├── .gitignore ├── LICENSE ├── README.md ├── ambassador ├── admin-rbac.yaml ├── admin.yaml └── gke-crb.yaml ├── client └── main.go ├── demo-services ├── gs-deployment.yaml ├── gs-service.yaml ├── ping-deployment.yaml └── ping-service.yaml ├── img └── kruiser-arch.png ├── kubectl.go ├── main.go └── proxy.go /.gitignore: -------------------------------------------------------------------------------- 1 | # Binaries for programs and plugins 2 | *.exe 3 | *.dll 4 | *.so 5 | *.dylib 6 | 7 | # Test binary, build with `go test -c` 8 | *.test 9 | 10 | # Output of the go coverage tool, specifically when used with LiteIDE 11 | *.out 12 | 13 | # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736 14 | .glide/ 15 | .DS_Store 16 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Kruiser 2 | 3 | A proxy that transparently exposes gRPC Kubernetes services cluster-externally. 4 | 5 | Using [Ambassador](https://www.getambassador.io/) as gRPC proxy, `kruiser` 6 | watches deployment in a target namespace that are labelled with `grpc=expose`. When it finds such a deployment, it creates a corresponding service of type `NodePort` proxying traffic to its pods from outside the cluster. 7 | 8 | So far, I've tested `kruiser` on Minikube v0.24 with Kubernetes v1.8 and v1.9, as well as on GKE with Kubernetes v1.9 with and without RBAC. 9 | 10 | - [Use cases](#use-cases) 11 | - [UC1: inter-cluster within the enterprise](#uc1-inter-cluster-within-the-enterprise) 12 | - [UC2: public services](#uc2-public-services) 13 | - [Install](#install) 14 | - [Use](#use) 15 | - [Example gRPC demo services](#example-grpc-demo-services) 16 | - [Expose deployment](#expose-deployment) 17 | - [Walkthroughs](#walkthroughs) 18 | - [Minikube](#minikube) 19 | - [GKE](#gke) 20 | - [Cleanup](#cleanup) 21 | 22 | ## Use cases 23 | 24 | There are two main use cases: 25 | 26 | ### UC1: inter-cluster within the enterprise 27 | 28 | Imagine two or more clusters deployed within, say, a data center in an enterprise. In order for gRPC services to communicate across clusters, you need to proxy the traffic from one cluster to another. 29 | 30 | ### UC2: public services 31 | 32 | If you want to make your gRPC service publicly available, you need to somehow expose it, routing traffic from outside the cluster to the cluster-internal service. 33 | 34 | 35 | ## Install 36 | 37 | First, clone this repository with `git clone https://github.com/mhausenblas/kruiser.git && cd kruiser`. 38 | 39 | Creating a namespaces for related apps rather than dumping all into the `default` namespace is a good practice, so let's do that first: 40 | 41 | ```bash 42 | $ kubectl create namespace kruiser 43 | $ go install . 44 | ``` 45 | 46 | ## Use 47 | 48 | ### Example gRPC demo services 49 | 50 | The two example gRPC [demo services](demo-services/) used below are: 51 | 52 | - A simple echo service [yages.Echo](https://github.com/mhausenblas/yages/blob/master/main.go) available via `quay.io/mhausenblas/yages:0.1.0` 53 | - The reference [helloworld.Greeter](https://github.com/grpc/grpc-go/blob/master/examples/helloworld/greeter_server/main.go) available via `quay.io/mhausenblas/grpc-gs:0.2` 54 | 55 | As a generic gRPC client we use [fullstorydev/grpcurl](https://github.com/fullstorydev/grpcurl) which you can either install locally, if you have Go installed, or as a container via the [quay.io/mhausenblas/gump:0.1](https://quay.io/repository/mhausenblas/gump?tag=0.1&tab=tags) container image. 