ExternalService: ExternalService Accessible from specific zone through ZoneEgress - Policy

ExternalService Accessible from specific zone through ZoneEgress

There are might be scenarios when a specific ExternalService might be accessible only through the specific zone. To make it work we should use the kuma.io/zone tag for external service. In order to make it work, we need a multi-zone setup with ZoneIngress and ZoneEgress deployed. Also, zone egress needs to be enabled.

In this example, when all the conditions mentioned above are fulfilled if the service in zone-1 is trying to set a connection with httpbin.mesh it will be redirected to the ZoneEgress instance within the zone-1. Next, this request goes to the ZoneIngress instance in zone-2 which redirects it to the ZoneEgress cluster instance from where it goes outside to the ExternalService.

Configuration

apiVersion: kuma.io/v1alpha1
kind: ExternalService
metadata:
  name: httpbin-only-in-zone-2
  namespace: kuma-demo
  labels:
    kuma.io/mesh: default
spec:

Copied!

type: ExternalService
mesh: default
name: httpbin-only-in-zone-2
tags:
  kuma.io/service: httpbin
  kuma.io/protocol: http
  kuma.io/zone: zone-2
networking:
address: httpbin.org:80

Copied!

Please adjust konnect_mesh_control_plane.my_meshcontrolplane.id and konnect_mesh.my_mesh.name according to your current configuration.

resource "konnect_external_service" "httpbin_only_in_zone_2" {
  provider = konnect-beta
  type = "ExternalService"
  name = "httpbin-only-in-zone-2"
  tags = {
    kuma.io/service = "httpbin"
    kuma.io/protocol = "http"
    kuma.io/zone = "zone-2"
  }
  networking = ""
  address = "httpbin.org:80"
  labels   = {
  "kuma.io/mesh" = konnect_mesh.my_mesh.name
  }
  cp_id    = konnect_mesh_control_plane.my_meshcontrolplane.id
  mesh     = konnect_mesh.my_mesh.name
}

Copied!

External Service

ExternalService Accessible from specific zone through ZoneEgress

Configuration

Help us make these docs great!

Still need help