Skip to main content
emisar

Envoy proxy / service mesh

v0.1.20

Envoy admin-API ops: cluster + listener + runtime + config + cert inventory, server info, logging level read/write, plus traffic-shifting mutators (drain listeners, healthcheck fail/ok, reset counters) for planned failovers and incident response. Default admin URL http://127.0.0.1:9901; override via ENVOY_ADMIN env.

11 allowed by default 3 need approval by default
Pack ID
envoy
Vendor
emisar
OS
linux
Actions
14
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
curl

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install envoy --hash sha256:95e91be868e0dca07edfb142c9d592712012fa3caaf918871ded1d2457402fe2

Setup

Operates on the local Envoy instance on the runner host via its admin endpoint (default 127.0.0.1:9901) — no credentials needed.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • ENVOY_ADMIN default http://127.0.0.1:9901

    Base URL of the Envoy admin endpoint every action talks to; set only if it is not on the default.

Notes

  • ENVOY_ADMIN only reaches an action when the runner allowlists it in execution.inherit_env — the action env is scrubbed to PATH/LANG/LC_ALL/TERM by default. Unset, it falls back to http://127.0.0.1:9901, so an admin interface on another port or host silently reads the local one instead.
  • The admin endpoint must be enabled in the Envoy bootstrap (admin.address) for any action to work.

Verify it works

Runs envoy.ready, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify envoy

Install and configure a pack walks through the whole sequence on a host.

Actions 14 total

View on GitHub
  • envoy.certs exec low Low — read-only or trivially reversible

    GET /certs

    List active TLS certs known to Envoy — subjects, expiry, days remaining.

    View source on GitHub
  • envoy.clusters exec low Low — read-only or trivially reversible

    GET /clusters

    List all clusters with endpoint health + stats. Use for "which upstream is unhealthy?".

    View source on GitHub
  • envoy.config_dump exec high High — service-affecting

    GET /config_dump

    Dump full xDS config — bootstrap, clusters, routes, listeners. This surfaces the entire effective config, which can carry secrets (TLS private keys / SDS material, upstream credentials, auth headers). The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

    View source on GitHub
  • envoy.drain_listeners exec high High — service-affecting

    POST /drain_listeners

    Mark all listeners as draining. Existing connections close on their own as requests complete; no new connections accepted on drained listeners. Use during a planned restart to drain traffic before flipping a load balancer.

    View source on GitHub
  • envoy.healthcheck_fail exec high High — service-affecting

    POST /healthcheck/fail

    Mark Envoy unhealthy via its admin API. External health checks see failure; load balancer pulls this instance out of rotation. Use during planned maintenance to drain traffic before a restart.

    View source on GitHub
  • envoy.healthcheck_ok exec medium Medium — changes state, easily reversible

    POST /healthcheck/ok

    Mark Envoy healthy again. Reverses healthcheck_fail. Load balancer starts sending traffic again on the next health check.

    View source on GitHub
  • envoy.listeners exec low Low — read-only or trivially reversible

    GET /listeners

    List all active listeners with bind address.

    View source on GitHub
  • envoy.logging_get exec low Low — read-only or trivially reversible

    POST /logging

    Show current per-component log levels.

    View source on GitHub
  • envoy.logging_set exec medium Medium — changes state, easily reversible

    POST /logging?level=<level>

    Set all components to one log level. Use "debug" for triage, then revert to "info".

    View source on GitHub
  • envoy.ready exec low Low — read-only or trivially reversible

    GET /ready

    Check readiness — 200 if Envoy is fully initialized; 503 otherwise.

    View source on GitHub
  • envoy.reset_counters exec medium Medium — changes state, easily reversible

    POST /reset_counters

    Reset all Envoy stat counters to zero. Use before isolating a specific test scenario or after diagnosing a noisy historical counter. Histograms and gauges unaffected.

    View source on GitHub
  • envoy.runtime exec low Low — read-only or trivially reversible

    GET /runtime

    Show runtime overrides (feature flags + numeric overrides).

    View source on GitHub
  • envoy.server_info exec low Low — read-only or trivially reversible

    GET /server_info

    Show Envoy version, uptime, hot-restart state, command-line.

    View source on GitHub
  • envoy.stats exec low Low — read-only or trivially reversible

    GET /stats (filter)

    Show Envoy stats matching a regex filter. Use 'cluster|listener|server' as a sane default.

    View source on GitHub
← Back to registry
Pack reference  Publish your own