Skip to content

Commit

Permalink
docs: Fix Kubernetes CRD example configs (#18878)
Browse files Browse the repository at this point in the history
Fixes configuration examples for several Consul Kubernetes CRDs. The
CRDs were missing required fields such as `apiVersion`, `metadata`,
and `spec`.

Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>
  • Loading branch information
blake and im2nguyen committed Sep 19, 2023
1 parent 486d2f3 commit 53887b2
Show file tree
Hide file tree
Showing 4 changed files with 111 additions and 89 deletions.
134 changes: 70 additions & 64 deletions website/content/docs/connect/gateways/mesh-gateway/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,13 @@ Datacenters can reside in different clouds or runtime environments where general
Mesh gateways can be used with any of the following Consul configrations for managing separate datacenters or partitions.

1. WAN Federation
* [Mesh gateways can be used to route service-to-service traffic between datacenters](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters)
* [Mesh gateways can be used to route all WAN traffic, including from Consul servers](/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways)
* [Mesh gateways can be used to route service-to-service traffic between datacenters](/consul/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters)
* [Mesh gateways can be used to route all WAN traffic, including from Consul servers](/consul/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways)
2. Cluster Peering
* [Mesh gateways can be used to route service-to-service traffic between datacenters](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers)
* [Mesh gateways can be used to route control-plane traffic from Consul servers](/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways)
* [Mesh gateways can be used to route service-to-service traffic between datacenters](/consul/docs/connect/cluster-peering/usage/establish-cluster-peering)
* [Mesh gateways can be used to route control-plane traffic from Consul servers](/consul/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways)
3. Admin Partitions
* [Mesh gateways can be used to route service-to-service traffic between admin partitions in the same Consul datacenter](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-partitions)
* [Mesh gateways can be used to route service-to-service traffic between admin partitions in the same Consul datacenter](/consul/docs/connect/gateways/mesh-gateway/service-to-service-traffic-partitions)

### Consul

Expand Down Expand Up @@ -59,7 +59,7 @@ Depending on your network, the proxy's connection to the gateway can operate in

* `none` - No gateway is used and a service mesh connect proxy makes its outbound connections directly
to the destination services. This is the default for WAN federation. This setting is invalid for peered clusters
and will be treated as remote instead.
and will be treated as remote instead.

* `local` - The service mesh connect proxy makes an outbound connection to a gateway running in the
same datacenter. That gateway is responsible for ensuring that the data is forwarded to gateways in the destination datacenter.
Expand All @@ -84,21 +84,24 @@ Use the following example configurations to help you understand some of the comm

The following `proxy-defaults` configuration will enable gateways for all Connect services in the `local` mode.

<CodeTabs heading="Example: Enabling gateways globally.">
<CodeTabs heading="Example: Enabling gateways globally">

```hcl
Kind = "proxy-defaults"
Name = "global"
MeshGateway {
Mode = "local"
Mode = "local"
}
```

```yaml
Kind: proxy-defaults
MeshGateway:
- Mode: local
Name: global
apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
name: global
spec:
meshGateway:
mode: local
```
</CodeTabs>
Expand All @@ -112,15 +115,18 @@ The following `service-defaults` configuration will enable gateways for all Conn
Kind = "service-defaults"
Name = "web"
MeshGateway {
Mode = "local"
Mode = "local"
}
```

```yaml
Kind: service-defaults
MeshGateway:
- Mode: local
Name: web
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: web
spec:
meshGateway:
mode: local
```

</CodeTabs>
Expand All @@ -134,22 +140,22 @@ definition will enable gateways for the service instance in the `remote` mode.

