Exposing a gRPC service

Overview

This guide walks through deploying a simple Service that listens for gRPC connections and exposes this service outside of the cluster using Kong Gateway.

For this example, you will:

• Deploy a gRPC test application.
• Route gRPC traffic to it using Ingress or GRPCRoute.

Installation

Follow the deployment documentation to install the Kong Ingress Controller on the Kubernetes cluster.

Installing the Gateway APIs

If you wish to use the Gateway APIs examples, follow the supplemental Gateway APIs installation instructions.

Testing connectivity to Kong Gateway

Ensure that the PROXY_IP environment variable is set to contain the IP address or URL pointing to Kong Gateway. The deployment guide that you used to install the Kong Ingress Controller on the Kubernetes cluster provides the instructions to configure this environment variable.

If everything is set correctly, a request to Kong Gateway returns a HTTP 404 Not Found status code:

curl -i $PROXY_IP

The results should look like this:

HTTP/1.1 404 Not Found
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 48
X-Kong-Response-Latency: 0
Server: kong/3.0.0

{"message":"no Route matched with those values"}

This is expected because Kong Gateway doesn’t know how to proxy the request yet.

Create a configuration group

Ingress and Gateway APIs controllers need a configuration that indicates which set of routing configuration they should recognize. This allows multiple controllers to coexist in the same cluster. Before creating individual routes, you need to create a class configuration to associate routes with:

echo "
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: kong
spec:
  controller: ingress-controllers.konghq.com/kong
" | kubectl apply -f -

ingressclass.networking.k8s.io/kong configured

echo "
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: kong
  annotations:
    konghq.com/gatewayclass-unmanaged: 'true'

spec:
  controllerName: konghq.com/kic-gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
" | kubectl apply -f -

gatewayclass.gateway.networking.k8s.io/kong created
gateway.gateway.networking.k8s.io/kong created

kubectl get gateway kong

NAME   CLASS   ADDRESS        READY   AGE
kong   kong    203.0.113.42   True    4m46s

Kong Ingress Controller recognizes the kong IngressClass and konghq.com/kic-gateway-controller GatewayClass by default. Setting the CONTROLLER_INGRESS_CLASS or CONTROLLER_GATEWAY_API_CONTROLLER_NAME environment variable to another value overrides these defaults.

Prerequisite

To make gRPC requests, you need a client that can invoke gRPC requests. In this guide, we use grpcurl. Ensure that you have it installed on your local system.

Enable the GatewayAlpha feature gate

If you are using the Gateway API, you need to enable the GatewayAlpha feature gate in the Kong Ingress Controller.

Deploy a gRPC test application

Add a gRPC deployment and service:

echo "---
apiVersion: v1
kind: Service
metadata:
  name: grpcbin
  labels:
    app: grpcbin
spec:
  ports:
  - name: grpc
    port: 443
    targetPort: 9001
  selector:
    app: grpcbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grpcbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grpcbin
  template:
    metadata:
      labels:
        app: grpcbin
    spec:
      containers:
      - image: moul/grpcbin
        name: grpcbin
        ports:
        - containerPort: 9001
" | kubectl apply -f -        

Response:

deployment.apps/grpcbin created
service/grpcbin created

Route GRPC traffic

Now that the test application is running, you can create GRPC routing configuration that proxies traffic to the application:

echo "apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  rules:
  - http:
    paths:
    - path: /
      backend:
        serviceName: grpcbin
        servicePort: 443" | kubectl apply -f -

ingress.networking.k8s.io/demo created

echo "apiVersion: gateway.networking.k8s.io/v1alpha2
kind: GRPCRoute
metadata:
  name: grpcbin
spec:
  parentRefs:
  - name: kong
  hostnames:
  - example.com
  rules:
  - backendRefs:
    - name: grpcbin
      port: 443
" | kubectl apply -f -

grpcroute.gateway.networking.k8s.io/demo created

Update the Ingress rule

Next, if using the ingress, we need to update the Ingress rule to specify gRPC as the protocol. By default, all routes are assumed to be either HTTP or HTTPS. This annotation informs Kong that this route is a gRPC(s) route and not a plain HTTP route:

kubectl patch ingress demo -p '{"metadata":{"annotations":{"konghq.com/protocols":"grpc,grpcs"}}}'

We also need to update the upstream protocol to be grpcs. Similar to routes, Kong assumes that services are HTTP-based by default. With this annotation, we configure Kong to use gRPCs protocol when it talks to the upstream service:

kubectl patch svc grpcbin -p '{"metadata":{"annotations":{"konghq.com/protocol":"grpcs"}}}'

Test the configuration

First, retrieve the external IP address of the Kong proxy service:

export PROXY_IP="$(kubectl -n kong get service kong-proxy \
    -o=go-template='{{range .status.loadBalancer.ingress}}{{.ip}}{{end}}')"

After, use grpcurl to send a gRPC request through the proxy:

grpcurl -d '{"greeting": "Kong"}' -servername example.com -insecure $PROXY_IP:443 hello.HelloService.SayHello

{
  "reply": "hello Kong"
}