Consul 1.15 Service Mesh With Consul Connect — 15 Questions

Question 1

When using Consul intentions, what is the default behavior if no intention is found for a service pair?

Accepted Answer

Explicit Allow.. By default, Consul operates on a 'deny all' or 'allow all' basis depending on configuration, but in a standard Connect deployment, the default is 'allow' unless intention enforcement is enabled.

Answer

Explicit Deny.

Answer

The request is buffered.

Answer

The connection is rejected by the agent.

Question 2

What does the 'kind' field in a service definition specify for a Consul Connect service?

Accepted Answer

The proxy type (e.g., 'connect-proxy').. The 'kind' field defines if the service is a standard service or a proxy/mesh-gateway.

Answer

The service version.

Answer

The datacenter location.

Answer

The language of the application.

Question 3

Which component acts as the default sidecar proxy for Consul Connect?

Accepted Answer

Envoy. Envoy is the default and recommended sidecar proxy for Consul Connect.

Answer

Nginx

Answer

HAProxy

Answer

Linkerd

Question 4

When using 'Consul Connect native' integration, how does the application handle mTLS?

Accepted Answer

The application uses the local Consul agent API to fetch identity certificates.. In native integration, the application uses the Consul API to retrieve certificates and handles the mTLS handshake itself.

Answer

mTLS is disabled by default for native apps.

Answer

The sidecar proxy handles all mTLS.

Answer

The Consul agent performs the TLS handshake on behalf of the app.

Question 5

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

Accepted Answer

A mesh gateway deployment.. Mesh gateways are required to route cross-datacenter traffic in a Consul Connect mesh.

Answer

Direct VPC peering.

Answer

An external service definition.

Answer

A global intention.

Question 6

A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?

Accepted Answer

Update the CA configuration to include the new root in the 'additional_roots' field.. Consul supports a 'prepared_ca' rotation where the new CA is added to the trust bundle before the old one is removed.

Answer

Disable mTLS globally, update, and re-enable.

Answer

Delete the existing CA and restart all agents.

Answer

Use the 'consul tls ca create' command with the --rotate flag.

Question 7

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

Accepted Answer

consul intention create -deny service-a service-b. Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.

Answer

consul intention create -allow-none service-a service-b

Answer

consul intention set -action=drop service-a service-b

Answer

consul intention delete service-a service-b

Question 8

You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?

Accepted Answer

Envoy access log. The sidecar proxy logs, typically routed to stdout or a specific file via the proxy configuration, contain Envoy access logs.

Answer

System syslog

Answer

Consul server audit log

Answer

Consul agent log

Question 9

You are configuring a sidecar proxy for a service named 'web'. Which configuration stanza in the service definition correctly defines the proxy's inbound port for Connect traffic?

Accepted Answer

proxy { local_bind_port = 8080 }. The 'proxy' configuration block within the service definition allows for the 'local_bind_port' and 'config' keys to define proxy behavior.

Answer

sidecar { port = 8080 }

Answer

config { inbound_port = 8080 }

Answer

service { connect { port = 8080 } }

Question 10

Which command displays all active intentions in the Consul mesh?

Accepted Answer

consul intention list. The 'consul intention list' command provides the current list of intentions.

Answer

consul connect intentions

Answer

consul kv get intentions

Answer

consul services intentions

Question 11

What is the primary role of the Consul Connect 'upstream' configuration?

Accepted Answer

To define the services that a local service can connect to.. Upstreams define the dependencies of a service, allowing the proxy to route to specific services.

Answer

To set intention priority.

Answer

To register external services.

Answer

To define health check ports.

Question 12

What is the function of the 'consul connect envoy' command?

Accepted Answer

To launch and manage the Envoy proxy sidecar for a service.. This command bootstraps and manages the lifecycle of the Envoy sidecar process.

Answer

To generate TLS certificates for Envoy.

Answer

To verify the Envoy binary installation.

Answer

To update the Envoy configuration via CLI.

Question 13

How are intentions applied to services in different partitions or namespaces?

Accepted Answer

You must specify the namespace in the intention definition.. Intentions are scoped to the namespace, and cross-namespace intentions require the namespace name.

Answer

Intentions only work within the 'default' namespace.

Answer

Intentions are always global.

Answer

They must be created via API only.

Question 14

Which protocol is used for the control plane communication between the Consul agent and the sidecar proxy?

Accepted Answer

gRPC. The Consul agent communicates with the sidecar proxy (Envoy) using the Envoy xDS API.

Answer

Consul RPC

Answer

REST

Answer

HTTP/1.1

Question 15

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

Accepted Answer

Consul Connect can delegate CA operations to an external provider like SPIRE.. SPIRE can act as the CA (Certificate Authority) for Consul, issuing identities to services within the mesh.

Answer

Only static certificates can be used.

Answer

Consul must be disabled.

Answer

SPIRE replaces the Consul agent.