open-consul/website/content/docs/connect/config-entries/terminating-gateway.mdx

725 lines
19 KiB
Plaintext
Raw Normal View History

---
layout: docs
page_title: 'Configuration Entry Kind: Terminating Gateway'
sidebar_title: Terminating Gateway
description: >-
The `terminating-gateway` config entry kind allows for configuring terminating gateways
to proxy traffic from services in the Consul service mesh to services outside the mesh.
---
# Terminating Gateway
-> **v1.8.4+:** On Kubernetes, the `ServiceSplitter` custom resource is supported in Consul versions 1.8.4+.<br />
**v1.8.0+:** On other platforms, this config entry is supported in Consul versions 1.8.0+.
The `terminating-gateway` config entry kind (`TerminatingGateway` on Kubernetes) allows you to configure terminating gateways
2020-07-08 23:09:00 +00:00
to proxy traffic from services in the Consul service mesh to services registered with Consul that do not have a
[Connect service sidecar proxy](/docs/connect/proxies). The configuration is associated with the name of a gateway service
and will apply to all instances of the gateway with that name.
~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies
2020-07-08 23:09:00 +00:00
across all federated Consul datacenters. If terminating gateways in different Consul datacenters need to route to different
sets of services within their datacenter then the terminating gateways **must** be registered with different names.
2020-07-08 23:09:00 +00:00
See [Terminating Gateway](/docs/connect/terminating-gateway) for more information.
## TLS Origination
By specifying a path to a [CA file](/docs/connect/config-entries/terminating-gateway#cafile) connections
2020-07-08 23:09:00 +00:00
from the terminating gateway will be encrypted using one-way TLS authentication. If a path to a
[client certificate](/docs/connect/config-entries/terminating-gateway#certfile)
and [private key](/docs/connect/config-entries/terminating-gateway#keyfile) are also specified connections
2020-07-08 23:09:00 +00:00
from the terminating gateway will be encrypted using mutual TLS authentication.
If none of these are provided, Consul will **only** encrypt connections to the gateway and not
from the gateway to the destination service.
## Wildcard service specification
2020-07-08 23:09:00 +00:00
Terminating gateways can optionally target all services within a Consul namespace by specifying a wildcard "\*"
as the service name. Configuration options set on the wildcard act as defaults that can be overridden
by options set on a specific service name.
2020-07-08 23:09:00 +00:00
Note that if the wildcard specifier is used, and some services in that namespace have a Connect sidecar proxy,
traffic from the mesh to those services will be evenly load-balanced between the gateway and their sidecars.
## Sample Config Entries
2020-06-24 22:10:46 +00:00
<Tabs>
<Tab heading="HCL">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with the billing service:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
2020-06-24 22:10:46 +00:00
Services = [
{
Name = "billing"
}
]
```
2020-06-24 22:10:46 +00:00
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" in the default namespace with the billing service in the finance namespace:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
Namespace = "default"
Services = [
{
Namespace = "finance"
Name = "billing"
}
]
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
</Tab>
<Tab heading="Kubernetes YAML">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
Link gateway named "us-west-gateway" with the billing service:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: billing
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
Link gateway named "us-west-gateway" in the default namespace with the billing service in the finance namespace:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: billing
namespace: finance
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
<Tab heading="JSON">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with the billing service:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Services": [
{
"Name": "billing"
}
]
}
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" in the default namespace with the billing service in the finance namespace:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Namespace": "default",
"Services": [
{
"Namespace": "finance",
"Name": "billing"
}
]
}
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
</Tabs>
<Tabs>
<Tab heading="HCL">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with the billing service and specify a CA file for one-way TLS authentication:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
2020-06-24 22:10:46 +00:00
Services = [
{
2020-06-24 22:10:46 +00:00
Name = "billing"
CAFile = "/etc/certs/ca-chain.cert.pem"
}
]
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" in the default namespace with the billing service in the finance namespace,
and specify a CA file for one-way TLS authentication:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
Namespace = "default"
Services = [
{
Namespace = "finance"
Name = "billing"
CAFile = "/etc/certs/ca-chain.cert.pem"
}
]
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
</Tab>
<Tab heading="Kubernetes YAML">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
Link gateway named "us-west-gateway" with the billing service and specify a CA file for one-way TLS authentication:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: billing
caFile: /etc/certs/ca-chain.cert.pem
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
Link gateway named "us-west-gateway" in the default namespace with the billing service in the finance namespace,
and specify a CA file for one-way TLS authentication:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: billing
namespace: finance
caFile: /etc/certs/ca-chain.cert.pem
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
<Tab heading="JSON">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with the billing service and specify a CA file for one-way TLS authentication:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Services": [
{
"Name": "billing",
"CAFile": "/etc/certs/ca-chain.cert.pem"
}
]
}
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" in the default namespace with the billing service in the finance namespace,
and specify a CA file for one-way TLS authentication:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Namespace": "default",
"Services": [
{
"Namespace": "finance",
"Name": "billing",
"CAFile": "/etc/certs/ca-chain.cert.pem"
}
]
}
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
</Tabs>
<Tabs>
<Tab heading="HCL">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with the payments service and specify a CA file, key file, and cert file for mutual TLS authentication:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
2020-06-24 22:10:46 +00:00
Services = [
{
2020-06-24 22:10:46 +00:00
Name = "billing"
CAFile = "/etc/certs/ca-chain.cert.pem"
KeyFile = "/etc/certs/gateway.key.pem"
CertFile = "/etc/certs/gateway.cert.pem"
}
]
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" in the default namespace with the payments service in the finance namespace.
Also specify a CA file, key file, and cert file for mutual TLS authentication:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
Namespace = "default"
Services = [
{
Namespace = "finance"
Name = "billing"
CAFile = "/etc/certs/ca-chain.cert.pem"
KeyFile = "/etc/certs/gateway.key.pem"
CertFile = "/etc/certs/gateway.cert.pem"
}
]
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
</Tab>
<Tab heading="Kubernetes YAML">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
Link gateway named "us-west-gateway" with the payments service and specify a CA file, key file, and cert file for mutual TLS authentication:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: billing
caFile: /etc/certs/ca-chain.cert.pem
keyFile: /etc/certs/gateway.key.pem
certFile: /etc/certs/gateway.cert.pem
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
Link gateway named "us-west-gateway" in the default namespace with the payments service in the finance namespace.
Also specify a CA file, key file, and cert file for mutual TLS authentication:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: billing
namespace: finance
caFile: /etc/certs/ca-chain.cert.pem
keyFile: /etc/certs/gateway.key.pem
certFile: /etc/certs/gateway.cert.pem
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
<Tab heading="JSON">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with the payments service and specify a CA file, key file, and cert file for mutual TLS authentication:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Services": [
{
"Name": "billing",
"CAFile": "/etc/certs/ca-chain.cert.pem",
"KeyFile": "/etc/certs/gateway.key.pem",
"CertFile": "/etc/certs/gateway.cert.pem"
}
]
}
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" in the default namespace with the payments service in the finance namespace.
Also specify a CA file, key file, and cert file for mutual TLS authentication:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Namespace": "default",
"Services": [
{
"Namespace": "finance",
"Name": "billing",
"CAFile": "/etc/certs/ca-chain.cert.pem",
"KeyFile": "/etc/certs/gateway.key.pem",
"CertFile": "/etc/certs/gateway.cert.pem"
}
]
}
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
</Tabs>
<Tabs>
<Tab heading="HCL">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with all services in the datacenter, and configure default certificates for mutual TLS.
