multicluster: Use the proxy as an HTTP gateway#4528
Merged
Conversation
The proxy can now operate as gateway, routing requests from its inbound proxy to the outbound proxy, without passing the requests to a local application. This supports Linkerd's multicluster feature by adding a `Forwarded` header to propagate the original client identity and assist in loop detection. --- * Add loop detection to inbound & TCP forwarding (linkerd/linkerd2-proxy#527) * Test loop detection (linkerd/linkerd2-proxy#532) * fallback: Unwrap errors recursively (linkerd/linkerd2-proxy#534) * app: Split inbound/outbound constructors into components (linkerd/linkerd2-proxy#533) * Introduce a gateway between inbound and outbound (linkerd/linkerd2-proxy#540) * gateway: Add a Forwarded header (linkerd/linkerd2-proxy#544) * gateway: Return errors instead of responses (linkerd/linkerd2-proxy#547) * Fail requests that loop through the gateway (linkerd/linkerd2-proxy#545)
This change introduces a new annotation, config.linkerd.io/enable-gateway, that, when set, enables the proxy to act as a gateway, routing all traffic targetting the inbound listener through the outbound proxy. This also removes the nginx default listener and gateway port of 4180, instead using 4143 (the inbound port).
Member
|
I verified that works with the k3d script |
Member
|
Note that the merge brought the |
Member
|
For anyone who wants to test this, I have verified it works with this branch olix0r/l2-k3d-multi#2 |
adleong
reviewed
Jun 2, 2020
| - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR | ||
| value: 0.0.0.0:{{.Values.global.proxy.ports.inbound}} | ||
| {{ if .Values.global.proxy.isGateway -}} | ||
| - name: LINKERD2_PROXY_INBOUND_GATEWAY_SUFFIXES |
Member
There was a problem hiding this comment.
What are the semantics of this variable? When set, any requests to the inbound listener that match this suffix will be routed directly to the outbound proxy?
Member
Author
There was a problem hiding this comment.
Correct. (After DNS resolution)
adleong
approved these changes
Jun 2, 2020
adleong
approved these changes
Jun 2, 2020
Member
|
For some reason I can't get this to work with the l2-k3d-multi setup... |
This change modifies the inbound gateway caching so that requests may be routed to multiple leaves of a traffic split. --- * inbound: Do not cache gateway services (linkerd/linkerd2-proxy#549)
Member
Author
|
OK. I've tested this with https://github.com/olix0r/l2-k3d-multi and it works as I'd expect with regard to loop detection and traffic split updating. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change introduces a new annotation,
config.linkerd.io/enable-gateway, that, when set, enables the proxy to
act as a gateway, routing all traffic targetting the inbound listener
through the outbound proxy.
This also removes the nginx default listener and gateway port of 4180,
instead using 4143 (the inbound port).
This includes an update to the proxy version v2.99.0.
The proxy can now operate as gateway, routing requests from its inbound
proxy to the outbound proxy, without passing the requests to a local
application. This supports Linkerd's multicluster feature by adding a
Forwardedheader to propagate the original client identity and assistin loop detection.