hashicorp / hashicorp/nomad

Support exposing multiple ports with transparent_proxy

Open
#23,271 3 comments 17 reactions 0 assignees View on GitHub
stage/needs-discussion theme/consul theme/consul/connect type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Proposal

It's a common usecase that applications exposes more then one port. ( Management, rest-api, grpc-api and so on)

The docu of transparent_proxy says `You can only have a single connect block in any task group that uses transparent proxy.`

Lets assume we have two services that exposes ports 5000 and 5001. Both shoul talk to each other over transparent_proxy.

My understanding of the current implementation is that is not possible with the current version of nomad (1.8.0).

So both of the services must handle with upstream configs. right?

Example job definition .

```hcl
job "connect_test" {
# curl -X GET http://app2-api1.virtual.consul
group "app1" {
count = 1

network {
mode = "bridge"
port "api1" {
to = 5000
}
port "api2" {
to = 5001
}
}

service {
name = "app1-api1"
port = "5000"
connect {
sidecar_service {
proxy {
transparent_proxy {
# exclude_outbound_ports = [5001]
# exclude_inbound_ports = ["5001"]
}
}
}
}
}
service {
name = "app1-api2"
port = "5001"
#How to expose this over transparent_proxy ??
}

task "app1" {
driver = "docker"

config {
image = "suikast42/nettools:latest"
ports = ["api1", "api2"]
# entrypoint = ["tail", "-f", "/dev/null"]
}

resources {
cpu = 100
memory = 128
}
}
}
group "app2" {
count = 1
# curl -X GET http://app1-api1.virtual.consul
network {
mode = "bridge"
port "api1" {
to = 5000
}
port "api2" {
to = 5001
}
}

service {
name = "app2-api1"
port = "5000"
connect {
sidecar_service {
proxy {
transparent_proxy {
# exclude_outbound_ports = [5001]
# exclude_inbound_ports = ["5001"]
}
}
}
}
}
service {
name = "app2-api2"
port = "5001"
#How to expose this over transparent_proxy ??
}

task "app2" {
driver = "docker"

config {
image = "suikast42/nettools:latest"
ports = ["api1", "api2"]
# entrypoint = ["tail", "-f", "/dev/null"]
}

resources {
cpu = 100
memory = 128
}
}
}
}
```

The issue is clearly exposed here https://github.com/hashicorp/consul/issues/5388

And it seems so that consul already support this. https://developer.hashicorp.com/consul/docs/v1.17.x/k8s/multiport/configure

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with Nomad's transparent_proxy documentation, the linked Consul issue 5388, and the multiport Consul configuration referenced in the issue. Confirm the current single-connect limitation and define how both application ports and services should be exposed through transparent proxy; done means the example's two ports can communicate without per-service upstream configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
backend, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.