Proxy gRPC traffic using GRPCRoute

Create the kong namespace in your Kubernetes cluster, which is where the demo will run:

kubectl create namespace kong

Create a GatewayConfiguration, GatewayClass, and Gateway with an HTTP listener:

echo '
apiVersion: gateway-operator.konghq.com/v2beta1
kind: GatewayConfiguration
metadata:
  name: kong-gateway-configuration
  namespace: kong
spec:
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
            - image: kong/kong-gateway:3.15
              name: proxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: kong-grpc
spec:
  controllerName: konghq.com/gateway-operator
  parametersRef:
    group: gateway-operator.konghq.com
    kind: GatewayConfiguration
    name: kong-gateway-configuration
    namespace: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong-grpc-gateway
  namespace: kong
spec:
  gatewayClassName: kong-grpc
  listeners:
    - name: http
      port: 80
      protocol: HTTP' | kubectl apply -f -

Install the grpcbin Service, which implements a simple gRPC test API:

kubectl apply -f https://developer.konghq.com/manifests/kic/grpcbin-service.yaml -n kong

Kong Gateway assumes Services are HTTP or HTTPS by default. Add the konghq.com/protocol annotation so Kong Operator configures the backend Service as gRPC over TLS instead:

kubectl annotate service -n kong grpcbin 'konghq.com/protocol=grpcs'

1. Create a test certificate for the example.com hostname. This will be used to secure TLS traffic.

   OpenSSL 1.1.1+ OpenSSL 0.9.8

   openssl req -subj '/CN=example.com' -new -newkey rsa:2048 -sha256 \
      -days 365 -nodes -x509 -keyout server.key -out server.crt \
      -addext "subjectAltName = DNS:example.com" \
      -addext "keyUsage = digitalSignature" \
      -addext "extendedKeyUsage = serverAuth" 2> /dev/null;
      openssl x509 -in server.crt -subject -noout

   Copied!

   openssl req -subj '/CN=example.com' -new -newkey rsa:2048 -sha256 \
      -days 365 -nodes -x509 -keyout server.key -out server.crt \
      -extensions EXT -config <( \
       printf "[dn]\nCN=example.com\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:example.com\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth") 2>/dev/null;
      openssl x509 -in server.crt -subject -noout

   Copied!

   Older OpenSSL versions, including the version provided with macOS Monterey, require using the alternative version of this command.

2. Create a Secret containing the certificate:

    kubectl create secret -n kong tls example.com --cert=./server.crt --key=./server.key

   Copied!

3. Kong Operator only watches certificate Secrets that carry the konghq.com/secret="true" label. Add the label so Kong Operator picks up the Secret you just created:

   kubectl label secret example.com -n kong konghq.com/secret="true"

   Copied!

1. Re-apply the kong-grpc-gateway Gateway with an additional HTTPS listener for gRPC traffic:

   Warning: Applying this Gateway replaces the listener list. Include every listener you want to keep.

   echo 'apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: kong-grpc-gateway
     namespace: kong
   spec:
     gatewayClassName: kong-grpc
     listeners:
       - name: http
         port: 80
         protocol: HTTP
       - name: grpc
         port: 443
         protocol: HTTPS
         hostname: example.com
         tls:
           certificateRefs:
             - group: ""
               kind: Secret
               name: example.com' | kubectl apply -f -

   Copied!

2. Create a GRPCRoute:

   echo 'apiVersion: gateway.networking.k8s.io/v1
   kind: GRPCRoute
   metadata:
     name: grpcbin
     namespace: kong
   spec:
     parentRefs:
       - name: kong-grpc-gateway
         sectionName: grpc
     hostnames:
       - "example.com"
     rules:
       - backendRefs:
           - name: grpcbin
             port: 9001
   ' | kubectl apply -f -

   Copied!

This configuration instructs Kong Gateway to forward gRPC requests for example.com on port 443 to the grpcbin Service on port 9001.

1. Wait for the Gateway to be programmed:

   kubectl wait gateway/kong-grpc-gateway -n kong \
     --for=condition=Programmed=True \
     --timeout=5m

   Copied!

2. Get the Gateway’s external IP:

   export PROXY_IP=$(kubectl get gateway kong-grpc-gateway -n kong -o jsonpath='{.status.addresses[0].value}')
   echo $PROXY_IP

   Copied!

3. Call the grpcbin test service through the proxy:

   grpcurl -insecure -authority example.com \
     -d '{"greeting": "Kong"}' \
     $PROXY_IP:443 hello.HelloService.SayHello

   Copied!

   The results should look like this:

   {
     "reply": "hello Kong"
   }