diff --git a/website/content/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways.mdx b/website/content/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways.mdx index efb0dd249..6751e28bd 100644 --- a/website/content/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways.mdx +++ b/website/content/docs/connect/gateways/mesh-gateway/peering-via-mesh-gateways.mdx @@ -7,11 +7,29 @@ description: >- # Enabling Peering Control Plane Traffic -In addition to [service-to-service traffic routing](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers), mesh gateways can optionally be used to route control-plane traffic between peers. -This includes the initial secret handshake and the bi-directional stream replicating peering data. +In addition to [service-to-service traffic routing](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-peers), +we recommend routing control plane traffic between cluster peers through mesh gateways +to simplfy networking requirements. + +Control plane traffic between cluster peers includes +the initial secret handshake and the bi-directional stream replicating peering data. This data is not decrypted by the mesh gateway(s). Instead, it is transmitted end-to-end using the accepting cluster’s auto-generated TLS certificate on the gRPC TLS port. + + + +[![Cluster peering with mesh gateways](/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.png)](/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.png) + + + + + +[![Cluster peering without mesh gateways](/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.png)](/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.png) + + + + ## Prerequisites To configure mesh gateways for cluster peering control plane traffic, make sure your Consul environment meets the following requirements: diff --git a/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.png b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.png new file mode 100755 index 000000000..de53fbbce --- /dev/null +++ b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:429cea5252b78e34653c78b30cb40f6d59b6c7ef7101fc32415029a45c2bd0c9 +size 526752 diff --git a/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.svg b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.svg new file mode 100755 index 000000000..a8078443a --- /dev/null +++ b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-with-mesh-gateways.svg @@ -0,0 +1,1872 @@ + + + + + + + + + + + + + + + + + + + + + + + + DC1 + + + + + | ON PREMISES + + + + DC2 + + + + + | CLOUD US-EAST-1 + + + + + + + + + + + + + + + + + + + + 8300/tcp + + + + + + + + + + + + + + 8300/tcp + Remote listener-wan-address=ip:port + Local listener-address=ip:port + + + + + + + + + + + + + + + + + + + + + + 8503/tcp + + + + LEADER + + + + + + + + + + + + + + + 8503/tcp + + LEADER + + + + + + + + + + + + + + + 8503/tcp + + + + + + + + + + + + + + + 8503/tcp + + + + + + + + + + + + + + + 8503/tcp + + + + + + + + + + + + + + + + + 8443/tcp + + + + + + + + + + + + + + + + + + 8443/tcp + + + + + With Mesh Gateways + CROSS-DC CONTROL PLANE COMMUNICATION (CLUSTER PEERING) + + consul connect envoy \ -gateway=mesh -register \ -service "dc1-mesh-gw" \ -address "ip1:443" \ -wan-address "ip2:8443" \ -expose-servers \ -token=<used by gateway> + $ + 8503/tcp + gRPC API with TLS + ####/tcp + GW Local Listener + see "-address" config optionwhen launching gateway + EXAMPLE GATEWAY CONFIG + ####/tcp + GW Remote Listener + see "-wan-address" config optionwhen launching gateway + not shown: the Consul client agent deployedwith each gateway to manage its configuration + + + + + + + + + + + + + + + Mesh Gateway + + paths through gateways can differ forDC1 DC2 versus DC2 DC1 because agateway's local listener (for internal traffic) typicallydiffers from its remote listener (for external traffic) + + + + + Control Plane + + + + + + LEADER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Consul Server Agent + System Components + Communication Paths + Ports + Requires config entry of type "mesh" with Peering.PeerThroughMeshGateways=true + Not shown: Consul client agents and their LAN Serf Gossip traffic on ports 8301/{udp,tcp} are not shown because they are not involved in cross-DC communication. + + + + + + + + + + + + + + + + 8503/tcp + + + diff --git a/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.png b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.png new file mode 100755 index 000000000..083bb4950 --- /dev/null +++ b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3fabeda46c9be002be3958ef97c704bf37c4246307ddf3004919b6fded29db16 +size 361806 diff --git a/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.svg b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.svg new file mode 100755 index 000000000..c8f6bb45c --- /dev/null +++ b/website/public/img/consul-connect/mesh-gateway/cluster-peering-connectivity-without-mesh-gateways.svg @@ -0,0 +1,1185 @@ + + + + + + + + + + + DC1 + + + + + | ON PREMISES + + + + DC2 + + + + + | CLOUD US-EAST-1 + + + + Without Mesh Gateways + CROSS-DC CONTROL PLANE COMMUNICATION (CLUSTER PEERING) + 8503/tcp + gRPC API with TLS + all servers are connected in DCswith a cluster peering relationship + Control Plane + + + + + + LEADER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Consul Server Agent + System Components + Communication Paths + Ports + + Not shown: Consul client agents and their LAN Serf Gossip traffic on ports 8301/{udp,tcp} are not shown because they are not involved in cross-DC communication. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 8503/tcp + + + + + + + + + + + + + + + + + 8503/tcp + + LEADER + + + + + + + + + + + + + + + + + 8503/tcp + + + + + + + + + + + + + + + + + 8503/tcp + + + + + + + + + + + + + + + + + 8503/tcp + + + + LEADER + + + + + + + + + + + + + + + + + 8503/tcp + + +