Enable external traffic ingress into Consul service mesh

To set up ingress into your service mesh, you will:

• Enable Consul ingress features
• Deploy Consul API Gateway
• Deploy RBAC and Reference Grant resources
• View Consul services with the CLI, UI, and/or API
• Explore ingress into the HashiCups UI

To set up ingress into your service mesh, you will:

• Enable Consul ingress features
• Deploy Consul API Gateway
• Deploy RBAC and Reference Grant resources
• View Consul services with the CLI, UI, and/or API
• Explore ingress into the HashiCups UI

To set up ingress into your service mesh, you will:

• Enable Consul ingress features
• Deploy Consul API Gateway
• Deploy RBAC and Reference Grant resources
• View Consul services with the CLI, UI, and/or API
• Explore ingress into the HashiCups UI

The tutorial assumes that you have completed the previous tutorials in this getting started collection.

For this tutorial, you will need:

• An AWS account configured for use with Terraform
• aws-cli >= 2.0
• terraform >= 1.0
• consul >= 1.16.0
• consul-k8s >= 1.2.0
• git >= 2.0
• helm >= 3.0
• kubectl <= 1.24

The tutorial assumes that you have completed the previous tutorials in this getting started collection.

For this tutorial, you will need:

• An Azure account configured for use with Terraform
• Azure CLI
• terraform >= 1.0
• consul >= 1.16.0
• consul-k8s >= 1.2.0
• git >= 2.0
• helm >= 3.0
• kubectl <= 1.24

The tutorial assumes that you have completed the previous tutorials in this getting started collection.

For this tutorial, you will need:

• consul >= 1.16.0
• consul-k8s >= 1.2.0
• docker >= 20.0
• git >= 2.0
• helm >= 3.0
• kind <= 0.24.x
• kubectl <= 1.24

Review Consul API Gateway configuration

Now that you have enabled ingress features in your Consul service mesh, you can deploy the Consul API Gateway and associated HTTP Routes to your Kubernetes cluster. The Consul API Gateway uses HTTP Routes to route traffic to your applications.

Review the api-gw/consul-api-gateway.yaml configuration file. This file contains the configuration for the API Gateway pod, the listener, and TLS attributes.

apiVersion: gateway.networking.k8s.io/v1beta1# The Gateway is the main infrastructure resource that links API gateway components.kind: Gatewaymetadata:  name: api-gateway  namespace: consulspec:  gatewayClassName: consul  # Configures the listener that is bound to the gateway's address.  listeners:    # Defines the listener protocol (HTTP, HTTPS, or TCP)  - protocol: HTTP    port: 8080    name: http    allowedRoutes:      namespaces:        from: Same

Review the api-gw/routes.yaml configuration file. This file contains the configuration for HTTP routing including the network traffic rules and the backend service that will receive the ingress traffic.

apiVersion: gateway.networking.k8s.io/v1beta1# HTTPRoute routes HTTP requests to backend services.kind: HTTPRoutemetadata:  name: http-route-1  namespace: consulspec:  # Defines the gateway listener.  parentRefs:  - name: api-gateway  # Rules define behaviors for network traffic that goes through the route.  rules:  - matches:    - path:        type: PathPrefix        value: /    # Defines the backend service.    backendRefs:    - kind: Service      name: nginx      namespace: default      port: 80

Deploy Consul API Gateway

Next, deploy the API Gateway, wait for the API Gateway to completely deploy, deploy the routes and apply the intentions for the API Gateway.

$ kubectl apply --filename api-gw/consul-api-gateway.yaml --namespace consul && \kubectl wait --for=condition=accepted gateway/api-gateway --namespace consul --timeout=90s && \kubectl apply --filename api-gw/routes.yaml --namespace consul && \kubectl apply --filename api-gw/intentions.yaml --namespace consul

Expected output:

gateway.gateway.networking.k8s.io/api-gateway createdgateway.gateway.networking.k8s.io/api-gateway condition methttproute.gateway.networking.k8s.io/http-route-1 createdserviceintentions.consul.hashicorp.com/api-gateway created

Verify you have created all the pods in your consul namespace. You should find an output similar to the following.

$ kubectl get pods --namespace consul | grep "api-gateway"NAME                                             READY   STATUS    RESTARTS   AGEapi-gateway-6ddbd69979-bm5kq                     1/1     Running   0          64s

The diagram below shows the services running in your Kubernetes cluster. This includes Consul API Gateway, service mesh layer, and HashiCups microservice application pods.

