Support exposing multiple ports with transparent_proxy
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Proposal
It's a common usecase that applications exposes more then one port. ( Management, rest-api, grpc-api and so on)
The docu of transparent_proxy says `You can only have a single connect block in any task group that uses transparent proxy.`
Lets assume we have two services that exposes ports 5000 and 5001. Both shoul talk to each other over transparent_proxy.
My understanding of the current implementation is that is not possible with the current version of nomad (1.8.0).
So both of the services must handle with upstream configs. right?
Example job definition .
```hcl
job "connect_test" {
# curl -X GET http://app2-api1.virtual.consul
group "app1" {
count = 1
network {
mode = "bridge"
port "api1" {
to = 5000
}
port "api2" {
to = 5001
}
}
service {
name = "app1-api1"
port = "5000"
connect {
sidecar_service {
proxy {
transparent_proxy {
# exclude_outbound_ports = [5001]
# exclude_inbound_ports = ["5001"]
}
}
}
}
}
service {
name = "app1-api2"
port = "5001"
#How to expose this over transparent_proxy ??
}
task "app1" {
driver = "docker"
config {
image = "suikast42/nettools:latest"
ports = ["api1", "api2"]
# entrypoint = ["tail", "-f", "/dev/null"]
}
resources {
cpu = 100
memory = 128
}
}
}
group "app2" {
count = 1
# curl -X GET http://app1-api1.virtual.consul
network {
mode = "bridge"
port "api1" {
to = 5000
}
port "api2" {
to = 5001
}
}
service {
name = "app2-api1"
port = "5000"
connect {
sidecar_service {
proxy {
transparent_proxy {
# exclude_outbound_ports = [5001]
# exclude_inbound_ports = ["5001"]
}
}
}
}
}
service {
name = "app2-api2"
port = "5001"
#How to expose this over transparent_proxy ??
}
task "app2" {
driver = "docker"
config {
image = "suikast42/nettools:latest"
ports = ["api1", "api2"]
# entrypoint = ["tail", "-f", "/dev/null"]
}
resources {
cpu = 100
memory = 128
}
}
}
}
```
The issue is clearly exposed here https://github.com/hashicorp/consul/issues/5388
And it seems so that consul already support this. https://developer.hashicorp.com/consul/docs/v1.17.x/k8s/multiport/configure
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with Nomad's transparent_proxy documentation, the linked Consul issue 5388, and the multiport Consul configuration referenced in the issue. Confirm the current single-connect limitation and define how both application ports and services should be exposed through transparent proxy; done means the example's two ports can communicate without per-service upstream configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100