Power Your Consul Service Mesh with HAProxy

blog20210415-01.sh

$ helm repo add hashicorp https://helm.releases.hashicorp.com
$ helm repo update
$ helm install consul hashicorp/consul \
   --set global.name=consul \
   --set connect=true \
   --set server.replicas=1 \
   --set server.bootstrapExpect=1 \
   --version 0.31.1

blog20210415-02.sh

$ kubectl port-forward service/consul-server 8500:8500

blog20210415-03.yaml

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
            
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: system:serviceaccount:default:default
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

blog20210415-04.sh

$ kubectl apply -f pod-reader-role.yaml

blog20210415-05.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
 name: news-service
 labels:
   app: news-service
spec:
 replicas: 1
 selector:
   matchLabels:
     app: news-service
 template:
   metadata:
     labels:
       app: news-service
   spec:
     containers:
     - name: news-service           
       image: quay.io/nickmramirez/news-service
     - name: haproxy-consul        
       image: haproxytech/haproxy-consul-connect
       args: ["-sidecar-for", "news-service", "-enable-intentions"]
     - name: consul                
       image: consul
       env:
             - name: CONSUL_LOCAL_CONFIG
               value: '{
                 "service": {
                   "name": "news-service",
                   "port": 80,
                   "connect": {
                     "sidecar_service": {}
                   }
                 }
             }'
       args:
       - agent
       - -bind=0.0.0.0
       - "-retry-join=provider=k8s label_selector=\"app=consul\""

blog20210415-06.sh

$ kubectl apply -f news-service-deployment.yaml

blog20210415-07.yaml

- name: CONSUL_LOCAL_CONFIG
  value: '{
    "service": {
       "name": "news-service",
        "port": 80,
        "connect": {
           "sidecar_service": {}
        }
     }
}'

blog20210415-08.sh

$ kubectl apply -f app-ui-deployment.yaml

blog20210415-09.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
 name: app-ui
 labels:
   app: app-ui
spec:
   replicas: 1
   selector:
     matchLabels:
       app: app-ui
   template:
     metadata:
       labels:
         app: app-ui
     spec:
       containers:
       - name: app-ui           
         image: quay.io/nickmramirez/app-ui
       - name: haproxy-consul   
         image: haproxytech/haproxy-consul-connect
         args: ["-sidecar-for", "app-ui", "-enable-intentions"]
       - name: consul           
         image: consul
         env:
         - name: CONSUL_LOCAL_CONFIG
           value: '{
               "service": {
                 "name": "app-ui",
                 "port": 80,
                 "connect": {
                   "sidecar_service": {
                       "proxy": {
                           "upstreams": [
                               {
                                 "destination_name": "news-service",
                                 "local_bind_port": 3000
                               }
                           ]
                       }
                   }
                 }
               }
             }'
         args:
         - agent
         - -bind=0.0.0.0
         - "-retry-join=provider=k8s label_selector=\"app=consul\""

---
apiVersion: v1
kind: Service
metadata:
   name: app-ui
spec:
   selector:
     app: app-ui
   ports:
   - name: http
     port: 80
     protocol: TCP
     targetPort: 80

blog20210415-10.yaml

- name: CONSUL_LOCAL_CONFIG
  value: '{
     "service": {
        "name": "app-ui",
        "port": 80,
        "connect": {
           "sidecar_service": {
              "proxy": {
                 "upstreams": [
                    {
                       "destination_name": "news-service",
                       "local_bind_port": 3000
                    }
                 ]
              }
           }
        }
     }
  }'

blog20210415-11.sh

$ kubectl port-forward service/app-ui 8080:80

blog20210415-12.sh

$ helm uninstall consul
$ helm install consul hashicorp/consul \
   --set global.name=consul \
   --set connect=true \
   --set server.replicas=1 \
   --set server.bootstrapExpect=1 \
   --set global.acls.manageSystemACLs=true

$ kubectl port-forward service/consul-server 8500:8500

blog20210415-13.sh

$ sudo apt install jq
$ kubectl get secret consul-bootstrap-acl-token \
   -o json | jq -r '.data.token' | base64 -d

8f1c8c5e-d0fb-82ff-06f4-a4418be245dc

blog20210415-14.hcl

node_prefix "" {
    policy = "write"
}
service_prefix "" {
    policy = "write"
}

blog20210415-15.yaml

- name: haproxy-consul        
  image: haproxytech/haproxy-consul-connect
  args: ["-sidecar-for", "news-service", "-enable-intentions", "-token", "f62a3058-e139-7e27-75a0-f47df9e2e4bd"]

blog20210415-16.yaml

- name: consul                
  image: consul
  env:
    - name: CONSUL_LOCAL_CONFIG
      value: '{
        "primary_datacenter": "dc1",
        "acl": {
          "enabled": true,
          "default_policy": "allow",
          "down_policy": "extend-cache",
          "tokens": {
            "default": "f62a3058-e139-7e27-75a0-f47df9e2e4bd"
          }
        },
        "service": {
          "name": "news-service",
          "port": 80,
          "connect": {
            "sidecar_service": {}
          }
        }      
      }'