Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of Docs/cluster peering 1.15 updates into release/1.14.x #16397

Merged
merged 4 commits into from
Feb 23, 2023
Merged

Backport of Docs/cluster peering 1.15 updates into release/1.14.x #16397

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
72b8c78
backport of commit e878d2d3e435a724e26789ab6fda84d009961495
boruszak Jan 3, 2023
d94927e
backport of commit 5a378f5794f5f4c9b2b697014c4168b6ab2bdef7
boruszak Jan 3, 2023
6e123b6
backport of commit 1f7e812d856960985351d70306ef3527531f2d6d
boruszak Jan 3, 2023
52a36bb
Docs/cluster peering 1.15 updates (#16291)
boruszak Feb 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 7 additions & 11 deletions ...eway/service-to-service-traffic-peers.mdx → ...connect/cluster-peering/configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,13 @@
---
layout: docs
page_title: Enabling Service-to-service Traffic Across Peered Clusters
page_title: Cluster Peering Configuration
description: >-
Mesh gateways are specialized proxies that route data between services that cannot communicate directly. Learn how to enable service-to-service traffic across clusters in different datacenters or admin partitions that have an established peering connection.

---

# Enabling Service-to-service Traffic Across Peered Clusters

Mesh gateways are required for you to route service mesh traffic between peered Consul clusters. Clusters can reside in different clouds or runtime environments where general interconnectivity between all services in all clusters is not feasible.

At a minimum, a peered cluster exporting a service must have a mesh gateway registered.
For Enterprise, this mesh gateway must also be registered in the same partition as the exported service(s).
To use the `local` mesh gateway mode, there must also be a mesh gateway regsitered in the importing cluster.

Unlike mesh gateways for WAN-federated datacenters and partitions, mesh gateways between peers terminate mTLS sessions to decrypt data to HTTP services and then re-encrypt traffic to send to services. Data must be decrypted in order to evaluate and apply dynamic routing rules at the destination cluster, which reduces coupling between peers.
The topic provides an overview of the configuration options and process for cluster peering.

## Prerequisites

Expand Down Expand Up @@ -47,14 +41,16 @@ Alternatively, you can also use the CLI to spin up and register a gateway in Con

### ACL configuration

If ACLs are enabled, you must add a token granting `service:write` for the gateway's service name and `service:read` for all services in the Enterprise admin partition or OSS datacenter to the gateway's service definition.
If ACLs are enabled, you must add a token granting `service:write` for the gateway's service name and `service:read` for all services in the Enterprise admin partition or OSS datacenter to the gateway's service definition.

These permissions authorize the token to route communications for other Consul service mesh services.

You must also grant `mesh:write` to mesh gateways routing peering traffic in the data plane.

This permission allows a leaf certificate to be issued for mesh gateways to terminate TLS sessions for HTTP requests.

### Modes

Modes are configurable as either `remote` or `local` for mesh gateways that connect peered clusters.
The `none` setting is invalid for mesh gateways in peered clusters and will be ignored by the gateway.
By default, all proxies connecting to peered clusters use mesh gateways in [remote mode](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters#remote).
By default, all proxies connecting to peered clusters use mesh gateways in [remote mode](/docs/connect/gateways/mesh-gateway/service-to-service-traffic-wan-datacenters#remote).
Loading