56 | 57 | ### Expose deployment 58 | 59 | To expose a deployment, that is, creating an Ambassador-backed service proxying traffic to its pods from outside the cluster with `kruiser` you have to do two things: 1. define the gRPC service semantics, and 2. enable/disable the proxying. 60 | 61 | Define the gRPC service semantics on the deployment you want to expose like so: 62 | 63 | ```bash 64 | $ kubectl -n kruiser annotate deploy/ping kruiser.kubernetes.sh/container-port='9000' 65 | $ kubectl -n kruiser annotate deploy/ping kruiser.kubernetes.sh/fq-service-name='yages.Echo' 66 | ``` 67 | 68 | And now, in order to trigger the service proxy to be created, label the deployment with `kruiser.kubernetes.sh/grpc=expose`, for example: 69 | 70 | ```bash 71 | $ kubectl -n kruiser label deploy/ping kruiser.kubernetes.sh/grpc=expose 72 | ``` 73 | 74 | Note: use `kubectl -n kruiser label deploy/ping kruiser.kubernetes.sh/grpc-` to remove the label again. 75 | 76 | ### Walkthroughs 77 | 78 | In the following, I'll walk you through how you can use `kruiser` in a static manner, that is, manually exposing gRPC services cluster-externally. Along the way I explain how `kruiser` works. 79 | 80 | 81 | ```bash 82 | $ kubectl create namespace kruiser 83 | ``` 84 | 85 | #### Minikube 86 | 87 | First, install Ambassador with: 88 | 89 | ```bash 90 | $ kubectl -n kruiser apply -f ambassador/admin.yaml 91 | ``` 92 | 93 | Next, deploy the two gRPC demo services: 94 | 95 | ```bash 96 | $ kubectl -n kruiser apply -f demo-services/ 97 | ``` 98 | 99 | Now you can invoke each of the gRPC demo services from outside Minikube like so: 100 | 101 | ```bash 102 | $ grpcurl --plaintext $(minikube ip):31001 yages.Echo.Ping 103 | 104 | $ grpcurl --plaintext -d '{ "name" : "Michael" }' $(minikube ip):31000 helloworld.Greeter.SayHello 105 | ``` 106 | 107 | Alternatively, you can access one of the gRPC services via the gRPC jump pod like so: 108 | 109 | ```bash 110 | $ kubectl -n kruiser run -it --rm gumpod \ 111 | --restart=Never --image=quay.io/mhausenblas/gump:0.1 112 | 113 | /go $ grpcurl --plaintext ping:9000 yages.Echo.Ping 114 | ``` 115 | 116 | #### GKE 117 | 118 | Note that the GKE deployment in the following uses RBAC for access control. 119 | 120 | As a preparation, you need to give your user certain rights. 121 | 122 | ```bash 123 | $ cat ambassador/gke-crb.yaml | \ 124 | sed s/__USER__/$(gcloud projects get-iam-policy $(gcloud config get-value core/project) | grep -m 1 user | awk '{split($0,u,":"); print u[2]}')/g | \ 125 | kubectl -n kruiser apply -f - 126 | ``` 127 | 128 | Above, we replace the `__USER__` placeholder in `ambassador/gke-crb.yaml` with the value of the user name of the active GKE project before creating the respective cluster-role binding. 129 | 130 | Next, install Ambassador with: 131 | 132 | ```bash 133 | $ kubectl -n kruiser apply -f ambassador/admin-rbac.yaml 134 | ``` 135 | 136 | And now deploy the two gRPC demo services: 137 | 138 | ```bash 139 | $ kubectl -n kruiser apply -f demo-services/ 140 | ``` 141 | 142 | To be able to access the services from outside the GKE cluster we first have to find values for external IPs of cluster nodes (store them for example in an env var `NODE_IP`): 143 | 144 | ```bash 145 | $ kubectl get nodes --selector=kubernetes.io/role!=master \ 146 | -o jsonpath={.items[*].status.addresses[?