To implement cross-zone communication when Kong Mesh is deployed in a
mode, there is a new proxy type
These proxies are not attached to any particular workload. Instead, they are bound to that particular zone.
Zone Ingress can proxy the traffic between all meshes, so we need only one deployment in each zone.
All requests that are sent from one zone to another will be directed to the proper instance by the Zone Ingress.
ZoneIngress uses Service Name Indication (SNI) to route traffic, mTLS is required to do cross zone communication.
ZoneIngress entity includes a few sections:
type: must be
name: this is the name of the Zone Ingress instance, and it must be unique for any given
networking: contains networking parameters of the Zone Ingress
address: the address of the network interface Zone Ingress is listening on. Could be the address of either
public or private network interface, but the latter must be used with a load balancer.
port: is a port that Zone Ingress is listening on default to 10001
advertisedAddress: an IP address or hostname which will be used to communicate with the Zone Ingress. Zone Ingress
doesn’t listen on this address. If Zone Ingress is exposed using a load balancer, then the address of the load balancer
should be used here. If Zone Ingress is listening on the public network interface, then the address of the public network
interface should be used here.
advertisedPort: a port which will be used to communicate with the Zone Ingress. Zone Ingress doesn’t listen on this port.
admin: determines parameters related to Envoy Admin API
port: the port that Envoy Admin API will listen to
availableServices [auto-generated on Kong Mesh CP] : the list of services that could be consumed through the Zone Ingress
zone [auto-generated on Kong Mesh CP] : zone where Zone Ingress is running
Zone Ingress without
advertisedPort is not taken into account when generating Envoy configuration, because they cannot be accessed by data plane proxies from other zones.
ZoneIngress deployment can be scaled horizontally. Many instances can have the same advertised address and advertised port because they can be put behind one load balancer.