Exposing mysql port via Envoy gateway

[jabbrwcky]

Hi,

I guess I am not the first to try, has anyone sucessfully tried to expose a mysql database via envoy gateway using Gatway API resources.

I currently have an OpenStack LB using PROXY protocol and I was trying to add an TCP listener to my Gateway and a TCPRoute for the DB service.

At the moment I am getting the response ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 0 which looks like the connection is established (but I had issues with the mysql starttls setup before).

Main question at this point is can and should this setup work in principle?

[arkodg]

can you try https://gateway.envoyproxy.io/docs/tasks/traffic/client-traffic-policy/#enable-proxy-protocol-for-downstream-client

[jabbrwcky]

Thank you @arkodg,

this is a very helpful tip. Together with the right BackendTrafficPolicy it actually works like a charm.

I'll record the solution here for posterity. It consists of:

• the Gateway
• the corresponding ClientTrafficPolicy
• a TCPRoute
• and the accompanying BackendTrafficPolicy

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: mysql
    namespace: envoy-gateway-system
spec:
  gatewayClassName: internal
  listeners:
    - name: mysql
      protocol: TCP
      port: 3306
      allowedRoutes:
        kinds:
        - group: gateway.networking.k8s.io
          kind: TCPRoute
        namespaces:
          from: Selector
          selector:
            matchLabels:
              kubernetes.io/metadata.name: db

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
  name: enable-proxy-protocol-policy
  namespace: envoy-gateway-system
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: mysql
  proxyProtocol:
    optional: false

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: pxc-internal
  namespace: db
spec:
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: mysql
    namespace: envoy-gateway-system
  rules:
  - backendRefs:
    - group: ''
      kind: Service
      name: pxc-db-haproxy
      port: 3309
      weight: 1

  apiVersion: gateway.envoyproxy.io/v1alpha1
  kind: BackendTrafficPolicy
  metadata:
    name: pxc-proxy-protocol
    namespace: db
  spec:
    targetRefs:
    - group: gateway.networking.k8s.io
      kind: TCPRoute
      name: pxc-internal
    proxyProtocol:
      version: V2