Zero‑Intrusion Node.js & Nginx Microservices on Tencent TSF Mesh: A Step‑by‑Step Guide

Background

TSF Mesh is Tencent Cloud's Service Mesh platform built on the CNCF open‑source projects Istio and Envoy. It offers a complete set of capabilities such as service registration and discovery, fine‑grained traffic governance, monitoring, logging, and configuration management.

Goal

The aim is to let front‑end developers who work with Node.js quickly create micro‑service applications without modifying existing code, by deploying Node.js and Nginx as services on TSF Mesh, achieving zero‑intrusion integration.

Architecture Overview

The following diagram illustrates the overall architecture, where Node.js and Nginx run as independent services registered in TSF Mesh and communicate via service names.

Step‑by‑Step Implementation

1. Build and Push Node.js Image

Prepare the Node.js application code (a demo can be obtained by sending the keyword demo).

Create a Dockerfile for the Node.js service (based on node:14) and a start.sh script to launch the app.

Write TSF Mesh configuration files: spec.yaml and apis/nodejs-service.yaml to define the service, ports, and health‑check.

Build the Docker image and push it to Tencent Cloud Container Registry.

FROM node:14
RUN mkdir -p /usr/src/app
WORKDIR /usr/src/app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["./start.sh"]  # start via start.sh

#!/bin/bash
already_run=`ps -ef|grep "node"|grep -v grep|wc -l`
if [ $already_run -ne 0 ]; then
    echo "nodejs-john alreadyRunning!!!!"
    exit -1
fi
mkdir -p /opt/tsf/app_config/apis
cp /usr/src/app/spec.yaml /opt/tsf/app_config/
cp -r /usr/src/app/apis /opt/tsf/app_config/
cd /usr/src/app/
nohup node ./bin/www 1>./logs/nodejs-service.log 2>&1 &

apiVersion: v1
kind: Application
spec:
  services:
    - name: nodejs-service # Service name
      ports:
        - targetPort: 3000 # Service listening port
          protocol: http # Supports HTTP and HTTP2 (for gRPC)
      healthCheck:
        path: /users # Health‑check URL, e.g., curl http://nodejs-service/users

openapi: 3.0.0
info:
  version: "1.0.0"
  title: nodejs-service
paths:
  /users:
    get:
      responses:
        '200':
          description: OK
        '401':
          description: Unauthorized
        '402':
          description: Forbidden
        '403':
          description: Not Found

# Build and push image
cd {Dockerfile directory}
docker pull node:14
docker build -t mesh-nodejs:v1.0 .
sudo docker login --username={uid} ccr.ccs.tencentyun.com
sudo docker tag {image_id} ccr.ccs.tencentyun.com/tsf_{uid}/nodejs:v1.0
sudo docker push ccr.ccs.tencentyun.com/tsf_{uid}/nodejs:v1.0

2. Build and Push Nginx Image

Create a Dockerfile based on nginx:stable-alpine that copies static resources and sets the timezone.

Provide a start.sh script that launches Nginx and keeps the container alive.

Build the image and push it to the same registry.

FROM nginx:stable-alpine
RUN echo "ip_resolve=4" >> /etc/yum.conf
RUN /bin/cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
RUN echo "Asia/Shanghai" > /etc/timezone
WORKDIR /usr/share/nginx/html
COPY . .   # copy static files
RUN chmod +x start.sh stop.sh
CMD ["./start.sh"]  # start via start.sh, which creates /opt/tsf/app_config

#!/bin/sh
mkdir -p /opt/tsf/app_config
cp spec.yaml /opt/tsf/app_config/
while true; do
    already_run=`ps -ef|grep "nginx"|grep -v grep|wc -l`
    if [ $already_run -eq 0 ]; then
        nohup nginx -c /etc/nginx/nginx.conf 1>/var/log/nginx/nginx-service.log 2>&1 &
    fi
    sleep 10
done

# Build and push Nginx image
cd {Dockerfile directory}
docker build -t mesh-nginx:v1.0 .
sudo docker tag {image_id} ccr.ccs.tencentyun.com/tsf_{uid}/nginx:v1.0
sudo docker push ccr.ccs.tencentyun.com/tsf_{uid}/nginx:v1.0

3. Deploy Services on TSF Mesh

Import host resources into the TSF container cluster.

Create two applications in TSF: one for Node.js, one for Nginx.

Create deployment groups for each application.

Deploy the previously pushed images via the deployment groups.

All operations are performed through the TSF console; the UI screenshots illustrate each step.

4. Verify Connectivity

Access the Node.js service directly via its external IP and port.

Test the API endpoint through TSF's service governance console.

Enter the Node.js container and curl the Nginx service by its service name.

Enter the Nginx container and curl the Node.js service similarly.

# Find container ID
sudo docker ps   # locate the container
# Exec into container
sudo docker exec -it {container_id} /bin/bash
# Test from Node.js container
curl http://nginx-service
# Test from Nginx container
curl http://nodejs-service/users

Both calls succeed, confirming that service discovery and sidecar proxying work as expected.

Conclusion

TSF Mesh combines data‑plane and control‑plane sidecars to provide L7 proxying within the same pod, enabling full micro‑service governance and operations. The basic connectivity tests prove that non‑Java workloads such as Node.js, PHP, or Python can be integrated with near‑zero code changes, making TSF Mesh an ideal solution for heterogeneous or legacy system migration.