```hcl
service {
name = "web-sidecar-proxy"
kind = "connect-proxy"
port = 8181
proxy {
destination_service_name = "web"
mesh_gateway {
mode = "remote"
name = "web-sidecar-proxy"
kind = "connect-proxy"
port = 8181
proxy {
destination_service_name = "web"
mesh_gateway {
mode = "remote"
}
upstreams = [
{
destination_name = "api"
datacenter = "secondary"
local_bind_port = 10000
}
upstreams = [
{
destination_name = "api"
datacenter = "secondary"
local_bind_port = 10000
}
]
}
]
}
}
# Or alternatively inline with the service definition:
Expand Down Expand Up @@ -201,38 +207,38 @@ The following service definition will enable gateways in the `local` mode for on

```hcl
service {
name = "web-sidecar-proxy"
kind = "connect-proxy"
port = 8181
proxy {
destination_service_name = "web"
upstreams = [
{
destination_name = "api"
destination_peer = "cluster-01"
local_bind_port = 10000
mesh_gateway {
mode = "remote"
}
},
{
destination_name = "db"
datacenter = "secondary"
local_bind_port = 10001
mesh_gateway {
mode = "local"
}
},
{
destination_name = "logging"
datacenter = "secondary"
local_bind_port = 10002
mesh_gateway {
mode = "none"
}
},
]
}
name = "web-sidecar-proxy"
kind = "connect-proxy"
port = 8181
proxy {
destination_service_name = "web"
upstreams = [
{
destination_name = "api"
destination_peer = "cluster-01"
local_bind_port = 10000
mesh_gateway {
mode = "remote"
}
},
{
destination_name = "db"
datacenter = "secondary"
local_bind_port = 10001
mesh_gateway {
mode = "local"
}
},
{
destination_name = "logging"
datacenter = "secondary"
local_bind_port = 10002
mesh_gateway {
mode = "none"
}
},
]
}
}
```
```yaml
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ For Consul Enterprise clusters, mesh gateways must be registered in the "default
<Tabs>
<Tab heading="Consul OSS">

In addition to the [ACL Configuration](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers#acl-configuration) necessary for service-to-service traffic, mesh gateways that route peering control plane traffic must be granted `peering:read` access to all peerings.
In addition to the [ACL Configuration](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers#acl-configuration) necessary for service-to-service traffic, mesh gateways that route peering control plane traffic must be granted `peering:read` access to all peerings.
This access allows the mesh gateway to list all peerings in a Consul cluster and generate unique routing per peered datacenter.

<CodeTabs heading="Example ACL rules for Mesh Gateway Peering Control Plane Traffic in Consul OSS">
Expand All @@ -80,7 +80,7 @@ peering = "read"

<Tab heading="Consul Enterprise">

In addition to the [ACL Configuration](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers#acl-configuration) necessary for service-to-service traffic, mesh gateways that route peering control plane traffic must be granted `peering:read` access to all peerings in all partitions.
In addition to the [ACL Configuration](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers#acl-configuration) necessary for service-to-service traffic, mesh gateways that route peering control plane traffic must be granted `peering:read` access to all peerings in all partitions.
This access allows the mesh gateway to list all peerings in a Consul cluster and generate unique routing per peered partition.

<CodeTabs heading="Example ACL rules for Mesh Gateway Peering Control Plane Traffic in Consul Enterprise">
Expand Down Expand Up @@ -108,7 +108,7 @@ partition_prefix "" {

### Modes

Connect proxy configuration [Modes](/docs/connect/gateways/mesh-gateway#connect-proxy-configuration#modes) are not applicable to peering control plane traffic.
Connect proxy configuration [Modes](/docs/connect/gateways/mesh-gateway#connect-proxy-configuration#modes) are not applicable to peering control plane traffic.
The flow of control plane traffic through the gateway is implied by the presence of a [Mesh config entry](/docs/connect/config-entries/mesh#peer-through-mesh-gateways) with `PeerThroughMeshGateways = true`.

<CodeTabs heading="Example: Enabling Peering Control Plane Traffic for Mesh Gateways">
Expand All @@ -121,13 +121,17 @@ Peering {
```

```yaml
Kind: mesh
Peeering:
PeerThroughMeshGateways: true
apiVersion: consul.hashicorp.com/v1alpha1
kind: Mesh
metadata:
name: mesh
spec:
peering:
peerThroughMeshGateways: true
```
</CodeTabs>
By setting this mesh config on a cluster before [creating a peering token](/docs/connect/cluster-peering/create-manage-peering#create-a-peering-token), inbound control plane traffic will be sent through the mesh gateway registered this cluster, also known the accepting cluster.
By setting this mesh config on a cluster before [creating a peering token](/docs/connect/cluster-peering/create-manage-peering#create-a-peering-token), inbound control plane traffic will be sent through the mesh gateway registered this cluster, also known the accepting cluster.
As mesh gateway instances are registered at the accepting cluster, their addresses will be exposed to the dialing cluster over the bi-directional peering stream.
Setting this mesh config on a cluster before [establishing a connection](/docs/connect/cluster-peering/create-manage-peering#establish-a-connection-between-clusters) will cause the outbound control plane traffic to flow through the mesh gateway.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ Use the following example configurations to help you understand some of the comm

The following `proxy-defaults` configuration will enable gateways for all Connect services in the `local` mode.

<CodeTabs heading="Example: Enabling gateways globally.">
<CodeTabs heading="Example: Enabling gateways globally">

```hcl
Kind = "proxy-defaults"
Expand All @@ -89,10 +89,13 @@ MeshGateway {
```

```yaml
Kind: proxy-defaults
MeshGateway:
- Mode: local
Name: global
apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
name: global
spec:
meshGateway:
mode: local
```
</CodeTabs>
Expand All @@ -112,10 +115,13 @@ MeshGateway {
```

```yaml
Kind: service-defaults
MeshGateway:
- Mode: local
Name: web
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: web
spec:
meshGateway:
mode: local
```
</CodeTabs>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ Use the following example configurations to help you understand some of the comm

The following `proxy-defaults` configuration will enable gateways for all Connect services in the `local` mode.

<CodeTabs heading="Example: Enabling gateways globally.">
<CodeTabs heading="Example: Enabling gateways globally">

```hcl
Kind = "proxy-defaults"
Expand All @@ -105,10 +105,13 @@ MeshGateway {
```

```yaml
Kind: proxy-defaults
MeshGateway:
- Mode: local
Name: global
apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
name: global
spec:
meshGateway:
mode: local
```
</CodeTabs>
Expand All @@ -127,10 +130,13 @@ MeshGateway {
```

```yaml
Kind: service-defaults
MeshGateway:
- Mode: local
Name: web
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: web
spec:
meshGateway:
mode: local
```

</CodeTabs>
Expand Down

0 comments on commit 53887b2

Please sign in to comment.