Service stop checking intention rules after 2 checks

Consul
1

I have case where a service stop checking intention rules after 2 times and then no matter new intention rules added / modification, it won’t take effect

and another case where a service always check intention rules (I suspect this is the expected behavior)

I checked by tailing the consul client logs and grep -i authz shown below

    2020-09-04T10:40:01.175Z [DEBUG] agent.envoy: Connect AuthZ ALLOWED: source=spiffe://9a093476-498e-4adb-81b4-74b6126047e3.consul/ns/default/dc/us-east-1/svc/staging-test-header-based-routing destination=spiffe://9a093476-498e-4adb-81b4-74b6126047e3.consul/ns/default/dc/us-east-1/svc/user-auth reason="ACLs disabled, access is allowed by default"
    2020-09-04T10:40:55.668Z [DEBUG] agent.envoy: Connect AuthZ ALLOWED: source=spiffe://9a093476-498e-4adb-81b4-74b6126047e3.consul/ns/default/dc/us-east-1/svc/userapi destination=spiffe://9a093476-498e-4adb-81b4-74b6126047e3.consul/ns/default/dc/us-east-1/svc/user-auth reason="ACLs disabled, access is allowed by default"

My questions are:

  • what is the expected behaviour? Do every service-to-service calls need to always check intention rules?
  • I can’t find anything different between the two services in terms of consul annotations. Could anyone help me understand more here?
2

The current version of Consul (pre-1.9.0) configures Envoy to use an ext_authz callback to enforce intentions. This is configured as a network filter, which means it’s enforcing auth at Layer 4 (tcp) and not Layer 7 (http).

Another way to think of this is that it’s enforcing auth on connections and not requests. If a client opens a connection for use in making HTTP requests and subsequently pools that connection for reuse, it means that only the initial connection establishment attempt goes through an intention check.

In the next release of Consul (1.9.0) one of the big changes to the intentions enforcement model is that when a service is explicitly configured as having a protocol value of http/http2/grpc then we’ll switch from connection-auth to request-auth

1 Like