\(@.type==\"ExternalIP\"\)].address} 147 | ``` 148 | 149 | Now, finally, you can invoke each of the gRPC demo services from outside the GKE cluster like so: 150 | 151 | ```bash 152 | $ grpcurl --plaintext $(NODE_IP):31001 yages.Echo.Ping 153 | 154 | $ grpcurl --plaintext -d '{ "name" : "Michael" }' $(NODE_IP):31000 helloworld.Greeter.SayHello 155 | ``` 156 | 157 | #### Cleanup 158 | 159 | When done, clean up with: 160 | 161 | ```bash 162 | $ kubectl delete ns kruiser 163 | ``` 164 | -------------------------------------------------------------------------------- /ambassador/admin-rbac.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: v1 3 | kind: ServiceAccount 4 | metadata: 5 | name: ambassador 6 | namespace: kruiser 7 | --- 8 | apiVersion: rbac.authorization.k8s.io/v1beta1 9 | kind: ClusterRole 10 | metadata: 11 | name: ambassador 12 | rules: 13 | - apiGroups: [""] 14 | resources: 15 | - services 16 | verbs: ["get", "list", "watch"] 17 | - apiGroups: [""] 18 | resources: 19 | - configmaps 20 | verbs: ["create", "update", "patch", "get", "list", "watch"] 21 | - apiGroups: [""] 22 | resources: 23 | - secrets 24 | verbs: ["get", "list", "watch"] 25 | --- 26 | apiVersion: rbac.authorization.k8s.io/v1beta1 27 | kind: ClusterRoleBinding 28 | metadata: 29 | name: ambassador 30 | roleRef: 31 | apiGroup: rbac.authorization.k8s.io 32 | kind: ClusterRole 33 | name: ambassador 34 | subjects: 35 | - kind: ServiceAccount 36 | name: ambassador 37 | namespace: kruiser 38 | --- 39 | apiVersion: extensions/v1beta1 40 | kind: Deployment 41 | metadata: 42 | name: ambassador 43 | namespace: kruiser 44 | spec: 45 | replicas: 1 46 | template: 47 | metadata: 48 | annotations: 49 | sidecar.istio.io/inject: "false" 50 | labels: 51 | service: ambassador 52 | spec: 53 | serviceAccountName: ambassador 54 | containers: 55 | - name: ambassador 56 | image: quay.io/datawire/ambassador:0.30.2 57 | resources: 58 | limits: 59 | cpu: 1 60 | memory: 400Mi 61 | requests: 62 | cpu: 200m 63 | memory: 100Mi 64 | env: 65 | - name: AMBASSADOR_NAMESPACE 66 | valueFrom: 67 | fieldRef: 68 | fieldPath: metadata.namespace 69 | livenessProbe: 70 | httpGet: 71 | path: /ambassador/v0/check_alive 72 | port: 8877 73 | initialDelaySeconds: 30 74 | periodSeconds: 3 75 | readinessProbe: 76 | httpGet: 77 | path: /ambassador/v0/check_ready 78 | port: 8877 79 | initialDelaySeconds: 30 80 | periodSeconds: 3 81 | - name: statsd 82 | image: quay.io/datawire/statsd:0.30.2 83 | restartPolicy: Always 84 | --- 85 | apiVersion: v1 86 | kind: Service 87 | metadata: 88 | labels: 89 | service: ambassador-admin 90 | name: ambassador-admin 91 | spec: 92 | type: NodePort 93 | ports: 94 | - name: ambassador-admin 95 | port: 8877 96 | targetPort: 8877 97 | selector: 98 | service: ambassador -------------------------------------------------------------------------------- /ambassador/admin.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: v1 3 | kind: Service 4 | metadata: 5 | labels: 6 | service: ambassador-admin 7 | name: ambassador-admin 8 | spec: 9 | type: NodePort 10 | ports: 11 | - name: ambassador-admin 12 | port: 8877 13 | targetPort: 8877 14 | selector: 15 | service: ambassador 16 | --- 17 | apiVersion: extensions/v1beta1 18 | kind: Deployment 19 | metadata: 20 | name: ambassador 21 | spec: 22 | replicas: 1 23 | template: 24 | metadata: 25 | annotations: 26 | sidecar.istio.io/inject: "false" 27 | labels: 28 | service: ambassador 29 | spec: 30 | containers: 31 | - name: ambassador 32 | image: quay.io/datawire/ambassador:0.30.2 