Feature Request: Add support for multiple listeners on Virtual Node and Virtual Router

[kiranmeduri]

Tell us about your request
What do you want us to build?
Today, virtual-node and virtual-router only allow single listener. Some applications have use-cases where they need to expose multiple ports and they cannot use App Mesh to support communication between these applications. Below are some sample applications

1. Service supports multiple protocols e.g. HTTP and gRPC
2. Service supports multiple access domains e.g. Admin port, Traffic port
3. ... Please add more

Which integration(s) is this request for?
None

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

Are you currently working around this issue?
How are you currently solving this problem?
Today I have to run multiple versions of service per port exposed. This increases cost and management.

Additional context
Anything else we should know?

Attachments
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

[piontas]

Another use case is when you have applications metrics, health checks running on different port.

There is no option to allow, whitelist or ignore TCP ingress port in App Mesh settings / ENV variables.

Example deployment configuration

containers:
        - name: dummy-name
          image: "dummy-repo/dummy-image
          ports:
            - name: service
              containerPort: 8080
              protocol: TCP
            - name: health
              containerPort: 8081
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8081
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8081
            timeoutSeconds: 30

Is there any other way to solve it?

[KushalP]

Any further news on this? When using AppMesh we're having to comment out our Deployment configuration to be:

containers:
  - name: dummy-name
    image: "dummy-repo/dummy-image"
    ports:
      - name: service
        containerPort: 8080
        protocol: TCP
      - name: health
        containerPort: 8081
        protocol: TCP
    # App Mesh doesn't support more than one listener as of today.
    # Whenever it's supported we will use liveness and readiness
    # probes.
    # See: https://github.com/aws/aws-app-mesh-roadmap/issues/120
    # livenessProbe:
    #   httpGet:
    #     path: /liveness
    #     port: 8081
    #   timeoutSeconds: 5
    # readinessProbe:
    #   httpGet:
    #     path: /readiness
    #     port: 8081
    #   timeoutSeconds: 30

As a result, we're forced to blind deploy pods that expect to have these checks occur on a separate port.

[KushalP]

Is it possible to have APPMESH_IGNORED_INGRESS_PORTS similar to the egress env var to get around this in the short-term?

[malphi]

This request make sense. Our case is that: a service provide http and grpc call for clients, when different clients use both protocol to access, it doesn't work. Such as ELB use http for health check, another client use grpc for business logic.
In istio, VirtualService can handle this request with multiple routes, but VirtualNode of AppMesh cannot support that.

[treynash]

Is there any more specific update on this issue other than Accepted? Unfortunately, this issue is preventing us from using appmesh in some of our scenarios because we must expose multiple ports with multiple protocols.

[awsiv]

Affects us as well:

For spring apps, its normal to have service port eg. 8080 and management port eg. 9180/health. The healthcheck port should be allowed to be different from listener port. Currently both must be the same