I want configure mtls and enforce connection between services.
In order for the services to start communicating via envoy with this, I need to configure the consul annotation upstream: ‘api: 4000’, then the web will be able to access the api via localhost: 4000. After that, I will be able to configure intentions, but intention will only work on localhost: 4000. And if you access the api through the domains that service discovery creates, for example api. default.svc, api.service.consul, then web will ignore envoy and go directly to the api, therefore, no mtls and intention does not work.
Demonstrate that on practice:
Create to pods static-client and static-server
metadata: name: static-client annotations: 'consul.hashicorp.com/connect-inject': 'true' 'consul.hashicorp.com/connect-service-upstreams': 'static-server:1234'
metadata: name: static-server annotations: 'consul.hashicorp.com/connect-inject': 'true'
$: kubectl get pods NAME READY STATUS RESTARTS AGE static-client 3/3 Running 0 155m static-server 3/3 Running 0 155m
Check connection from static-client to static-server, without intentions:
$: k exec -it static-client -c static-client -- /bin/bash static-client$: curl localhost:1234 "hello world" static-client$: curl static-server.service.consul:8080 "hello world" static-client$: curl static-server.api.svc.cluster.local:8080 "hello world"
$: consul intention match -destination static-server static-client => static-server (deny)
Check connection from static-client to static-server, with intentions:
static-client$: curl localhost:1234 curl: (52) Empty reply from server static-client$: curl static-server.service.consul:8080 "hello world" static-client$: curl static-server.api.svc.cluster.local:8080 "hello world"
How to combine service discovery and sidecar in consul?