Consul API Gateway enables ingress, load-balancing, and other advanced traffic behavior for your service mesh applications. In this tutorial, Consul API Gateway allows external traffic into the HashiCups service.

Review Consul API Gateway configuration

Now that you have enabled ingress features in your Consul service mesh, you can deploy the Consul API Gateway and associated HTTP Routes to your Kubernetes cluster. The Consul API Gateway uses HTTP Routes to route traffic to your applications.

Review the api-gw/consul-api-gateway.yaml configuration file. This file contains the configuration for the API Gateway pod, the listener, and TLS attributes.

apiVersion: gateway.networking.k8s.io/v1beta1# The Gateway is the main infrastructure resource that links API gateway components.kind: Gatewaymetadata:  name: api-gateway  namespace: consulspec:  gatewayClassName: consul  # Configures the listener that is bound to the gateway's address.  listeners:    # Defines the listener protocol (HTTP, HTTPS, or TCP)  - protocol: HTTP    port: 8080    name: http    allowedRoutes:      namespaces:        from: Same

Review the api-gw/routes.yaml configuration file. This file contains the configuration for HTTP routing including the network traffic rules and the backend service that will receive the ingress traffic.

apiVersion: gateway.networking.k8s.io/v1beta1# HTTPRoute routes HTTP requests to backend services.kind: HTTPRoutemetadata:  name: http-route-1  namespace: consulspec:  # Defines the gateway listener.  parentRefs:  - name: api-gateway  # Rules define behaviors for network traffic that goes through the route.  rules:  - matches:    - path:        type: PathPrefix        value: /    # Defines the backend service.    backendRefs:    - kind: Service      name: nginx      namespace: default      port: 80

Deploy Consul API Gateway

Next, deploy the API Gateway, wait for the API Gateway to completely deploy, deploy the routes and apply the intentions for the API Gateway.

$ kubectl apply --filename api-gw/consul-api-gateway.yaml --namespace consul && \kubectl wait --for=condition=accepted gateway/api-gateway --namespace consul --timeout=90s && \kubectl apply --filename api-gw/routes.yaml --namespace consul && \kubectl apply --filename api-gw/intentions.yaml --namespace consul

Expected output:

gateway.gateway.networking.k8s.io/api-gateway createdgateway.gateway.networking.k8s.io/api-gateway condition methttproute.gateway.networking.k8s.io/http-route-1 createdserviceintentions.consul.hashicorp.com/api-gateway created

Verify you have created all the pods in your consul namespace. You should find an output similar to the following.

$ kubectl get pods --namespace consul | grep "api-gateway"NAME                                             READY   STATUS    RESTARTS   AGEapi-gateway-6ddbd69979-bm5kq                     1/1     Running   0          64s

The diagram below shows the services running in your Kubernetes cluster. This includes Consul API Gateway, service mesh layer, and HashiCups microservice application pods.

Consul API Gateway enables ingress, load-balancing, and other advanced traffic behavior for your service mesh applications. In this tutorial, Consul API Gateway allows external traffic into the HashiCups service.

Review Consul API Gateway configuration

Now that you have enabled ingress features in your Consul service mesh, you can deploy the Consul API Gateway and associated HTTP Routes to your Kubernetes cluster. The Consul API Gateway uses HTTP Routes to route traffic to your applications.

Review the api-gw/consul-api-gateway.yaml configuration file. This file contains the configuration for the API Gateway pod, the listener, and TLS attributes.

apiVersion: gateway.networking.k8s.io/v1beta1# The Gateway is the main infrastructure resource that links API gateway components.kind: Gatewaymetadata: name: api-gateway namespace: consulspec: gatewayClassName: consul # Configures the listener that is bound to the gateway's address. listeners:   # Defines the listener protocol (HTTP, HTTPS, or TCP) - protocol: HTTPS   port: 8443   name: https   allowedRoutes:     namespaces:       from: Same   tls:     # Defines the certificate to use for the HTTPS listener.     certificateRefs:       - name: consul-server-cert

Review the api-gw/routes.yaml configuration file. This file contains the configuration for HTTP routing including the network traffic rules and the backend service that will receive the ingress traffic.

apiVersion: gateway.networking.k8s.io/v1beta1# HTTPRoute routes HTTP requests to backend services.kind: HTTPRoutemetadata: name: http-route-1 namespace: consulspec: # Defines the gateway listener. parentRefs: - name: api-gateway # Rules define behaviors for network traffic that goes through the route. rules: - matches:   - path:       type: PathPrefix       value: /   # Defines the backend service.   backendRefs:   - kind: Service     name: nginx     namespace: default     port: 80

Deploy Consul API Gateway

Next, deploy the API Gateway, wait for the API Gateway to completely deploy, deploy the routes and apply the intentions for the API Gateway.

