Add http2 and grpc support to ingress gateways

[jackloughran]

While evaluating a Consul + Envoy request routing solution, I noticed ingress gateways don't support grpc (#8454). We were hoping to route grpc traffic though an ingress gateway during the first phase of our migration.

Out of curiosity, I tried adding grpc to the ingress gateway supported protocols map, and Consul was able to correctly configure the Envoy ingress gateway. From what I can tell, ingress gateways share a lot of code with sidecar proxies which already support grpc.

Could this work? Is there another reason why ingress gateways don't support grpc?

I'm happy to expand on our use case if that would help.

[jackloughran]

Any updates on this? Is there any more information I can give you?

@blake

[freddygv]

Hi @jackloughran, you are correct that grpc/http2 is supported for sidecar proxies.

The only reason why gRPC wasn't supported for ingress gateways initially is that it hasn't been tested. Have you tested sending gRPC traffic through the gateway with the changes in this PR?

[jackloughran]

@freddygv Yes, I tried this out, and I was able to successfully proxy grpc traffic on my computer with the changes in this PR.

[freddygv]

Great, so then I think the one thing missing here would be a new integration test for an Ingress gateways routing to a grpc service.

It would be a mix of:
https://github.com/hashicorp/consul/tree/master/test/integration/connect/envoy/case-grpc
and
https://github.com/hashicorp/consul/blob/master/test/integration/connect/envoy/case-ingress-gateway-simple

Here's some additional info on that:

• To run specific test cases you can do: env GOFLAGS="-run=TestEnvoy/case-grpc" make test-envoy-integ where case-grpc would be replaced with the case you want to run.
• When the test case directory is created, then it needs to be added to this function in order to run: https://github.com/hashicorp/consul/blob/master/test/integration/connect/envoy/main_test.go
• Relevant files to update after copying case-ingress-gateway-simple:
  • config_entries.hcl defines configuration entries to use during the test. You will need to update the gateway's config entry so that the protocol for s1 is grpc (rather than tcp)
  • verify.bats defines the assertions for the test. You will need to update the assertion for connectivity through the gateway to use grpcping like here rather than curl as it [currently does]

[jackloughran]

@freddygv Thanks so much for writing that out! It was really helpful. I added the integration test, and I added http2 to the list of supported protocols since grpc always uses http2.

https://github.com/hashicorp/consul/blob/master/test/integration/connect/envoy/case-grpc/verify.bats#L31

[freddygv]

Great, thanks @jackloughran! This looks good.

One last request: We recently moved to automating changelog entries, can you add a file like this one to ./changelog where the filename is the PR number?

https://github.com/hashicorp/consul/blob/master/.changelog/7628.txt

This would also be considered as an improvement, like 7628.

[jackloughran]

@freddygv Sure! Thanks again for all the help!

[freddygv]

Thanks you!

[hashicorp-ci]

🍒❌ Cherry pick of commit 9e1c672 onto release/1.8.x failed! Build Log

[freddygv]

I'll take care of fixing up this cherry-pick @jackloughran. You're all set here.