From f6f28c49529741b13bd507812a9c910f9ce6f8ca Mon Sep 17 00:00:00 2001 From: Jared Kirschner Date: Sat, 15 Jan 2022 11:09:49 -0800 Subject: [PATCH] docs: show WAN fed with/without mesh gateways --- .../wan-federation-via-mesh-gateways.mdx | 4 +- ...-federation-connectivity-mesh-gateways.png | 3 + ...-federation-connectivity-mesh-gateways.svg | 2371 +++++++++++++++++ ...an-federation-connectivity-traditional.png | 3 + ...an-federation-connectivity-traditional.svg | 1539 +++++++++++ 5 files changed, 3919 insertions(+), 1 deletion(-) create mode 100755 website/public/img/wan-federation-connectivity-mesh-gateways.png create mode 100755 website/public/img/wan-federation-connectivity-mesh-gateways.svg create mode 100755 website/public/img/wan-federation-connectivity-traditional.png create mode 100755 website/public/img/wan-federation-connectivity-traditional.svg diff --git a/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx b/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx index eca396d92..8c5aa2c4b 100644 --- a/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx +++ b/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx @@ -20,6 +20,8 @@ Consul cluster, operators must ensure that all Consul servers in every datacenter must be directly connectable over their WAN-advertised network address from each other. +[![WAN federation without mesh gateways](/img/wan-federation-connectivity-traditional.png)](/img/wan-federation-connectivity-traditional.png) + This requires that operators setting up the virtual machines or containers hosting the servers take additional steps to ensure the necessary routing and firewall rules are in place to allow the servers to speak to each other over @@ -38,7 +40,7 @@ Operators looking to simplify their WAN deployment and minimize the exposed security surface area can elect to join these datacenters together using [mesh gateways](/docs/connect/gateways/mesh-gateway) to do so. -![Mesh Gateway Architecture](/img/mesh-gateways.png) +[![WAN federation with mesh gateways](/img/wan-federation-connectivity-mesh-gateways.png)](/img/wan-federation-connectivity-mesh-gateways.png) ## Architecture diff --git a/website/public/img/wan-federation-connectivity-mesh-gateways.png b/website/public/img/wan-federation-connectivity-mesh-gateways.png new file mode 100755 index 000000000..6545e62f6 --- /dev/null +++ b/website/public/img/wan-federation-connectivity-mesh-gateways.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:852c56560756f176487f6dbfb4cc5e88763257010408bc9957b8de8ca6a7c501 +size 722888 diff --git a/website/public/img/wan-federation-connectivity-mesh-gateways.svg b/website/public/img/wan-federation-connectivity-mesh-gateways.svg new file mode 100755 index 000000000..8d4599f7f --- /dev/null +++ b/website/public/img/wan-federation-connectivity-mesh-gateways.svg @@ -0,0 +1,2371 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + DC1 + + + + + | ON PREMISES + + + + DC2 + + + + + | CLOUD US-EAST-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + + + + + + + + + + + + + + 8300/tcp + Remote listener-wan-address=ip:port + Local listener-address=ip:port + + + + + + + + PRIMARY + SECONDARY + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + + 8443/tcp + + + + + + + + + + + + + + + + + + 8443/tcp + + + + + With Mesh Gateways + CROSS-DC CONTROL PLANE COMMUNICATION (WAN FEDERATION) + + + consul connect envoy \ -gateway=mesh -register \ -service "dc1-mesh-gw" \ -address "ip1:8443" \ -wan-address "ip2:8443" \ -token=<used by gateway> + $ + + 8300/tcp + 8300/tcp + + + DC2 + DC1 + + Server RPC & Cross-DC WAN Gossip + ####/tcp + Intra-DC WAN Gossip + when using mesh gateways, cross-DC WAN gossipexclusively uses TCP over the server RPC port (8300) + Direct Primary GW Connection + unidirectional connection from all Consul server agentsin secondary DCs to the mesh gateway of the primary DC(see "primary_gateways" agent config option); necessaryfor infrequent internal operations (e.g., bootstrapping) + GW Local Listener + see "-address" config optionwhen launching gateway + EXAMPLE GATEWAY CONFIG + ####/tcp + GW Remote Listener + see "-wan-address" config optionwhen launching gateway + 8302/tcp + 8302/udp + not shown: the Consul client agent deployedwith each gateway to manage its configuration + + + + + + + + + + + + + + + Mesh Gateway + + + paths through gateways can differ forDC1 DC2 versus DC2 DC1 because agateway's local listener (for internal traffic) typicallydiffers from its remote listener (for external traffic) + + + + + + Control Plane + + + + + + + LEADER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Consul Server Agent + System Components + Communication Paths + Ports + Requires server agent configuration: connect.enable_mesh_gateway_wan_federation=true + Not shown: Consul client agents and their LAN Serf Gossip traffic on ports 8301/{udp,tcp} are not shown because they are not involved in cross-DC communication. + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + diff --git a/website/public/img/wan-federation-connectivity-traditional.png b/website/public/img/wan-federation-connectivity-traditional.png new file mode 100755 index 000000000..91eb13b20 --- /dev/null +++ b/website/public/img/wan-federation-connectivity-traditional.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:625d73e3709f4091e69c01cacca5818767df2f90822a5cda3ad5de930e7c88eb +size 615867 diff --git a/website/public/img/wan-federation-connectivity-traditional.svg b/website/public/img/wan-federation-connectivity-traditional.svg new file mode 100755 index 000000000..0a8f64c9b --- /dev/null +++ b/website/public/img/wan-federation-connectivity-traditional.svg @@ -0,0 +1,1539 @@ + + + + + + + + + + + DC1 + + + + + | ON PREMISES + + + + DC2 + + + + + | CLOUD US-EAST-1 + + PRIMARY + SECONDARY + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + Standard: Without Mesh Gateways + CROSS-DC CONTROL PLANE COMMUNICATION (WAN FEDERATION) + + 8302/tcp + 8302/udp + + 8300/tcp + Server RPC + WAN Serf Gossip + all servers are connected in the WAN gossip pool + Control Plane + + + + + + LEADER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Consul Server Agent + System Components + Communication Paths + Ports + gossip occurs primarily via UDP,TCP is only used as a fallback + + + + Not shown: Consul client agents and their LAN Serf Gossip traffic on ports 8301/{udp,tcp} are not shown because they are not involved in cross-DC communication. + +