search

Azure / service-fabric-mesh-preview

Service Fabric Mesh is the Service Fabric's serverless offering to enable developers to deploy containerized applications without managing infrastructure. Service Fabric Mesh , aka project “SeaBreeze” is currently available in private preview. This repository will be used for tracking bugs/feature requests as GitHub issues and for maintaining the latest documentation.
MIT License
82 stars 11 forks source link

Gateway deployment failing for empty tcp/http config. #331

Open mgrabarz opened 5 years ago

mgrabarz commented 5 years ago

Gateway deployments with no tcp/http ingress rules fail constantly. Error is the same as reported in #324.

Repro steps:

  1. Use e.g. HelloWorld sample template.
  2. Remove entire "tcp": [...] property from Gateway resource.
  3. Deploy template.

After deployment failure Gateway resource seems to be working properly, with expected egress traffic from containers to public Internet.

arturenault commented 5 years ago

The egress traffic would work even if you didn't have a gateway resource (in fact you don't really, since the deployment failed). The gateway resource is used to configure ingress traffic (i.e. accessing your containers from outside the cluster).

There is an ongoing discussion internally about whether or not gateways without an ingress configuration should be supported, as it is unclear whether there is a scenario for them. I'll update this thread once we have a conclusion.

mgrabarz commented 5 years ago

Thanks Artur, That raises another questions.

  1. Why gateway resource is then mandatory for mesh network? Currently to perform successful deploymet both gateway and gateway http/tcp config are mandatory.
  2. I was under impression that egress goes via gateway IP, if not, then we probably need routing rules in the future, especally in BYOVN scenarios.
mgrabarz commented 5 years ago

Just to explain my use case:

  1. We noticed that as for today the only option to expose services outside of Mesh is to use GW with public IP and open ports.
  2. There is no option for IP restriction, firewall, rate limiting, or even TLS.

To securely expose services from Mesh we started to experiment with Cloudflare's Argo tunnels. We run cloudflare deamon as sidecar to establish encrypted tunnel (initiated from Mesh side) with Cloudflare. Thanks of this solution all traffic goes using Cloudflare's anti-DDos, WAF, TLS, tunnel load balancers etc. If there are no ingress rules on GW, nothing can get in but through the tunnel.