$ kubectl apply --filename api-gw/consul-api-gateway.yaml --namespace consul && \kubectl wait --for=condition=accepted gateway/api-gateway --namespace consul --timeout=90s && \kubectl apply --filename api-gw/routes.yaml --namespace consul && \kubectl apply --filename api-gw/intentions.yaml --namespace consul

Expected output:

gateway.gateway.networking.k8s.io/api-gateway createdgateway.gateway.networking.k8s.io/api-gateway condition methttproute.gateway.networking.k8s.io/http-route-1 createdserviceintentions.consul.hashicorp.com/api-gateway created

Verify you have created all the pods in your consul namespace. You should find an output similar to the following.

$ kubectl get pods --namespace consul | grep "api-gateway"NAME                                             READY   STATUS    RESTARTS   AGEapi-gateway-6ddbd69979-bm5kq                     1/1     Running   0          64s

The diagram below shows the services running in your Kubernetes cluster. This includes Consul API Gateway, service mesh layer, and HashiCups microservice application pods.

Consul API Gateway enables ingress, load-balancing, and other advanced traffic behavior for your service mesh applications. In this tutorial, Consul API Gateway allows external traffic into the HashiCups service.

Now that Consul API Gateway is operational in your cluster, you will deploy role-based access control (RBAC) and Reference Grant resources. RBAC enables the Consul API gateway to interact with Consul datacenter resources and reference grants enable the Consul API Gateway to route traffic between different namespaces.

Deploy the RBAC and Reference Grant resources.

$ kubectl apply --filename hashicups/v2/clusterrolebinding.rbac.authorization.k8s.io/consul-api-gateway-tokenreview-binding createdclusterrole.rbac.authorization.k8s.io/consul-api-gateway-auth createdclusterrolebinding.rbac.authorization.k8s.io/consul-api-gateway-auth-binding createdclusterrolebinding.rbac.authorization.k8s.io/consul-auth-binding createdreferencegrant.gateway.networking.k8s.io/consul-reference-grant created

Now that Consul API Gateway is operational in your cluster, you will deploy role-based access control (RBAC) and Reference Grant resources. RBAC enables the Consul API gateway to interact with Consul datacenter resources and reference grants enable the Consul API Gateway to route traffic between different namespaces.

Deploy the RBAC and Reference Grant resources.

$ kubectl apply --filename hashicups/v2/clusterrolebinding.rbac.authorization.k8s.io/consul-api-gateway-tokenreview-binding createdclusterrole.rbac.authorization.k8s.io/consul-api-gateway-auth createdclusterrolebinding.rbac.authorization.k8s.io/consul-api-gateway-auth-binding createdclusterrolebinding.rbac.authorization.k8s.io/consul-auth-binding createdreferencegrant.gateway.networking.k8s.io/consul-reference-grant created

Now that Consul API Gateway is operational in your cluster, you will deploy role-based access control (RBAC) and Reference Grant resources. RBAC enables the Consul API gateway to interact with Consul datacenter resources and reference grants enable the Consul API Gateway to route traffic between different namespaces.

Deploy the RBAC and Reference Grant resources.

$ kubectl apply --filename hashicups/v2/clusterrolebinding.rbac.authorization.k8s.io/consul-api-gateway-tokenreview-binding createdclusterrole.rbac.authorization.k8s.io/consul-api-gateway-auth createdclusterrolebinding.rbac.authorization.k8s.io/consul-api-gateway-auth-binding createdclusterrolebinding.rbac.authorization.k8s.io/consul-auth-binding createdreferencegrant.gateway.networking.k8s.io/consul-reference-grant created

In this section, you will view your Consul services with the CLI, UI, and/or API to explore the details of your service mesh ingress.

