Consul-helm: Ingress Gateway Listeners Configuration

[berkaybayraktar]

Is there any way to provide listeners configuration to ingress gateway via helm chart ?

For example, I want to use following listener configuration for the ingress gateway. But, I couldn't find a way to set this configuration.

{
  "kind": "ingress-gateway",
  "name": "ingress-gateway",
  "listeners": {
    "port": 8080,
    "protocol": "http",
    "services": [
      {
        "name": "some-service-name"
      }
    ]
  }
}

I know that I can set this configuration by using consul config write command.

[blake]

Hi @berkaybayraktar,

You may use ingressGateways.defaults.service.ports to specify the list of ports which should be exposed from the ingress gateway container. Here's an example.

ingressGateways:
  enabled: true
  defaults:
    service:
      type: LoadBalancer
      ports:
        - port: 80
        - port: 443
        - port: 8080

The ports defined here are not automatically synced to the ingress-gateway config entry. You will need to also set the configuration you provided so that Envoy listens on the specified port(s).

[ishustava]

Hey @berkaybayraktar

Thanks for the issue! To add to what Blake said, currently, the Helm chart helps you with the installation of the Ingress Gateway, but not with the configuration. The configuration has to be done via the CLI command that you have mentioned.

We are working on developing Custom Resource Definitions for Consul's config entries, and so hopefully that will improve the configuration of the gateways going forward.

Hope this helps!

[berkaybayraktar]

Thank you for the info. Also, I know this is not the right place but, I couldn't manage to set this configuration via config maps. I tried to add this config in bootstrap / config_entries section of consul-server-config as the default proxy config. Right after the consul server starts, I can list the ingress-gateway configuration with consul config list -kind ingress-gateway command but, somehow, it dissapears after for a while and ingress gateway can not be configured via this method. Fyi.

Have a good day.

You may close this issue.

[ishustava]

That's interesting @berkaybayraktar, thanks for letting us know. I haven't tried configuring it via the bootstrap property. Let me try it and let you know.

[ishustava]

I've tried it out, and it worked!

Important note on using config_entries.bootstrap is that this will work only on-create, and so if you need to update the gateway config, you could no longer do it through the bootstrap property and would have to use the CLI. If you try and update it through the config, it won't do anything once a config entry with this name already exists.

Here is the Helm config I used:

server:
  extraConfig: |
    {
      "config_entries": {
        "bootstrap": [
        {
          "kind": "service-defaults",
          "name": "static-server",
          "protocol": "http"
        },
        {
          "kind": "ingress-gateway",
          "name": "ingress-gateway",
          "listeners": {
            "port": 8080,
            "protocol": "http",
            "services": [
            {
              "name": "static-server"
            }
            ]
          }
        }
        ]
      }
    }
connectInject:
  enabled: true
ingressGateways:
  enabled: true
  defaults:
    service:
      type: LoadBalancer

Note that my service name is called static-server, and you would just need to replace it with whatever is the name of your service.

For completeness, my static-server looks like this:

$ cat static-server.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: static-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: static-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: static-server
  template:
    metadata:
      name: static-server
      labels:
        app: static-server
      annotations:
        "consul.hashicorp.com/connect-inject": "true"
    spec:
      containers:
        # This name will be the service name in Consul.
        - name: static-server
          image: ishustava/http-echo:latest
          command:
          - "/bin/sh"
          - "-ec"
          - |
            /http-echo -listen=:8080 -text="hello world"
          ports:
            - containerPort: 8080
              name: http
       # If ACLs are enabled, the serviceAccountName must match the Consul service name.
      serviceAccountName: static-server

And I tried to connect to it like so:

curl -vvv -H "Host: static-server.ingress.consul" <ingress gateway load balancer IP>:8080

[ishustava]

I'm going to close this issue for now but please let us know if you're still seeing problems!