Consul ACL scope

[blake]

Hi @Dahnepfl,

@Dahnepfl

Is there a way to add and configure new http filters to the Envoy Proxy ? There is existing JWT authentication filters that can be configured in Envoy.

Consul’s escape-hatch overrides could potentially be used to add JWT verification and processing to the inbound listeners for sidecar proxies.

Assuming you could get it to work, it would only apply to east-west traffic. Consul does not currently support installing escape hatch configurations on ingress gateways for north-south traffic. (see hashicorp/consul#8722).

@Dahnepfl

I have already used it in Kuma: Proxy Template | Kuma
They have a configuration file that can be used to add custom filters configuration to the Envoy Proxy. Then, this configuration is deployed to all the sidecar proxies.
Is there a similar feature with Consul ?

The escape hatch is the closet thing Consul has to Kuma’s Proxy Template, or Istio’s EnvoyFilter resource, however I would not consider it equivalent because it does not support match, patch or remove operations. Certain hatches require a full replacement of the target configuration whereas others are only able to add additional configuration at the specified certain injection points.

We are open to improving the escape hatch to offer more flexibility like the ProxyTemplate or EvnoyFilter resources. I recommend filing a GitHub issue with details of your use case so that we can discuss and track this feature request.

@Dahnepfl

Is it also possible to use Consul ACLs for service-to-service communication ? Something similar to Istio JWT token authentication: Istio / JWT Token

Similarly to the escape hatch enhancements, we’re open to considering extending intentions to formally support JWT token auth. I’d also recommend commenting on the following GitHub issue with your use case so that our engineering team can review your requirements, and discuss how we might be able to support this.

Validation of JWT token passed through service mesh

Thanks.