APIs come in all different shapes and forms. In this tutorial, I’ll show you a Kubernetes Ingress gRPC example. I’ll explain how to deploy a gRPC service to Kubernetes and provide external access to the service using Kong’s Kubernetes Ingress Controller. And to hype you up a little bit about the upcoming live-action movie, Dune, based on Frank Herbert’s book, I created a Kubernetes service that delivers Dune quotes. It’s arguably one of the most outstanding science fiction books ever written…what do you think? Let me know on Twitter. @GAMUSSA Before we dive into the code, let’s review a few basics. How Does gRPC Work With Kong? gRPC is a procedural framework initially developed by Google in 2015. Based on HTTP2 protocol for transport and Protocol Buffer (Protobuf) as the interface definition language, gRPC has seen growing adoption in recent years. gRPC has several capabilities that traditional REST APIs struggle with, such as bidirectional streaming and efficient binary encoding. supports TCP streams and can proxy any protocol built on top of a TCP or TLS. We felt that native support for gRPC would allow a growing user base to leverage Kong to manage their REST and gRPC services uniformly. Kong Now that we’ve covered the basics, let’s take a look at the Protobuf definition of my . Dune Quote service Protobuf Definition My Protobuf definition contains a quote service that uses two methods. One method is to deliver a simple quote on any gRPC request. That method doesn’t require any input parameter, so we’ll be using the Protobuf empty type. And as a return, it will have a quote message that will include a message field. And another method that I have here is a GetQuoteStream method that also doesn’t require any parameters to provide. In this case, I also used an empty type. But in this case, I’m returning a stream of these results. syntax = ;
 
package io.kong.developer.quoteservice; ;
 
option java_multiple_files = ;
option java_package = ;
 
service QuoteService {
 
  rpc GetQuote(google.protobuf.Empty) returns (QuoteMessage) ;
  
  rpc GetQuoteStream(google.protobuf.Empty) returns (stream QuoteMessage) ;
 