$ consul catalog services | grep api-gatewayapi-gateway

$ consul intention listID  Source       Action  Destination     Precedence    api-gateway  allow   nginx           9    nginx        allow   frontend        9    nginx        allow   public-api      9    product-api  allow   product-api-db  9    public-api   allow   payments        9    public-api   allow   product-api     9

$ echo $CONSUL_HTTP_ADDRhttps://my-loadbalancer-1234567890.us-east-1.elb.amazonaws.com

$ echo $CONSUL_HTTP_TOKENfe0dd5c3-f2e1-81e8-cde8-49d26cee5efc

$ curl -k \    --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \    $CONSUL_HTTP_ADDR/v1/catalog/services

{"api-gateway":[],"consul":[],"frontend":[],"frontend-sidecar-proxy":[],"nginx":[],"nginx-sidecar-proxy":[],"payments":[],"payments-sidecar-proxy":[],"product-api":[],"product-api-db":[],"product-api-db-sidecar-proxy":[],"product-api-sidecar-proxy":[],"public-api":[],"public-api-sidecar-proxy":[]}

$ curl -k \    --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \    $CONSUL_HTTP_ADDR/v1/connect/intentions 

[{"Description":"Allow traffic from Consul API Gateway. Reconciled by controller at 2022-09-12T14:45:16Z.","SourceNS":"default","SourceName":"api-gateway","DestinationNS":"default","DestinationName":"nginx","SourceType":"consul","Action":"allow","Precedence":9,"CreateIndex":205,"ModifyIndex":205},{"SourceNS":"default","SourceName":"nginx","DestinationNS":"default","DestinationName":"frontend","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":256,"ModifyIndex":256},{"SourceNS":"default","SourceName":"nginx","DestinationNS":"default","DestinationName":"public-api","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":257,"ModifyIndex":257},{"SourceNS":"default","SourceName":"product-api","DestinationNS":"default","DestinationName":"product-api-db","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":259,"ModifyIndex":259},{"SourceNS":"default","SourceName":"public-api","DestinationNS":"default","DestinationName":"payments","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":260,"ModifyIndex":260},{"SourceNS":"default","SourceName":"public-api","DestinationNS":"default","DestinationName":"product-api","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":258,"ModifyIndex":258}]

In this section, you will view your Consul services with the CLI, UI, and/or API to explore the details of your service mesh ingress.

$ consul catalog services | grep api-gatewayapi-gateway

$ consul intention listID  Source       Action  Destination     Precedence    api-gateway  allow   nginx           9    nginx        allow   frontend        9    nginx        allow   public-api      9    product-api  allow   product-api-db  9    public-api   allow   payments        9    public-api   allow   product-api     9

$ echo $CONSUL_HTTP_ADDRhttps://24.122.12.125

$ echo $CONSUL_HTTP_TOKENfe0dd5c3-f2e1-81e8-cde8-49d26cee5efc

$ curl -k \    --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \    $CONSUL_HTTP_ADDR/v1/catalog/services

{"api-gateway":[],"consul":[],"frontend":[],"frontend-sidecar-proxy":[],"nginx":[],"nginx-sidecar-proxy":[],"payments":[],"payments-sidecar-proxy":[],"product-api":[],"product-api-db":[],"product-api-db-sidecar-proxy":[],"product-api-sidecar-proxy":[],"public-api":[],"public-api-sidecar-proxy":[]}

$ curl -k \    --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \    $CONSUL_HTTP_ADDR/v1/connect/intentions 

[{"Description":"Allow traffic from Consul API Gateway. Reconciled by controller at 2022-09-12T14:45:16Z.","SourceNS":"default","SourceName":"api-gateway","DestinationNS":"default","DestinationName":"nginx","SourceType":"consul","Action":"allow","Precedence":9,"CreateIndex":205,"ModifyIndex":205},{"SourceNS":"default","SourceName":"nginx","DestinationNS":"default","DestinationName":"frontend","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":256,"ModifyIndex":256},{"SourceNS":"default","SourceName":"nginx","DestinationNS":"default","DestinationName":"public-api","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":257,"ModifyIndex":257},{"SourceNS":"default","SourceName":"product-api","DestinationNS":"default","DestinationName":"product-api-db","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":259,"ModifyIndex":259},{"SourceNS":"default","SourceName":"public-api","DestinationNS":"default","DestinationName":"payments","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":260,"ModifyIndex":260},{"SourceNS":"default","SourceName":"public-api","DestinationNS":"default","DestinationName":"product-api","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":258,"ModifyIndex":258}]

In this section, you will view your Consul services with the CLI, UI, and/or API to explore the details of your service mesh ingress.

