Envoy for VS Code

A VS Code extension for Envoy Proxy 1.40.0 bootstrap YAML and inline static resources. Field definitions and documentation are generated from the pinned upstream protobuf API, not maintained by hand. Red Hat YAML supplies YAML syntax, formatting, and syntax diagnostics.

This is an independent community project, not an official Envoy or CNCF extension.

Installation

Requires VS Code 1.96 or newer and YAML by Red Hat. For pre-release packages, see the VSIX installation instructions.

Quick start

1. Open your Envoy YAML or the example configuration. Filenames containing envoy are detected by default. For other filenames, run Envoy for VS Code: Enable for Current File. The command also works on empty untitled documents with the language set to YAML.
2. Under http_filters, add - name: before the router. Press Ctrl+Space, select envoy.filters.http.jwt_authn, and fill the tab stops for the provider name, issuer, and JWKS file.
3. Inside typed_config, press Ctrl+Space on a new indented line for generated fields; repeat inside nested maps or array items.
4. Try the same inside clusters, listener filters, transport sockets, or typed_per_filter_config. Hover names, type URLs, and fields for documentation.

The JWT starter requires verification for all paths. Supply a real issuer and JWKS file; add audiences when audience validation is required. CORS needs a route/virtual-host policy, and external authorization needs an upstream cluster. Keep the router last. Existing typed_config blocks are preserved.

Files containing an Envoy type.googleapis.com/envoy.* URL are also detected automatically. Use envoyYaml.filePatterns to recognize additional filenames.

Features

• Field completion for bootstrap, listeners, clusters, endpoints, routes, and nested messages.
• Context-aware extension names and inline Any type URLs, including MCP, JWT, RBAC, TLS, access loggers, upstream HTTP options, and per-route configurations.
• Editable starter templates for JWT, router, CORS, external authorization, HTTP connection manager, TCP proxy, and listener local rate limit. Other known filters receive a name/type skeleton and may need additional required fields.
• Hovers with field types, annotated constraints, oneof choices, and version-pinned API documentation links.
• Focused warnings for field types, integer shapes, enum values, string lengths, oneof conflicts, known filter name/type mismatches, JWT references, and router ordering.
• Offline editing assistance using bundled metadata.

See the coverage report for metadata counts and unresolved documentation references. Coverage does not imply complete validation or availability in every Envoy binary; marked contrib extensions may need a contrib build.

Settings

• envoyYaml.enabled: enable or disable the extension.
• envoyYaml.filePatterns: YAML globs; defaults to **/*envoy*.yaml and **/*envoy*.yml.
• envoyYaml.validation: enable or disable focused Envoy warnings.

Envoy API support is fixed at 1.40.0; API v3 does not mean every Envoy release is supported. A version selector and automatic schema updates are not implemented.

Scope and limitations

• Single-file bootstrap/static resources and inline configurations only. No standalone xDS resource workflow, external-file traversal, remote resource discovery, or graphical configuration forms.
• Unknown fields and custom types remain opaque, not errors. Not all required fields, numeric bounds, duration formats, CEL rules, prose constraints, or Envoy runtime semantics are validated. Absence of warnings does not imply a valid or secure configuration.
• The registry does not fully encode per-route applicability or transport direction. Context selection uses message/category information plus limited naming conventions; Envoy remains authoritative for whether a type is valid at a particular extension point.
• Some upstream documentation references are rendered as text rather than links.
• Completion targets unfinished block-style YAML and two-space templates. Flow style, merge-key/alias expansion, and multi-document completion are not supported. YAML syntax errors are left to Red Hat YAML.

Run envoy --mode validate -c <config.yaml> with the actual target binary for authoritative semantic, build-specific, and version-specific validation. The extension does not execute Envoy or fetch remote schemas while editing.

Contributing and license

Bug reports and pull requests are welcome at https://github.com/ivanitskiy/envoy-vscode. See CONTRIBUTING.md to contribute and SECURITY.md for private vulnerability reporting.

Copyright 2026 Maxim Ivanitskiy. Licensed under the Apache License 2.0.

Envoy-derived documentation retains its upstream attribution. See NOTICE and THIRD_PARTY_NOTICES.md.