33 | resources: 34 | limits: 35 | cpu: 1 36 | memory: 400Mi 37 | requests: 38 | cpu: 200m 39 | memory: 100Mi 40 | env: 41 | - name: AMBASSADOR_NAMESPACE 42 | valueFrom: 43 | fieldRef: 44 | fieldPath: metadata.namespace 45 | livenessProbe: 46 | httpGet: 47 | path: /ambassador/v0/check_alive 48 | port: 8877 49 | initialDelaySeconds: 30 50 | periodSeconds: 3 51 | readinessProbe: 52 | httpGet: 53 | path: /ambassador/v0/check_ready 54 | port: 8877 55 | initialDelaySeconds: 30 56 | periodSeconds: 3 57 | - name: statsd 58 | image: quay.io/datawire/statsd:0.30.2 59 | restartPolicy: Always 60 | -------------------------------------------------------------------------------- /ambassador/gke-crb.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1beta1 2 | kind: ClusterRoleBinding 3 | metadata: 4 | name: makesmeclusteradmin 5 | roleRef: 6 | apiGroup: rbac.authorization.k8s.io 7 | kind: ClusterRole 8 | name: cluster-admin 9 | subjects: 10 | - apiGroup: rbac.authorization.k8s.io 11 | kind: User 12 | name: __USER__ 13 | namespace: kruiser -------------------------------------------------------------------------------- /client/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "context" 5 | "flag" 6 | "log" 7 | "time" 8 | 9 | "github.com/mhausenblas/yages/yages" 10 | "google.golang.org/grpc" 11 | ) 12 | 13 | func main() { 14 | serverAddr := flag.String("svc", "127.0.0.1:9000", "YAGES service address") 15 | flag.Parse() 16 | conn, err := grpc.Dial(*serverAddr, grpc.WithInsecure()) 17 | if err != nil { 18 | log.Fatal(err) 19 | } 20 | defer conn.Close() 21 | 22 | c := yages.NewEchoClient(conn) 23 | ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second) 24 | res, err := c.Ping(ctx, &yages.Empty{}) 25 | if err != nil { 26 | log.Fatal(err) 27 | } 28 | cancel() 29 | log.Println(res.Text) 30 | } 31 | -------------------------------------------------------------------------------- /demo-services/gs-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1beta1 2 | kind: Deployment 3 | metadata: 4 | name: gs 5 | spec: 6 | replicas: 1 7 | template: 8 | metadata: 9 | labels: 10 | app: gs 11 | spec: 12 | containers: 13 | - name: ping 14 | image: quay.io/mhausenblas/grpc-gs:0.2 15 | ports: 16 | - containerPort: 50051 17 | protocol: TCP 18 | -------------------------------------------------------------------------------- /demo-services/gs-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: gs 5 | annotations: 6 | getambassador.io/config: | 7 | --- 8 | apiVersion: ambassador/v0 9 | kind: Mapping 10 | name: map-gs 11 | grpc: true 12 | prefix: /helloworld.Greeter/ 13 | rewrite: /helloworld.Greeter/ 14 | service: gs:9001 15 | spec: 16 | type: NodePort 17 | ports: 18 | - nodePort: 31000 19 | port: 9001 20 | targetPort: 50051 21 | selector: 22 | app: gs 23 | -------------------------------------------------------------------------------- /demo-services/ping-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1beta1 2 | kind: Deployment 3 | metadata: 4 | name: ping 5 | spec: 6 | replicas: 1 7 | template: 8 | metadata: 9 | labels: 10 | app: ping 11 | spec: 12 | containers: 13 | - name: ping 14 | image: quay.io/mhausenblas/yages:0.1.0 15 | ports: 16 | - containerPort: 9000 17 | protocol: TCP -------------------------------------------------------------------------------- /demo-services/ping-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: ping 5 | annotations: 6 | getambassador.io/config: | 7 | --- 8 | apiVersion: ambassador/v0 9 | kind: Mapping 10 | name: map-ping 11 | grpc: true 12 | prefix: /yages.Echo/ 13 | rewrite: /yages.Echo/ 14 | service: ping:9000 15 | spec: 16 | type: NodePort 17 | ports: 18 | - nodePort: 31001 19 | port: 9000 20 | targetPort: 9000 21 | selector: 22 | app: ping -------------------------------------------------------------------------------- /img/kruiser-arch.