Also override the SNI and CA file used for connections to the billing service:
2020-06-24 22:10:46 +00:00
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
Services = [
{
Name = "*"
CAFile = "/etc/common-certs/ca-chain.cert.pem"
KeyFile = "/etc/common-certs/gateway.key.pem"
CertFile = "/etc/common-certs/gateway.cert.pem"
},
{
Name = "billing"
CAFile = "/etc/billing-ca/ca-chain.cert.pem",
SNI = "billing.service.com"
}
]
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
2020-07-08 23:09:00 +00:00
Link gateway named "us-west-gateway" in the default namespace with all services in the finance namespace,
2020-06-24 22:10:46 +00:00
and configure default certificates for mutual TLS. Also override the SNI and CA file used for connections to the billing service:
```hcl
Kind = "terminating-gateway"
Name = "us-west-gateway"
Namespace = "default"
2020-06-24 22:10:46 +00:00
Services = [
{
Namespace = "finance"
Name = "*"
CAFile = "/etc/common-certs/ca-chain.cert.pem"
KeyFile = "/etc/common-certs/gateway.key.pem"
CertFile = "/etc/common-certs/gateway.cert.pem"
},
{
Namespace = "finance"
Name = "billing"
2020-06-24 22:10:46 +00:00
CAFile = "/etc/billing-ca/ca-chain.cert.pem",
SNI = "billing.service.com"
}
]
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
</Tab>
<Tab heading="Kubernetes YAML">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
Link gateway named "us-west-gateway" with all services in the datacenter, and configure default certificates for mutual TLS.
Also override the SNI and CA file used for connections to the billing service:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: '*'
caFile: /etc/common-certs/ca-chain.cert.pem
keyFile: /etc/common-certs/gateway.key.pem
certFile: /etc/common-certs/gateway.cert.pem
- name: billing
caFile: /etc/billing-ca/ca-chain.cert.pem
sni: billing.service.com
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
Link gateway named "us-west-gateway" in the default namespace with all services in the finance namespace,
and configure default certificates for mutual TLS. Also override the SNI and CA file used for connections to the billing service:
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: TerminatingGateway
metadata:
name: us-west-gateway
spec:
services:
- name: '*'
namespace: finance
caFile: /etc/common-certs/ca-chain.cert.pem
keyFile: /etc/common-certs/gateway.key.pem
certFile: /etc/common-certs/gateway.cert.pem
- name: billing
namespace: finance
caFile: /etc/billing-ca/ca-chain.cert.pem
sni: billing.service.com
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
2020-07-08 23:09:00 +00:00
<Tab heading="JSON">
2021-01-07 00:45:35 +00:00
<Tabs>
<Tab heading="Consul OSS">
2020-06-24 22:10:46 +00:00
Link gateway named "us-west-gateway" with all services in the datacenter, and configure default certificates for mutual TLS.
Also override the SNI and CA file used for connections to the billing service:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Services": [
{
"Name": "*",
"CAFile": "/etc/billing-ca/ca-chain.cert.pem",
"KeyFile": "/etc/certs/gateway.key.pem",
"CertFile": "/etc/certs/gateway.cert.pem",
2020-07-08 23:09:00 +00:00
"SNI": "billing.service.com"
2020-06-24 22:10:46 +00:00
},
{
"Name": "billing",
"CAFile": "/etc/billing-ca/ca-chain.cert.pem",
2020-07-08 23:09:00 +00:00
"SNI": "billing.service.com"
2020-06-24 22:10:46 +00:00
}
]
}
```
</Tab>
2021-01-07 00:45:35 +00:00
<Tab heading="Consul Enterprise">
2020-06-24 22:10:46 +00:00
2020-07-08 23:09:00 +00:00
Link gateway named "us-west-gateway" in the default namespace with all services in the finance namespace,
2020-06-24 22:10:46 +00:00
and configure default certificates for mutual TLS. Also override the SNI and CA file used for connections to the billing service:
```json
{
"Kind": "terminating-gateway",
"Name": "us-west-gateway",
"Namespace": "default",
"Services": [
2020-07-08 23:09:00 +00:00
{
2020-06-24 22:10:46 +00:00
"Namespace": "finance",
"Name": "*",
"CAFile": "/etc/billing-ca/ca-chain.cert.pem",
"KeyFile": "/etc/certs/gateway.key.pem",
"CertFile": "/etc/certs/gateway.cert.pem",
2020-07-08 23:09:00 +00:00
"SNI": "billing.service.com"
2020-06-24 22:10:46 +00:00
},
2020-07-08 23:09:00 +00:00
{
2020-06-24 22:10:46 +00:00
"Namespace": "finance",
"Name": "billing",