$ kubectl port-forward svc/consul-ui --namespace consul 8501:443

$ consul catalog services | grep api-gatewayapi-gateway

$ consul intention listID  Source       Action  Destination     Precedence    api-gateway  allow   nginx           9    nginx        allow   frontend        9    nginx        allow   public-api      9    product-api  allow   product-api-db  9    public-api   allow   payments        9    public-api   allow   product-api     9

$ kubectl port-forward svc/consul-ui --namespace consul 8501:443

$ kubectl port-forward svc/consul-ui --namespace consul 8501:443

$ curl -k \    --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \    $CONSUL_HTTP_ADDR/v1/catalog/services

{"api-gateway":[],"consul":[],"frontend":[],"frontend-sidecar-proxy":[],"nginx":[],"nginx-sidecar-proxy":[],"payments":[],"payments-sidecar-proxy":[],"product-api":[],"product-api-db":[],"product-api-db-sidecar-proxy":[],"product-api-sidecar-proxy":[],"public-api":[],"public-api-sidecar-proxy":[]}

$ curl -k \    --header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \    $CONSUL_HTTP_ADDR/v1/connect/intentions 

[{"Description":"Allow traffic from Consul API Gateway. Reconciled by controller at 2022-09-12T14:45:16Z.","SourceNS":"default","SourceName":"api-gateway","DestinationNS":"default","DestinationName":"nginx","SourceType":"consul","Action":"allow","Precedence":9,"CreateIndex":205,"ModifyIndex":205},{"SourceNS":"default","SourceName":"nginx","DestinationNS":"default","DestinationName":"frontend","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":256,"ModifyIndex":256},{"SourceNS":"default","SourceName":"nginx","DestinationNS":"default","DestinationName":"public-api","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":257,"ModifyIndex":257},{"SourceNS":"default","SourceName":"product-api","DestinationNS":"default","DestinationName":"product-api-db","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":259,"ModifyIndex":259},{"SourceNS":"default","SourceName":"public-api","DestinationNS":"default","DestinationName":"payments","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":260,"ModifyIndex":260},{"SourceNS":"default","SourceName":"public-api","DestinationNS":"default","DestinationName":"product-api","SourceType":"consul","Action":"allow","Meta":{"consul.hashicorp.com/source-datacenter":"dc1","external-source":"kubernetes"},"Precedence":9,"CreateIndex":258,"ModifyIndex":258}]

Set your Consul API Gateway address to the CONSUL_APIGW_ADDR environment variable.

$ export CONSUL_APIGW_ADDR=http://$(kubectl get svc/api-gateway --namespace consul -o json | jq -r '.status.loadBalancer.ingress[0].hostname'):8080

Output the Consul API Gateway value to your terminal and paste it in your browser to access the HashiCups UI through the API Gateway.

$ echo $CONSUL_APIGW_ADDRhttp://a46cc0cc9dc6841a4b1a0fa1771973ca-1032165333.us-west-2.elb.amazonaws.com:8080

For more information on accessing service mesh services via the Consul API Gateway, visit the Consul API Gateway documentation page.

Set your Consul API Gateway address to the CONSUL_APIGW_ADDR environment variable.

$ export CONSUL_APIGW_ADDR=http://$(kubectl get svc/api-gateway --namespace consul -o json | jq -r '.status.loadBalancer.ingress[0].ip'):8080

Output the Consul API Gateway value to your terminal and paste it in your browser to access the HashiCups UI through the API Gateway.

$ echo $CONSUL_APIGW_ADDRhttp://24.132.10.127:8080

For more information on accessing service mesh services via the Consul API Gateway, visit the Consul API Gateway documentation page.

Retrieve information on the api-gateway service.

$ kubectl get services api-gateway --namespace consulNAME          TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGEapi-gateway   NodePort   10.96.214.246   <none>        8443:31800/TCP   8m7s

In this local environment, API Gateway uses NodePort to let you access your application directly through the API Gateway without having to forward your Kubernetes cluster’s ports. In a cloud environment, API Gateway may use a LoadBalancer to automatically provision a publicly accessible DNS entry.

Access the HashiCups UI through the API Gateway by opening https://localhost:8443 in your browser.

For more information on accessing service mesh services via the Consul API Gateway, visit the Consul API Gateway documentation page.