Application Networking

In addition to configuring application's container specifications, you can also configure its networking behaviors, including how to expose the application and how it can be accessed. You can specify a network module in the accessories field in AppConfiguration to achieve that.

In future versions, this will also include ingress-based routing strategy and DNS configurations.

Import

In the examples below, we are using schemas defined in the kam package and the network Kusion Module. For more details on KCL package and module import, please refer to the Configuration File Overview.

The import statements needed for the following walkthrough:

import kam.v1.app_configuration as ac
import service
import service.container as c
import network as n

The kcl.mod must contain reference to the network module:

#...

[dependencies]
network = { oci = "oci://ghcr.io/kusionstack/network", tag = "0.2.0" }

#...

Private vs Public Access

Private network access means the service can only be access from within the target cluster.

Public access is implemented using public load balancers on the cloud. This generally requires a Kubernetes cluster that is running on the cloud with a vendor-specific service controller.

Any ports defined default to private access unless explicitly specified.

To expose port 80 to be accessed privately:

import kam.v1.app_configuration as ac
import service
import service.container as c
import network as n

myapp: ac.AppConfiguration {
    workload: service.Service {
        # ...
    }
    accessories: {
        "network": n.Network {
            ports: [
                n.Port {
                    port: 80
                }
            ]
        }
    }
}

To expose port 80 to be accessed publicly:

import kam.v1.app_configuration as ac
import service
import service.container as c
import network as n

myapp: ac.AppConfiguration {
    workload: service.Service {
        # ...
    }
    accessories: {
        "network": n.Network {
            ports: [
                n.Port {
                    port: 80
                    public: True
                }
            ]
        }
    }
}

info

The CSP (Cloud Service Provider) used to provide load balancers is defined by platform engineers in workspace.

Mapping ports

To expose a port 80 that maps to a different port 8088 on the container:

import kam.v1.app_configuration as ac
import service
import service.container as c
import network as n

myapp: ac.AppConfiguration {
    workload: service.Service {
        # ...
    }
    accessories: {
        "network": n.Network {
            ports: [
                n.Port {
                    port: 80
                    targetPort: 8088
                }
            ]
        }
    }
}

Exposing multiple ports

You can also expose multiple ports and configure them separately.

To expose port 80 to be accessed publicly, and port 9099 for private access (to be scraped by Prometheus, for example):

import kam.v1.app_configuration as ac
import service
import service.container as c
import network as n

myapp: ac.AppConfiguration {
    workload: service.Service {
        # ...
    }
    accessories: {
        "network": n.Network {
            ports: [
                n.Port {
                    port: 80
                    public: True
                }
                n.Port {
                    port: 9099
                }
            ]
        }
    }
}

Choosing protocol

To expose a port using the UDP protocol:

import kam.v1.app_configuration as ac
import service
import service.container as c
import network as n

myapp: ac.AppConfiguration {
    workload: service.Service {
        # ...
    }
    accessories: {
        "network": n.Network {
            ports: [
                n.Port {
                    port: 80
                    targetPort: 8088
                    protocol: "UDP"
                }
            ]
        }
    }
}