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mhausenblas/kruiser/dd05ea8b0ff0c1760a141b38bada97c5a72595d8/img/kruiser-arch.png -------------------------------------------------------------------------------- /kubectl.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "bytes" 5 | "fmt" 6 | "os" 7 | "os/exec" 8 | "strings" 9 | ) 10 | 11 | func kubectl(withstderr bool, cmd string, args ...string) (string, error) { 12 | kubectlbin, err := shellout(withstderr, "which", "kubectl") 13 | if err != nil { 14 | return "", err 15 | } 16 | all := append([]string{cmd}, args...) 17 | result, err := shellout(withstderr, kubectlbin, all...) 18 | if err != nil { 19 | return "", err 20 | } 21 | return result, nil 22 | } 23 | 24 | func shellout(withstderr bool, cmd string, args ...string) (string, error) { 25 | result := "" 26 | var out bytes.Buffer 27 | c := exec.Command(cmd, args...) 28 | c.Env = os.Environ() 29 | if withstderr { 30 | c.Stderr = os.Stderr 31 | } 32 | c.Stdout = &out 33 | if debug { 34 | fmt.Println(append([]string{cmd}, args...)) 35 | } 36 | err := c.Run() 37 | if err != nil { 38 | return result, err 39 | } 40 | result = strings.TrimSpace(out.String()) 41 | return result, nil 42 | } 43 | -------------------------------------------------------------------------------- /main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "bytes" 5 | "fmt" 6 | "html/template" 7 | "io/ioutil" 8 | "os" 9 | "strings" 10 | "time" 11 | ) 12 | 13 | var ( 14 | debug = false 15 | // if KRUISER_TARGET_NAMESPACE not set, watch default namespace: 16 | targetns = "default" 17 | // if KRUISER_TARGET_LABEL not set, watch for label grpc=expose: 18 | targetlabel = "kruiser.kubernetes.sh/grpc=expose" 19 | // checking for gRPC services every 5 sec: 20 | wdelay = time.Duration(5) * time.Second 21 | ) 22 | 23 | func init() { 24 | if d := os.Getenv("KRUISER_DEBUG"); d != "" { 25 | debug = true 26 | } 27 | if tns := os.Getenv("KRUISER_TARGET_NAMESPACE"); tns != "" { 28 | targetns = tns 29 | } 30 | if tl := os.Getenv("KRUISER_TARGET_LABEL"); tl != "" { 31 | targetlabel = tl 32 | } 33 | } 34 | 35 | func main() { 36 | fmt.Printf("This is kruiser watching namespace %v for deployments labelled with %v so that I can publish services to proxy gRPC traffic\n", targetns, targetlabel) 37 | for { 38 | deploys, err := find(targetns, targetlabel) 39 | if err != nil { 40 | fmt.Errorf("Can't list deployments in namespace %v due to %v\n", targetns, err) 41 | } 42 | switch { 43 | case deploys[0] == "": 44 | fmt.Printf("Didn't find any deployments to proxy\n") 45 | default: 46 | fmt.Printf("Found deployments %v to create gRPC proxies for\n", deploys) 47 | err = proxy(targetns, deploys) 48 | if err != nil { 49 | fmt.Errorf("Can't create gRPC proxies due to %v\n", err) 50 | } 51 | } 52 | time.Sleep(wdelay) 53 | } 54 | } 55 | 56 | // proxy takes a list of deployment names 57 | // and creates an Ambassador-backed service 58 | // for each that proxies traffic to its pods. 59 | func proxy(namespace string, deploys []string) error { 60 | // 1. create proxy services 61 | type