Skip to main content
Version: Next

How to proxy the gRPC service

In this practice, we will introduce how to proxy the gRPC service.

Prerequisites#

Please note that in this practice, all components will be installed in the ingress-apisix namespace. If your Kubernetes cluster does not have such namespace, please create it first.

kubectl create ns ingress-apisix

You could install APISIX and APISIX ingress controller by running:

#  We use Apisix 3.0 in this example. If you're using Apisix v2.x, please set to v2
ADMIN_API_VERSION=v3
helm install apisix apisix/apisix -n ingress-apisix \
--set gateway.type=NodePort \
--set ingress-controller.enabled=true \
--set gateway.tls.enabled=true \
--set ingress-controller.config.apisix.serviceNamespace=ingress-apisix \
--set ingress-controller.config.apisix.adminAPIVersion=$ADMIN_API_VERSION

Check that all related components have been installed successfully, including ETCD cluster / APISIX / apisix-ingress-controller.

$ kubectl get pod -n ingress-apisix
NAME READY STATUS RESTARTS AGE
apisix-569f94b7b6-qt5jj 1/1 Running 0 101m
apisix-etcd-0 1/1 Running 0 101m
apisix-etcd-1 1/1 Running 0 101m
apisix-etcd-2 1/1 Running 0 101m
apisix-ingress-controller-b5f5d49db-r9cxb 1/1 Running 0 101m

Prepare a gRPC service#

Using yages as the gRPC server.

Declare the deployment configuration of yapes, exposing port 9000.

kubectl run yages -n ingress-apisix --image smirl/yages:0.1.3 --expose --port 9000

Use the service that includes grpcurl to test gRPC connectivity.

$ kubectl run -it -n ingress-apisix --rm grpcurl --restart=Never --image=fullstorydev/grpcurl:v1.8.7 --command -- \
/bin/grpcurl -plaintext yages:9000 yages.Echo.Ping
# It should output:
{
"text": "pong"
}

If you encounter a timeout error, you can first download quay.io/mhausenblas/gump:0.1 to the local.

Declare gRPC proxy configuration#

Create a route and tell APISIX proxy rules#

kubectl apply -f - <<EOF
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
name: grpc-proxy-route
namespace: ingress-apisix
spec:
http:
- name: grpc-route
match:
hosts:
- grpc-proxy
paths:
- "/*"
backends:
- serviceName: yages
servicePort: 9000
weight: 10
EOF

Inform APISIX the yages is a gRPC server through ApisixUpstream#

kubectl apply -f - <<EOF
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
name: yages
namespace: ingress-apisix
spec:
scheme: grpc
EOF

Configure certificates for gRPC#

Common Name should be grpc-proxy, which needs to be consistent with the hosts declared in ApisixRoute.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=grpc-proxy/O=grpc-proxy"

Store key and crt in secret.

kubectl create secret tls grpc-secret -n ingress-apisix --cert=tls.crt --key=tls.key

Inform APISIX SSL configuration through ApisixTls.

kubectl apply -f - <<EOF
apiVersion: apisix.apache.org/v2
kind: ApisixTls
metadata:
name: grpc-secret
namespace: ingress-apisix
spec:
hosts:
- "grpc-proxy"
secret:
name: grpc-secret
namespace: ingress-apisix
EOF

Test#

OK, the configuration is complete, continue to verify through grpcurl, this time we visit the yages service through the Apache APISIX proxy.

Check the APISIX DP (Data Plane) service, which is apisix-gateway in this example.

kubectl get svc -n ingress-apisix
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
apisix-admin ClusterIP 10.96.49.113 <none> 9180/TCP 98m
apisix-etcd ClusterIP 10.96.81.162 <none> 2379/TCP,2380/TCP 98m
apisix-etcd-headless ClusterIP None <none> 2379/TCP,2380/TCP 98m
apisix-gateway NodePort 10.96.74.145 <none> 80:32600/TCP,443:32103/TCP 98m
apisix-ingress-controller ClusterIP 10.96.78.108 <none> 80/TCP 98m
yages ClusterIP 10.96.37.236 <none> 9000/TCP 94m
$ kubectl run -it -n ingress-apisix --rm grpcurl --restart=Never --image=fullstorydev/grpcurl:v1.8.7 --command -- \
/bin/grpcurl -insecure -servername grpc-proxy apisix-gateway:443 yages.Echo.Ping
# It should output:
{
"text": "pong"
}

APISIX proxy gRPC server succeeded.

Cleanup#

kubectl delete ns ingress-apisix