernetes pod log collection. This post adds a practical use case: structured Envoy access log collection via Vector, archiving to OVH Object Storage in Combined Log Format, and monthly HTML reports via awffull — accessible at https://reports.<your-domain></code> through the existing Istio gateway.</p>


ClickHouse Use Case: Vector, Istio, nginx, Java on OVH MKS
aleks — Thu, 14 May 2026 00:00:00 +0000
The first four parts of this series compared Elasticsearch, OpenSearch, Loki, Quickwit, and
ClickHouse across storage models, operations, security, and UX. This part shows what a
concrete production setup looks like when the decision has been made: ClickHouse</strong> as the
log store, Vector</strong> as the ingestion agent, running on OVH Managed Kubernetes Service
(MKS)</strong> with OVH Object Storage</strong> as the cold tier.</p>
This is Part 5 of a five-part series:</p>

Full guide:</strong> Elasticsearch vs. OpenSearch vs. Loki vs. Quickwit vs. ClickHouse: The Complete Guide</a></li>
Part 1</a> — storage models, compression, resource consumption, and SaaS options</li>
Part 2</a> — cluster setup, Kubernetes operations, backup and disaster recovery</li>
Part 3</a> — encryption, RBAC, and WORM compliance</li>
Part 4</a> — UI layers, dashboards, alerting, and cold-tier query behaviour</li>
Part 5 — this post</li>
</ul>


Istio vs. Envoy Gateway: Gateway API on Kubernetes
aleks — Thu, 30 Apr 2026 00:00:00 +0000
Both Istio</a> and Envoy Gateway</a> implement the
Kubernetes Gateway API</a> and use Envoy as their data plane.
That is roughly where the similarity ends. Istio is a full service mesh that happens to
implement Gateway API; Envoy Gateway is a dedicated Gateway API controller with no mesh
ambitions. Choosing between them is mostly a question of scope.</p>
This post starts with that comparison — architecture, mTLS, egress control, and resource
overhead — then broadens to cover Cilium</a> as a lighter alternative for
East-West security, how the choice plays out on managed Kubernetes offerings (AKS, GKE, and
OVH MKS including their cloud-native ingress and egress options), and finally how to get
the real client IP through a cloud load balancer to your application.</p>


Envoy Gateway v1.7: Global Rate Limiting with a Custom ratelimit Service
aleks — Sun, 19 Apr 2026 00:00:00 +0000
Global rate limiting in Envoy Gateway (EG)</a> can be set up in two ways:
the easy path (EG manages its own envoy-ratelimit</code> container) and the flexible path
(you bring your own envoyproxy/ratelimit</a> service).
This post covers the flexible path — Option B</strong> — and documents the three xDS patches
required to wire it up, the EG v1.7 breaking changes that affect the approach,
and a namespace-admin self-service deployment model.</p>