gRPCService struct { 62 | Name string 63 | FQServiceName string 64 | Port string 65 | } 66 | svcs := bytes.NewBufferString("") 67 | for _, deploy := range deploys { 68 | cport, fqsvcname, err := getconf(namespace, deploy) 69 | if err != nil { 70 | return err 71 | } 72 | s := gRPCService{ 73 | deploy, 74 | fqsvcname, 75 | cport, 76 | } 77 | tmpl, err := template.New("service").Parse(proxy_template) 78 | if err != nil { 79 | return err 80 | } 81 | err = tmpl.Execute(svcs, s) 82 | if err != nil { 83 | return err 84 | } 85 | } 86 | 87 | // 2. write out to tmp file: 88 | tmpfile, err := ioutil.TempFile("", "kruiser") 89 | if err != nil { 90 | return err 91 | } 92 | // defer os.Remove(tmpfile.Name()) 93 | _, err = tmpfile.Write(svcs.Bytes()) 94 | if err != nil { 95 | return err 96 | } 97 | err = tmpfile.Close() 98 | if err != nil { 99 | return err 100 | } 101 | fmt.Printf("%v", svcs.String()) 102 | 103 | // 3. apply tmp file containing service proxies: 104 | res, err := kubectl(true, "apply", 105 | "--namespace="+namespace, 106 | "-f="+tmpfile.Name()) 107 | if err != nil { 108 | return err 109 | } 110 | fmt.Printf("%v", res) 111 | return nil 112 | } 113 | 114 | // find queries the given Kubernetes namespace 115 | // for deployments with the given label and 116 | // returns a list of matching deployment names. 117 | func find(namespace, label string) ([]string, error) { 118 | var res []string 119 | deploys, err := kubectl(true, "get", 120 | "--namespace="+namespace, "deploy", 121 | "--selector="+label, 122 | "-o=custom-columns=:metadata.name", 123 | "--no-headers") 124 | if err != nil { 125 | return res, err 126 | } 127 | // fmt.Printf("RAW: [%v] \n", deploys) 128 | res = strings.Split(deploys, "\n") 129 | return res, nil 130 | } 131 | 132 | // getconf queries the annotation of a deployment 133 | // to get the container port and the fully qualified 134 | // service name in the form package.Service 135 | func getconf(namespace, deploy string) (cport, fqsvcname string, err error) { 136 | annotations, err := kubectl(true, "get", 137 | "--namespace="+namespace, "deploy/"+deploy, 138 | "-o=custom-columns=:metadata.annotations", 139 | "--no-headers") 140 | if err != nil { 141 | return "", "", err 142 | } 143 | arows := strings.TrimPrefix(annotations, "map[") 144 | arows = strings.TrimSuffix(arows, "]") 145 | alist := strings.Split(arows, " ") 146 | for _, annotation := range alist { 147 | if strings.HasPrefix(annotation, "kruiser.kubernetes.sh/container-port") { 148 | cport = strings.Split(annotation, ":")[1] 149 | } 150 | if strings.HasPrefix(annotation, "kruiser.kubernetes.sh/fq-service-name") { 151 | fqsvcname = strings.Split(annotation, ":")[1] 152 | } 153 | } 154 | return cport, fqsvcname, nil 155 | } 156 | -------------------------------------------------------------------------------- /proxy.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | var proxy_template = `--- 4 | apiVersion: v1 5 | kind: Service 6 | metadata: 7 | name: {{.Name}} 8 | annotations: 9 | getambassador.io/config: | 10 | --- 11 | apiVersion: ambassador/v0 12 | kind: Mapping 13 | name: map-{{.Name}} 14 | grpc: true 15 | prefix: /{{.FQServiceName}}/ 16 | rewrite: /{{.FQServiceName}}/ 17 | service: {{.Name}}:{{.Port}} 18 | spec: 19 | type: NodePort 20 | ports: 21 | - port: {{.Port}} 22 | targetPort: {{.Port}} 23 | selector: 24 | app: {{.Name}} 25 | ` 26 | --------------------------------------------------------------------------------