# Consul on k8s, how to provide ACL to service?

**URL:** <https://discuss.hashicorp.com/t/consul-on-k8s-how-to-provide-acl-to-service/20308>\
**Category:** Consul\
**Created:** [January 29, 2021, 9:34am UTC](https://discuss.hashicorp.com/t/consul-on-k8s-how-to-provide-acl-to-service/20308 "2021-01-29T09:34:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chenyg0911](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/chenyg0911/32/16838_2.png) [@chenyg0911](https://discuss.hashicorp.com/u/chenyg0911)\
**Post date:** [January 29, 2021, 9:34am UTC](https://discuss.hashicorp.com/t/consul-on-k8s-how-to-provide-acl-to-service/20308/1 "2021-01-29T09:34:04Z")

</div>

Hello, I try to test consul service mesh on k8s, which deploy with helm.  
helm manifest:

```auto
# name your datacenter
global:
  name: consul
  datacenter: l7
  tls:
generate certificate
    enabled: false

servers
    enableAutoEncrypt: false
  acls:
    manageSystemACLs: true

server:
  replicas: 1
  bootstrapExpect: 1
  disruptionBudget:
    enabled: true
    maxUnavailable: 0
  extraConfig: |
    {
      "telemetry": {
        "prometheus_retention_time": "10s"
      },
      "ui_config": {
        "enabled": true,
        "metrics_provider": "prometheus",
        "metrics_proxy": {
          "base_url": "http://prometheus-server"
        }
      }
    }

client:
  enabled: true
  grpc: true

ui:
  enabled: true
  service:
    enabled: true
    type: LoadBalancer

connectInject:
  enabled: true
  default: true
  k8sAllowNamespaces: ["consul-test"]

  centralConfig:
    enabled: true
    defaultProtocol: "http"
    proxyDefaults: |
      {
        "envoy_prometheus_bind_addr": "0.0.0.0:9102"
      }

controller:
  enabled: true

```

deploy service is the simple demo app.  
two service: web → api  
the demo is work as expect. I can provide acl through intention to enable or disable `api` service accessable.

But how can I provide acl on service `web` ?  
I try to create token and policy like below:  
web-deny.hcl

```auto
service "web" {
	policy = "deny"
}
service "web-sidecar-proxy" {
	policy = "deny"
}
service_prefix "" {
	policy = "deny"
}
node_prefix "" {
	policy = "deny"
}

```

But, when test with : `curl http://webservice`, I can get service response OK.

How I can’t restrict the service `web` accessable with a token?

---

<div class="post-metadata">

**Author:** ![lkysow](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/lkysow/32/1105_2.png) [@lkysow](https://discuss.hashicorp.com/u/lkysow)\
**Post date:** [January 29, 2021, 6:08pm UTC](https://discuss.hashicorp.com/t/consul-on-k8s-how-to-provide-acl-to-service/20308/2 "2021-01-29T18:08:19Z")

</div>

Hi, so correct me if I’m wrong but are you trying to restrict access to `web` from a user?

In this case, you would need to add a Kubernetes ingress controller or API gateway because intentions are for calls between services in the mesh (e.g. `web` =\> `api`) not for calls from outside the mesh to inside the mesh (e.g. `user` =\> `web`).

Consul does have an ingress gateway ([External \<\> Internal Services - Ingress Gateways | Consul by HashiCorp](https://www.consul.io/docs/connect/gateways/ingress-gateway)) however it does not currently support token-based authentication.

---

<div class="post-metadata">

**Author:** ![chenyg0911](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/chenyg0911/32/16838_2.png) [@chenyg0911](https://discuss.hashicorp.com/u/chenyg0911)\
**Post date:** [February 1, 2021, 2:46am UTC](https://discuss.hashicorp.com/t/consul-on-k8s-how-to-provide-acl-to-service/20308/3 "2021-02-01T02:46:55Z")

</div>

Yes, that’s I get.  
Because follow the document, when consul run out k8s, it can config service acl with token, as below:

```auto
consul acl token create -description "Token for Dashboard Service" \
  -policy-name dashboard-service
service {
  name = "dashboard",
  port = 9002,
  token = "57c5d69a-5f19-469b-0543-12a487eecc66",
  check {
    id = "dashboard-check",
    http = "http://localhost:9002/health",
    method = "GET",
    interval = "1s",
    timeout = "1s"
  }
}

```