Linkerd TrafficSplit with Contour HTTPProxy

[zyzlik]

Hello!

I have a question regarding TrafficSplit and HTTPProxy working together.
I have two services canary-atomation-stable and canary-automation-canary, and TrafficSplit object that routes traffic between them:

apiVersion: v1
items:
- apiVersion: split.smi-spec.io/v1alpha2
  kind: TrafficSplit
  metadata:
    name: canary-automation-trafficsplit
    namespace: canary-automation
  spec:
    backends:
    - service: canary-automation-stable
      weight: 50
    - service: canary-automation-canary
      weight: 50
    service: canary-automation-stable

Locally, when I query curl http://canary-automation-stable.canary-automation.svc.cluster.local:5000, it works as expected.
However, when I add the HTTPProxy object and curl xxx.us-east-2.elb.amazonaws.com, it routes the traffic only to the stable service:

apiVersion: v1
items:
- apiVersion: projectcontour.io/v1
  kind: HTTPProxy
  metadata:
    name: canary-automation
    namespace: canary-automation
  spec:
    routes:
    - requestHeadersPolicy:
        set:
        - name: l5d-dst-override
          value: canary-automation-stable.canary-automation.svc.cluster.local:5000
      services:
      - name: canary-automation-stable
        port: 5000
    virtualhost:
      fqdn: xxx.us-east-2.elb.amazonaws.com

Is there anything I'm missing?

[zyzlik]

I installed Contour using the documentation from here, I see Contour pods having the annotation linkerd.io/inject: enabled.
What else can I do?

[kflynn]

@zyzlik Contour needs to be meshed in "ingress mode" -- this is in the docs about Linkerd, but it's way up at the top of the Contour section and you might've missed it. Specifically, you need linkerd.io/inject: ingress (rather than using the value enabled) -- give that a shot?

[zyzlik]

I changed pod annotations, still only routes to the stable

[zyzlik]

Do I need to mesh anything else apart from contour pods? envoy pods maybe?

[kflynn]

Just to be certain, did you restart the Contour pods after changing the annotations?

And hmmm, if Contour runs Envoy in separate pods, yes, I would expect that they would need to be meshed as well. Can you send over a list of what all is in the projectcontour namespace?

[zyzlik]

Yes, the pods did restart since I changed the pod spec in Deployment. Pods restarted, and the app was unavailable for a minute; then, I was able to curl it, but it still only hit the stable app.

I'll list all the objects in the projectcontour ns when I come back to the project tomorrow (I destroyed the cluster already 😅 ), but as far as I remember, it had Deamonset, Deployment, two contour pods, two envoy pods.

[zyzlik]

Alright, so you were right: I had to inject linkerd.io/inject: ingress into envoy pods too. Just injecting Deployments and Deamonset with that is not enough: pod spec must also be changed for both Contour pods and Envoy pods.

[zyzlik]

I wonder if Linkerd + Ngnix would be faster than Linkerd + HTTPProxy, because Istio ended up being faster because it already has an Ingress solution.

[kflynn]

Great to hear that this is working! I'll update the Contour instructions on our end.

And what speed are you looking at? Both Contour and Istio are ultimately using Envoy as the proxy for their ingress controllers: I haven't benchmarked Envoy against NGINX, but Envoy's pretty fast, and Linkerd won't add but a tiny amount of latency.

[zyzlik]

I measured response time for a very simple app: 0.1610s for HTTPProxy when it is responsible for canary/stable routing (0.08 when no canary), 0.1379s for Linkerd + HTTPProxy, 0.1050s for Istio.