HAProxy, Envoy & Choosing a Proxy

In one line

HAProxy is a battle-tested, very fast L4/L7 load balancer; Envoy is a dynamically configured L7 proxy built for microservices and service meshes; knowing their strengths helps you pick and debug them.

0/4 · 0%

Key ideas

01
HAPROXY: extremely efficient TCP and HTTP load balancing with rich health checks, stick tables (per-client tracking for rate limits and sessions), and detailed stats. Common in front of databases (e.g. routing to a Postgres primary) and in high-traffic edges.
02
ENVOY: a modern L7 proxy configured through APIs (xDS) rather than static files, so a control plane can update routes, clusters, and certificates live. It has first-class gRPC and HTTP/2, retries, timeouts, circuit breaking, outlier detection, and detailed metrics and tracing. It's the data plane of Istio and many API gateways, and powers several Kubernetes Gateway API implementations.
03
NGINX vs HAPROXY vs ENVOY, roughly: Nginx for web serving plus reverse proxying and simple setups; HAProxy for high-performance load balancing with fine-grained TCP/HTTP control; Envoy when you need dynamic configuration, gRPC-aware balancing, and deep observability across many services.
04
The resilience features you met in the Observability course (timeouts, retries with budgets, circuit breakers, outlier detection: Case 3.2) are configuration in Envoy, so a mesh can apply them uniformly without changing application code (Kubernetes course, Topic 8.3).
05
Apache HTTP Server still runs a lot of the web, especially with legacy PHP; its reverse-proxy module (mod_proxy) works on the same principles.

Code & diagrams

haproxy.cfgbash

frontend web
    bind *:80
    default_backend shoplite

backend shoplite
    balance leastconn
    option httpchk GET /healthz
    server app1 10.0.1.10:8080 check
    server app2 10.0.1.11:8080 check

ProxyRolesdiagram

Rendering diagram…

Explain it without notes

What does it mean that Envoy is configured through APIs (xDS), and why does that matter in Kubernetes?

Practice

You need to load-balance plain TCP connections to three Postgres replicas with health checks. Which of Nginx, HAProxy, or Envoy would you pick, and why?

Trade-offs

↔
Dynamic, feature-rich proxies like Envoy enable meshes and gateways but bring a control plane to operate; simpler proxies are easier to run and reason about but need reloads and templating to keep up with changing backends.

Done when you can

I know the strengths of Nginx, HAProxy, and Envoy.
I understand what xDS dynamic configuration enables.
I can read a basic HAProxy frontend and backend.