xds

xDS refers to a family of APIs used to dynamically configure proxy servers, most notably the Envoy proxy, via a control plane. The set of xDS APIs includes CDS (Cluster Discovery Service), EDS (Endpoint Discovery Service), LDS (Listener Discovery Service), RDS (Route Discovery Service), and SDS (Secret Discovery Service), along with the Aggregated Discovery Service (ADS) that can carry multiple resource types over a single channel. These APIs enable a centralized control plane to manage the data plane’s topology, routing configuration, and credentials at runtime.

In operation, a data plane proxy acts as an xDS client and establishes a long‑lived connection to a management server that acts as the xDS server. The client sends DiscoveryRequest messages to subscribe to resources, while the server replies with DiscoveryResponse messages containing the requested resources. Each response carries a version and nonce for consistency and incremental updates. ADS allows all resource types to be delivered over one stream, and delta xDS offers an incremental update mechanism to reduce bandwidth.

Protocol details are defined using protobuf messages. Resource types are identified by type URLs, such as clusters, endpoints, routes, listeners, and secrets, allowing the control plane to push changes efficiently. Security commonly relies on TLS with mutual authentication, and deployments often use a centralized control plane to orchestrate configuration across many proxies.

xDS is a foundational component in modern service meshes, most prominently in Istio deployments, where Envoy data planes are configured by a control plane. The ecosystem includes multiple implementations and ongoing evolution to support dynamic, scalable, and secure proxy configurations.