}
 
message QuoteMessage{
  string message = ;
} "proto3" import "google/protobuf/empty.proto" true "io.kong.developer.quoteservice" 1 I’m using Java to generate a server-side implementation of the service. However, you can take this proto file and implement this service in any language that you use. Protobuf comes with various tools in different languages, including some code generators that support your language of choice. Let’s take a look at the deployment for our Dune Quote service. Kubernetes Deployment Review I’m using the same image in my deployment, but my active service will be using version 3. ---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dune-quote-service
spec:
  replicas: selector:
    matchLabels:
      app: dune-quote-service
  template:
    metadata:
      labels:
        app: dune-quote-service
    spec:
      containers:
        - image: gamussa/reactive-quote-service: imagePullPolicy: Always
          name: dune-quote-service
          ports:
            - containerPort: env:
            - name: GRPC_SERVER_PORT
              value: - name: GRPC_SERVER_SECURITY_ENABLED
              value: - name: GRPC_SERVER_SECURITY_CERTIFICATECHAIN
              value: - name: GRPC_SERVER_SECURITY_PRIVATEKEY
              value: volumeMounts:
            - mountPath: rpc-cert-chain
              name: grpc-cert-chain
            - mountPath: rpc-pk
              name: grpc-pk
      volumes:
        - name: grpc-cert-chain
          secret:
            secretName: grpc-cert-chain
        - name: grpc-pk
          secret:
            secretName: grpc-pk 1 0.0 .3 9001 "9001" "true" "file:/mnt/grpc-cert-chain/server.crt" "file:/mnt/grpc-pk/server.key" /mnt/g /mnt/g My application will be running the GRPC_SERVER on port 9001. And this port will be available to the service to expose this inside my Kubernetes cluster. My service has security enabled. And I do provide some certificates in the gRPC server private key. name: dune-quote-service
          ports:
            - containerPort: env:
            - name: GRPC_SERVER_PORT
              value: - name: GRPC_SERVER_SECURITY_ENABLED
              value: - name: GRPC_SERVER_SECURITY_CERTIFICATECHAIN
              value: - name: GRPC_SERVER_SECURITY_PRIVATEKEY
              value: 9001 "9001" "true" "file:/mnt/grpc-cert-chain/server.crt" "file:/mnt/grpc-pk/server.key" I’m using a self-signed TLS certificate in this example. You’ll need to use a certificate signed by a certification authority that you trust in a production use case. I created the secrets. After that, I mount those secrets as files in my deployment. volumeMounts:
            - mountPath: rpc-cert-chain
              name: grpc-cert-chain
            - mountPath: rpc-pk
              name: grpc-pk /mnt/g /mnt/g Service Review My service will use port 9001 as my target port. Pay attention to Line 6, where I have the limitation: . It will respond to gRPC as a protocol because my service has security enabled, and I need to notify my Kong Gateway that my service understands gRPCS protocol. konghq.com/protocol ---
apiVersion: v1
kind: Service
metadata:
  annotations:
    konghq.com/protocol: grpcs
  name: dune-quote-service
  labels:
    app: dune-quote-service
spec:
  ports:
    - name: grpc
      port: targetPort: selector:
    app: dune-quote-service 9001 9001 And last but not least, I need to create an ingress. Ingress Setup You see some familiar things like that corresponds to my open-source Kong Ingress Controller. Now, I also have an annotation here: ingress.class konghq.com/protocols ---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dune-quote-service
  annotations:
    konghq.com/protocols: grpc,grpcs
    kubernetes.io/ingress.class: kong
    kubernetes.io/tls-acme: cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - secretName: kong.gamov.dev
      hosts:
        - kong.gamov.dev
  rules:
    - host: kong.gamov.dev
      http:
        paths:
          - path: "true" /
            pathType: ImplementationSpecific
            backend:
              service:
                name: dune-quote-service
                port:
                  number: 9001 It’s an ingress configuration that allows Kong Gateway to understand what kind of incoming clients we expect. In this case, we’re creating this ingress for gRPCS because we’re expecting gRPC clients to connect to the service. We’re using gRPC or gRPCS protocols. Before deploying the Kubernetes service, we’ll need to set up Kong Ingress Controller and Kubernetes cert-manager. Ingress Controller and Cert Manager Setup I’ve already installed the Kong Ingress Controller. If you haven’t, follow along in my previous . getting started tutorial I configured my cluster to use cert-manager. I will be using certificates issued by LetsEncrypt. In Kong’s documentation, there is a that allows you to configure your Kong Ingress Controller and your API Gateway to use automatically issued certificates for TLS. getting started guide for cert-manager Next, we need to follow the . Kubernetes cert-manager documentation Then, we’ll be able to request the TLS certificate from the certification authority. And after that, the application will use port 443 TLS to communicate with external clients. That’s why I have this annotation, , to use an automatic certificate management extension enabled for my cluster. I’m using the LetsEncrypt server production version to receive the certificate. kubernetes.io/tls-acme kubernetes.io/tls-acme: cert-manager.io/cluster-issuer: letsencrypt-prod "true" The next thing is to configure my ingress. I need to specify that I’m using TLS for my ingress and issue a certificate for this domain name. This domain name corresponds to the external IP address that Google Cloud Platform provided. spec:
  tls:
    - secretName: kong.gamov.dev
      hosts:
        - kong.gamov.dev It’s the same configuration rules for the particular path. By default, that will correspond to my Dune Quote service. - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: dune-quote-service
                port:
                  number: 9001 Inbound traffic will listen on gRPC or gRPCS protocols. My Kong Gateway and Dune Quote service will also use the gRPCS protocol because I deployed my service using gRPCS. konghq.com/protocols: grpc,grpcs
   kubernetes.io/ingress.class: kong
   kubernetes.io/tls-acme: cert-manager.io/cluster-issuer: letsencrypt-prod "true" The next thing is to configure my ingress. I need to specify that I’m using TLS for my ingress and issue a certificate for this domain name. This domain name corresponds to the external IP address that Google Cloud Platform provided. spec:
  tls:
    - secretName: kong.gamov.dev
      hosts:
        - kong.gamov.dev It’s the same configuration rules for the particular path. By default, that will correspond to my Dune Quote service. - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: dune-quote-service
                port:
                  number: 9001 Inbound traffic will listen on gRPC or gRPCS protocols. My Kong Gateway and Dune Quote service will also use the gRPCS protocol because I deployed my service using gRPCS. konghq.com/protocols: grpc,grpcs
   kubernetes.io/ingress.class: kong
   kubernetes.io/tls-acme: cert-manager.io/cluster-issuer: letsencrypt-prod "true" Deploy the Kubernetes Service Before we can deploy, we need to provide two secrets. We can provide the secrets with the below script. It generates a self-signed certificate and, after that, applies this certificate and key as my secrets. openssl req -x509 -nodes -subj -newkey rsa: -sha256 -keyout server.key -out server.crt -days kubectl create secret generic grpc-cert-chain -- -file=server.crt=server.crt
kubectl create secret generic grpc-pk -- -file=server.key=server.key #!/usr/bin/env bash "/CN=gamov.dev" 4096 3650 from from Next, let’s restart the deployment and bring up our service. Test the Service Once our service is up, we can use to hit the service. Insomnia In Insomnia, let’s upload our proto file. Once that’s uploaded, we’ll see two methods, GetQuote and GetQuoteStream. When we hit GetQuote, we get some quotes from Dune. It works! Next, let’s see if streaming works by switching to the GetQuoteStream. When I click , my response contains 10 responses from the gRPCS server. Nice! Start And my implementation has an interceptor that will log all the calls to my service. That’s a Wrap! In this article, I showed you how to deploy a gRPC service to Kubernetes and expose it outside of the cluster using Kong Ingress Controller. Once you’ve finished this Kubernetes Ingress gRPC example, you may find these other Kubernetes tutorials helpful: Configuring a Kubernetes Application on Kong Konnect Managing Docker Apps With Kubernetes Ingress Controller Implementing Traffic Policies in Kubernetes Have questions or want to stay in touch with the Kong community? Join us wherever you hang out: ⭐ Star us on GitHub 🐦 Follow us on Twitter 🌎 Join the Kong Community 🍻 Join our Meetups ❓ ️ Ask and answer questions on Kong Nation 💯 Apply to become a Kong Champion

Chain

Google

Building a Dune Quote Service Using Kubernetes Ingress gRPC

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

10 Must Have Chrome Extensions for a Web Developer

10 Best Practices for Securing Your API

A Beginners Guide to Learn Mock Fetching in jest

A Guide to Local Debugging with Datadog Agent

AI in Software Testing: Automation or Automagic?

API Choice Overload

10 Must Have Chrome Extensions for a Web Developer

10 Best Practices for Securing Your API

A Beginners Guide to Learn Mock Fetching in jest

A Guide to Local Debugging with Datadog Agent

AI in Software Testing: Automation or Automagic?

API Choice Overload

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps