Deployment

gRPC Invocation Enablement

View as Markdown

The self-managed Helmfile stack deploys grpc-proxy as a core service. Client gRPC traffic reaches grpc-proxy through the Gateway TCP listener on port 10081.

Split or multi-cluster deployments need one additional route. During invocation, a worker opens an HTTP/1 CONNECT callback channel to grpc-proxy on port 10086. Enable this path when worker pods cannot route to grpc-proxy pod IPs, such as when compute clusters and the control-plane cluster use separate pod networks.

Single-cluster deployments usually do not need this worker callback route because workers can reach grpc-proxy pod IPs directly.

For a complete Amazon EKS installation example that compares single-cluster and multi-cluster topologies, see the CSP End-to-End Example.

Split or multi-cluster gRPC invocation is beta in 0.6.0. It supports one grpc-proxy replica in the control plane. Set grpcproxy.replicaCount: 1 and keep the grpc-proxy Horizontal Pod Autoscaler (HPA) disabled. Multiple grpc-proxy replicas are not supported because the 0.6.0 worker callback route is shared TCP routing and can send a callback to the wrong pod.

Network Paths

gRPC invocation uses two network legs:

LegProtocolDefault portPurpose
Client to grpc-proxyHTTP/2 gRPC10081Sends client gRPC requests through the Gateway TCP listener.
Worker to grpc-proxyHTTP/1 CONNECT10086Opens the callback channel that attaches the worker session to grpc-proxy.

The worker callback listener does not add HTTP/1 client invocation support. Client gRPC traffic still uses HTTP/2. Self-hosted HTTP/3 callback routing is out of scope for 0.6.0.

Add the Gateway Listener

Add a TCP listener for the worker callback path only when enabling split or multi-cluster gRPC invocation. The listener name must match ingress.gatewayApi.routes.grpcWorker.listenerName.

1- name: worker-tcp
2  protocol: TCP
3  port: 10086
4  allowedRoutes:
5    namespaces:
6      from: Selector
7      selector:
8        matchLabels:
9          nvcf/platform: "true"

See Gateway Routing for where this listener fits in the Gateway quickstart.

Set Helmfile Values

Add these values to your environment file before deploying or syncing the control plane:

1grpcproxy:
2  replicaCount: 1
3  deployment:
4    autoscaling:
5      enabled: false
6  workerConnectBaseURL: "http://grpc.<domain-or-service>:10086"
7
8ingress:
9  gatewayApi:
10    routes:
11      grpcWorker:
12        enabled: true
13        listenerName: worker-tcp

Set grpcproxy.workerConnectBaseURL to the base URL that workers can use to reach the grpc-proxy callback listener. The stack passes this value to the grpc-proxy chart, which renders the grpc-proxy container configuration. Do not set the raw container environment variable directly.

For local multi-cluster testing with ncp-local, use:

1grpcproxy:
2  workerConnectBaseURL: "http://grpc.nvcf.svc.cluster.local:10086"

After updating the environment file, continue with the normal Helmfile Installation flow.