Updates to traffic management#120
Conversation
| # Kubernetes Cluster Traffic Management | ||
|
|
||
| We are making use of Cilium [Gateway API](https://gateway-api.sigs.k8s.io/) as default means of managing traffic towards Routes defined in a Kubernetes Service, which offers full API lifecycle management, security, and governance. | ||
| Safespring uses the Cilium [Gateway API](https://gateway-api.sigs.k8s.io/) as the default means of routing traffic to services running in your cluster. It offers full API lifecycle management, security, and governance. |
There was a problem hiding this comment.
Should "Safespring" be "Safespring Kubernetes Engine", or is this sentence referring to the company?
| Safespring uses the Cilium [Gateway API](https://gateway-api.sigs.k8s.io/) as the default means of routing traffic to services running in your cluster. It offers full API lifecycle management, security, and governance. | ||
|
|
||
| If you are migrating your service from an Ingress Controller (Nginx, Traefik or any other) a quick comparison of main advantages of using Gateway API: | ||
| If you are migrating your service from an Ingress controller (Nginx, Traefik, or any other), here is a quick comparison of the main advantages of using the Gateway API: |
There was a problem hiding this comment.
My impression is that I'm reading the documentation for the Safespring Kubernetes Engine.
I'm not sure why I need the comparison to some other Ingress controller that the Safespring Kubernetes Engine doesn't use, it gives the impression that the choice of using the Cilium Gateway API needs to be defended. And even if that choice would need to be defended, it's a moot point by the time someone is reading the product documentation since they have most likely already bought the product by that time.
This isn't an objection against the content itself, it just feels like this salespitch belongs in some other place than half-way through the product documentation.
| - The traffic is picked up by services exposed via Cilium Gateway API at ports `80` and `443`. | ||
| - **OpenStack Security Groups**: provide a stateful virtual firewall applied to cluster nodes, plus granular filtering for API access and service ports, with explicit allowlists for Kubernetes control plane and worker node communication. | ||
| - The Safespring load balancer forwards traffic to the cluster nodes on L4 TCP ports `80, 443, 6443 and 30000-32767`. | ||
| - Ports `80`, `443` and the range `30000-32767` (all TCP) are available for exposing your own services. `80`/`443` are served by the Cilium Gateway API and `30000-32767` is the Kubernetes [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) range - and as covered below, the Gateway can listen on any of these ports. |
There was a problem hiding this comment.
What does "(all TCP)" refer to, 30000-32767, or all ports mentioned? If the intention is all ports mentioned, I think it's less ambiguous to start the sentence with "TCP ports" and remove the comment in the parenthesis.
Edit: and prepending "ports" before the numbers in the second sentence makes it easier to read.
| - The Safespring load balancer forwards traffic to the cluster nodes on L4 TCP ports `80, 443, 6443 and 30000-32767`. | ||
| - Ports `80`, `443` and the range `30000-32767` (all TCP) are available for exposing your own services. `80`/`443` are served by the Cilium Gateway API and `30000-32767` is the Kubernetes [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) range - and as covered below, the Gateway can listen on any of these ports. | ||
|
|
||
| ## How incoming traffic reaches your app |
There was a problem hiding this comment.
I think most other sections in this documentation use title-case capitalization for headings.
| In the following example we create a Gateway and its HTTP routes (with HTTP redirecting to HTTPS), using the [`GatewayClass`](https://gateway-api.sigs.k8s.io/docs/concepts/api-overview/) `cilium`. Everything - the app and its Service, the Certificate, and the Gateway with its routes - lives in one namespace, so it all appears together below. | ||
|
|
||
| In the following example we illustrate how to create a Gateway and corresponding HTTP routes, with HTTP redirecting to HTTPS. We create the Gateway `cilium-gateway` which makes use of the [`GatewayClass`](https://gateway-api.sigs.k8s.io/api-types/gatewayclass/) `cilium`. | ||
| First, the application itself - a namespace, an nginx `Deployment` serving a demo page, and a `Service` in front of it: |
There was a problem hiding this comment.
It's probably not something to be done for this PR, but I think it would reduce the risk of confusion if the application deployed in the example was something that doesn't have a name that happens to be very close to the name of an ingress controller.
|
|
||
| ``` | ||
|
|
||
| ### Shared Gateway for multiple services |
There was a problem hiding this comment.
I would guess that this scenario applies to the vast majority of uses of Safespring Kubernetes Engine, is it worth the real-estate in the documentation to explain the non-common case at all?
Even if you decide it is worth the real-estate, I would suggest to put the thing most of your users need first (i.e. this one), so they don't have to read through the details of the thing they don't need.
| from: All | ||
| ``` | ||
|
|
||
| Because the TLS Secret lives in the service's namespace but the Gateway reads it from `gateway-system`, each service needs a [`ReferenceGrant`](https://gateway-api.sigs.k8s.io/guides/tls/) allowing that cross-namespace read. Per service you then apply a `Certificate`, the `ReferenceGrant`, and the `HTTPRoute`s (reusing the `letsencrypt-prod` ClusterIssuer from the previous example): |
There was a problem hiding this comment.
Lead sentences with the important stuff first, "Each service needs .. to allow ".
| | **Certificate** + **ClusterIssuer** | cert-manager obtains and renews the TLS certificate (via Let's Encrypt) that the Gateway serves. | [cert-manager + Gateway API](https://cert-manager.io/docs/usage/gateway/) | | ||
| | **Service** | Your application - the destination the HTTPRoute forwards to. | [Kubernetes Services](https://kubernetes.io/docs/concepts/services-networking/service/) | | ||
|
|
||
| !!! note "One Gateway per app vs. a shared Gateway" |
There was a problem hiding this comment.
I'm guessing this is the thing that gives a red box with a warning in the rendered documentation on the deployed page.
I believe I tried to address the same issue as this warning with my comment in https://github.com/safespring/docs/pull/120/files#r3543593280, but in a much less jarring way.
(There's also a numbing aspect if warnings are frequent, so people stop paying attention and will miss the times the warnings are important.)
| - We make use of [Load Balancing - Elastic IP](../compute/loadbalancing.md) to forward traffic to respective Cluster Nodes based on L4 TCP ports: `80/443/6443/50000`. Additional ports can be provided on request. | ||
| - The traffic is picked up by services exposed via Cilium Gateway API at ports `80` and `443`. | ||
| - **OpenStack Security Groups**: provide a stateful virtual firewall applied to cluster nodes, plus granular filtering for API access and service ports, with explicit allowlists for Kubernetes control plane and worker node communication. | ||
| - The Safespring load balancer forwards traffic to the cluster nodes on L4 TCP ports `80, 443, 6443 and 30000-32767`. |
There was a problem hiding this comment.
Do you want the "and" and commas rendered as "and" and ",", or should each number have a closing backtick?
No description provided.