(How) Do Sidecar Proxies Work Without Containers?

Consul
,
1

Context: Using Nomad to orchestrate Java applications (Tomcat, using exec), with Consul providing the service mesh.

How do sidecar proxies (specifically Envoy) work without containers? I’d like to run a group of Tomcat servers using Nomad’s exec driver. Following the service mesh idioms I should have a sidecar running with each instance of Tomcat. Is this possible at all, given that Tomcat will not be running inside containers?

I’m very new to Nomad and Consul. Do point me in the right direction if this has been answered elsewhere.

Thanks in advance.

2

Sure, i’m doing it in production, you need to explicitly declare the sidecar service systemd unit for each service (either inbound or outbound).

I usually use this config:

[Unit]
Requires=network-online.target
After=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/consul connect envoy \
    -token-file /my-token-file \
    -admin-bind localhost:0 \
    -sidecar-for my-service-name
Restart=on-failure
RestartSec=15
User=my-service-user
KillMode=process
KillSignal=SIGKILL
LimitNOFILE=65536
TimeoutSec=120
TimeoutStopSec=120

[Install]
WantedBy=multi-user.target
1 Like
3

Thanks! Will try this out as soon as I have my Vagrant/Virtualbox local cluster up and running.

Noob question: do I declare the sidecar per instance of my service (Tomcat in my case)?

4

Yes, each service instance must have one dedicated sidecar instance if it has at least one inbound connection or outbound dependency, the sidecar covers multiple inbound and outbound, you never need more than one per service instance.
Even if you use a plethora or sidecars the memory footprint will be lowered by the kernel, so it’s not that high.

You could access sidecars which are not specific to your service, but it would cause a mess keeping record and from security prospective, avoid it.

1 Like
5

:+1: Thanks for the quick revert.

I’m guessing that the above systemd service definition should be parametrised using a template in order create multiple instances of the same (sidecar) service. Is that correct?

6

Yes, I recommend using this approach if you’re going to be running multiple proxies on the same host.

Here’s an example systemd unit I wrote a while back that you can use as a starting point to customize for your environment.

1 Like
7

Thanks @blake. This is really helpful :100: