Container Service for Kubernetes:Deploy gRPC services on the backend of the NGINX Ingress controller

Background information

gRPC is developed based on the HTTP/2 protocol and the Protocol Buffers (ProtoBuf) serialization protocol. It is an open-source Remote Procedure Call (RPC) framework provided by Google and works on platforms developed by various programming languages. Due to its efficiency, flexibility, and support for multiple programming languages, gRPC is suitable for distributed systems and environments in which microservices are deployed, such as inter-service calls, communication between Internet of Things (IoT) devices, and remote API services of complex data structures.

option java_multiple_files = true;
option java_package = "io.grpc.examples.helloworld";
option java_outer_classname = "HelloWorldProto";

package helloworld;

// The greeting service definition.
service Greeter {
  // Sends a greeting
  rpc SayHello (HelloRequest) returns (HelloReply) {}
}

// The request message containing the user's name.
message HelloRequest {
  string name = 1;
}

// The response message containing the greetings
message HelloReply {
  string message = 1;
}

Prerequisites

• The NGINX Ingress controller is installed and its version is 0.22.0 or later. For more information, see Manage the NGINX Ingress controller.

• A kubectl client is connected to the ACK cluster. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

• gRPCurl is installed. For more information, see gRPCurl.

• A trusted certificate is obtained. You can obtain a certificate in one of the following ways:

  • Purchase a certificate in the Certificate Management Service console. For more information, see Purchase SSL certificates.

  • Purchase a certificate that is issued by another certificate authority (CA).

  • (Optional) Follow the steps in (Optional) Generate a self-signed certificate to generate a self-signed certificate.

Step 1: Save an SSL certificate as a Secret in the cluster

In the NGINX Ingress controller, gRPC services run only on HTTPS ports. The default port for gRPC services is port 443. Therefore, you must configure an SSL certificate as a Secret in the cluster.

Run the following command to add the certificate to the cluster through grpc-secret:

kubectl create secret tls grpc-secret --key grpc.key --cert grpc.crt # Replace grpc.key with your certificate file and grpc.crt with your private key file

Step 2: Create a gRPC service

1. Create a file named grpc.yaml and copy the following content to the file:

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: grpc-service
   spec:
     replicas: 1
     selector:
       matchLabels:
         run: grpc-service
     template:
       metadata:
         labels:
           run: grpc-service
       spec:
         containers:
         - image: registry.cn-hangzhou.aliyuncs.com/acs-sample/grpc-server:latest
           imagePullPolicy: Always
           name: grpc-service
           ports:
           - containerPort: 50051
             protocol: TCP
         restartPolicy: Always
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: grpc-service
   spec:
     ports:
     - port: 50051
       protocol: TCP
       targetPort: 50051
     selector:
       run: grpc-service
     sessionAffinity: None
     type: NodePort

2. Run the following command to create the gRPC service:

   kubectl apply -f grpc.yaml

   Expected output:

   deployment.apps/grpc-service created
   service/grpc-service created

Step 3: Create an Ingress

1. Create a file named grpc-ingress.yaml and copy the following content to the file:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: grpc-ingress
     annotations:
       # Must specify that the backend service is a gRPC service
       nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
   spec:
     # Specify the SSL certificate saved through Secret
     tls:
     - hosts:
       - grpc.example.com
       secretName: grpc-secret
     rules:
     - host: grpc.example.com # gRPC service domain name, replace with your domain name
       http:
         paths:
         - path: /
           pathType: Prefix
           backend:
             service:
               # gRPC service
               name: grpc-service
               port:
                 number: 50051

   Important

   Due to the grpc_pass limit of NGINX, you cannot configure service-weight for gRPC services.

2. Run the following command to create the Ingress:

   kubectl apply -f grpc-ingress.yaml

   Expected output:

   ingress.networking.k8s.io/grpc-ingress created

Step 4: Verify the result

1. Run the following command to view the Ingress information:

   kubectl get ingress

   Expected output:

   NAME           CLASS   HOSTS              ADDRESS         PORTS     AGE
   grpc-ingress   nginx   grpc.example.com   139.196.*****   80, 443   3m51s

   Record the IP address in the ADDRESS column.

2. Use grpcurl to connect to the service.

   grpcurl -insecure -authority grpc.example.com <IP_ADDRESS>:443 list # Replace <IP_ADDRESS> with the IP address recorded in the previous step

   The output indicates that the Ingress distributes requests to the backend gRPC service:

   grpc.reflection.v1alpha.ServerReflection
   helloworld.Greeter