このページは、まだ日本語ではご利用いただけません。翻訳中です。
旧バージョンのドキュメントを参照しています。 最新のドキュメントはこちらをご参照ください。
Proxy UDP requests
Deploy a Service that listens for UDP datagrams, and exposes this service outside of the cluster using Kong Gateway.
Before you begin ensure that you have Installed Kong Ingress Controller with Gateway API support in your Kubernetes cluster and are able to connect to Kong.
Before you begin ensure that you have Installed Kong Ingress Controller with Gateway API support in your Kubernetes cluster and are able to connect to Kong.
Prerequisites
Install the Gateway APIs
-
Install the Gateway API CRDs before installing Kong Ingress Controller.
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml
-
Install the experimental Gateway API CRDs to test this feature.
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/experimental-install.yaml
-
Create a
Gateway
andGatewayClass
instance to use.echo " --- apiVersion: gateway.networking.k8s.io/v1 kind: GatewayClass metadata: name: kong annotations: konghq.com/gatewayclass-unmanaged: 'true' spec: controllerName: konghq.com/kic-gateway-controller --- apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: kong spec: gatewayClassName: kong listeners: - name: proxy port: 80 protocol: HTTP " | kubectl apply -f -
The results should look like this:
gatewayclass.gateway.networking.k8s.io/kong created gateway.gateway.networking.k8s.io/kong created
Install Kong
You can install Kong in your Kubernetes cluster using Helm.
-
Add the Kong Helm charts:
helm repo add kong https://charts.konghq.com helm repo update
-
Install Kong Ingress Controller and Kong Gateway with Helm:
helm install kong kong/ingress -n kong --create-namespace
-
Enable the Gateway API Alpha feature gate:
kubectl set env -n kong deployment/kong-controller CONTROLLER_FEATURE_GATES="GatewayAlpha=true" -c ingress-controller
The results should look like this:
deployment.apps/kong-controller env updated
Test connectivity to Kong
Kubernetes exposes the proxy through a Kubernetes service. Run the following commands to store the load balancer IP address in a variable named PROXY_IP
:
-
Populate
$PROXY_IP
for future commands:export PROXY_IP=$(kubectl get svc --namespace kong kong-gateway-proxy -o jsonpath='{.status.loadBalancer.ingress[0].ip}') echo $PROXY_IP
-
Ensure that you can call the proxy IP:
curl -i $PROXY_IP
The results should look like this:
HTTP/1.1 404 Not Found Content-Type: application/json; charset=utf-8 Connection: keep-alive Content-Length: 48 X-Kong-Response-Latency: 0 Server: kong/3.0.0 {"message":"no Route matched with those values"}
Configure Kong Gateway
Kong Gateway does not include any UDP listen configuration by default
Add UDP listens
To expose UDP listens, set the KONG_STREAM_LISTEN
environment variable and expose port 9999
in the Deployment:
kubectl patch deploy -n kong kong-gateway --patch '{
"spec": {
"template": {
"spec": {
"containers": [
{
"name": "proxy",
"env": [
{
"name": "KONG_STREAM_LISTEN",
"value": "0.0.0.0:9999 udp"
}
],
"ports": [
{
"containerPort": 9999,
"name": "stream9999",
"protocol": "UDP"
}
]
}
]
}
}
}
}'
The results should look like this:
deployment.apps/kong-gateway patched
Add a UDP proxy Service
LoadBalancer Services only support a single transport protocol in Kubernetes
versions prior to 1.26.
To direct UDP traffic to the proxy Service, create a second Service named kong-udp-proxy
.
This Service can be managed using the
udpProxy
configuration of the Kong Helm chart.
echo "apiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: udp
service.beta.kubernetes.io/aws-load-balancer-type: nlb
name: kong-udp-proxy
namespace: kong
spec:
ports:
- name: stream9999
port: 9999
protocol: UDP
targetPort: 9999
selector:
app: kong-gateway
type: LoadBalancer
" | kubectl apply -f -
The results should look like this:
service/kong-udp-proxy created
Update Gateway API Listeners
If you are using Gateway API (UDPRoute
), your Gateway needs additional
configuration under listeners
. If you are using UDPIngress
, you can skip this step.
kubectl patch --type=json gateway kong -p='[
{
"op":"add",
"path":"/spec/listeners/-",
"value":{
"name":"stream9999",
"port":9999,
"protocol":"UDP",
"allowedRoutes": {
"namespaces": {
"from": "All"
}
}
}
}
]'
The results should look like this:
gateway.gateway.networking.k8s.io/kong patched
Deploy a UDP test application
echoserver-udp is a simple test server that accepts UDP TFTP requests and returns basic request information. Because curl supports TFTP you can use it to test UDP routing.
- Create a namespace for deploying the UDP application.
kubectl create namespace udp-example
The results should look like this:
namespace/udp-example created
When you’ve completed this guide, use the
kubectl delete namespace udp-example
command to clean those resources. -
Create a test application Deployment and an associated Service.
echo "--- apiVersion: apps/v1 kind: Deployment metadata: name: tftp namespace: udp-example labels: app: tftp spec: replicas: 1 selector: matchLabels: app: tftp template: metadata: labels: app: tftp spec: containers: - name: tftp image: cilium/echoserver-udp:latest args: - --listen - :9999 ports: - containerPort: 9999 --- apiVersion: v1 kind: Service metadata: name: tftp namespace: udp-example spec: ports: - port: 9999 name: tftp protocol: UDP targetPort: 9999 selector: app: tftp type: ClusterIP " | kubectl apply -f -
The results should look like this:
deployment.apps/tftp created service/tftp created
Route UDP traffic
Now that Kong Gateway is listening on port 9999
and the test application
is running, you can create UDP routing configuration that proxies traffic to
the application:
This configuration routes traffic to UDP port 9999
on the
Kong Gateway proxy to port 9999
on the TFTP test server.
Test the UDP routing configuration
-
Retrieve the external IP address of the UDP proxy Service you created and set the
KONG_UDP_ENDPOINT
variable.export KONG_UDP_ENDPOINT="$(kubectl -n kong get service kong-udp-proxy \ -o=go-template='{{range .status.loadBalancer.ingress}}{{.ip}}{{end}}')"
-
Send a TFTP request through the proxy.
curl -s tftp://${KONG_UDP_ENDPOINT}:9999/hello
The results should look like this:
Hostname: tftp-5849bfd46f-nqk9x Request Information: client_address=10.244.0.1 client_port=39364 real path=/hello request_scheme=tftp