"CAFile": "/etc/billing-ca/ca-chain.cert.pem",
2020-07-08 23:09:00 +00:00
"SNI": "billing.service.com"
2020-06-24 22:10:46 +00:00
}
]
}
```
2021-01-07 00:45:35 +00:00
</Tab>
</Tabs>
2020-06-24 22:10:46 +00:00
</Tab>
</Tabs>
## Available Fields
<ConfigEntryReference
keys={[
{
name: 'apiVersion',
description: 'Must be set to `consul.hashicorp.com/v1alpha1`',
hcl: false,
},
{
name: 'Kind',
description: {
hcl: 'Must be set to `terminating-gateway`',
yaml: 'Must be set to `TerminatingGateway`',
},
},
{
name: 'Name',
description: 'Set to the name of the gateway being configured.',
type: 'string: <required>',
yaml: false,
},
{
name: 'Namespace',
type: `string: "default"`,
enterprise: true,
description:
'Specifies the namespace the config entry will apply to. This must be the namespace the gateway is registered in.' +
' If omitted, the namespace will be inherited from [the request](/api/config#ns)' +
' or will default to the `default` namespace.',
yaml: false,
},
{
name: 'Meta',
type: 'map<string|string>: nil',
description:
'Specifies arbitrary KV metadata pairs. Added in Consul 1.8.4.',
yaml: false,
},
{
name: 'metadata',
children: [
{
name: 'name',
description: 'Set to the name of the gateway being configured.',
},
{
name: 'namespace',
description:
'If running Consul Open Source, the namespace is ignored (see [Kubernetes Namespaces in Consul OSS](/docs/k8s/crds#consul-oss)). If running Consul Enterprise see [Kubernetes Namespaces in Consul Enterprise](/docs/k8s/crds#consul-enterprise) for more details.',
},
],
hcl: false,
},
{
name: 'Services',
type: 'array<LinkedService>: <optional>',
description: `A list of services to link
with the gateway. The gateway will proxy traffic to these services. These linked services
must be registered with Consul for the gateway to discover their addresses. They must also
be registered in the same Consul datacenter as the terminating gateway.`,
children: [
{
name: 'Name',
type: 'string: ""',
description:
'The name of the service to link with the gateway. If the wildcard specifier, `*`, is provided, then ALL services within the namespace will be linked with the gateway.',
},
{
name: 'Namespace',
enterprise: true,
type: 'string: ""',
description:
'The namespace of the service. If omitted, the namespace will be inherited from the config entry.',
},
{
name: 'CAFile',
type: 'string: ""',
description: `A file path to a PEM-encoded certificate authority.
The file must be present on the proxy's filesystem.
The certificate authority is used to verify the authenticity of the service linked with the gateway.
It can be provided along with a CertFile and KeyFile for mutual TLS authentication, or on its own
for one-way TLS authentication. If none is provided the gateway <b>will not</b> encrypt the traffic to the destination.`,
},
{
name: 'CertFile',
type: 'string: ""',
description: {
hcl: `A file path to a PEM-encoded certificate.
The file must be present on the proxy's filesystem.
The certificate is provided servers to verify the gateway's authenticity. It must be provided if a \`KeyFile\` was specified.`,
yaml: `A file path to a PEM-encoded certificate.
The file must be present on the proxy's filesystem.
The certificate is provided servers to verify the gateway's authenticity. It must be provided if a \`keyFile\` was specified.`,
},
},
{
name: 'KeyFile',
type: 'string: ""',
description: {
hcl: `A file path to a PEM-encoded private key.
The file must be present on the proxy's filesystem.
The key is used with the certificate to verify the gateway's authenticity. It must be provided along if a \`CertFile\` was specified.`,
yaml: `A file path to a PEM-encoded private key.
The file must be present on the proxy's filesystem.
The key is used with the certificate to verify the gateway's authenticity. It must be provided along if a \`certFile\` was specified.`,
},
},
{
name: 'SNI',
type: 'string: ""',
description:
'An optional hostname or domain name to specify during the TLS handshake.',
},
],
},
]}
/>
## ACLs
Configuration entries may be protected by [ACLs](/docs/security/acl).
Reading a `terminating-gateway` config entry requires `service:read` on the `Name`
field of the config entry.
Creating, updating, or deleting a `terminating-gateway` config entry requires
`operator:write`.