Consul 1.15 Service Mesh With Consul Connect — Timed 20 Questions

Question 1

When using Consul intentions, what is the default behavior if no intention is found for a service pair?

Accepted Answer

Explicit Allow.. By default, Consul operates on a 'deny all' or 'allow all' basis depending on configuration, but in a standard Connect deployment, the default is 'allow' unless intention enforcement is enabled.

Answer

Explicit Deny.

Answer

The request is buffered.

Answer

The connection is rejected by the agent.

Question 2

What does the 'kind' field in a service definition specify for a Consul Connect service?

Accepted Answer

The proxy type (e.g., 'connect-proxy').. The 'kind' field defines if the service is a standard service or a proxy/mesh-gateway.

Answer

The service version.

Answer

The datacenter location.

Answer

The language of the application.

Question 3

Which component acts as the default sidecar proxy for Consul Connect?

Accepted Answer

Envoy. Envoy is the default and recommended sidecar proxy for Consul Connect.

Answer

Nginx

Answer

HAProxy

Answer

Linkerd

Question 4

When using 'Consul Connect native' integration, how does the application handle mTLS?

Accepted Answer

The application uses the local Consul agent API to fetch identity certificates.. In native integration, the application uses the Consul API to retrieve certificates and handles the mTLS handshake itself.

Answer

mTLS is disabled by default for native apps.

Answer

The sidecar proxy handles all mTLS.

Answer

The Consul agent performs the TLS handshake on behalf of the app.

Question 5

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

Accepted Answer

A mesh gateway deployment.. Mesh gateways are required to route cross-datacenter traffic in a Consul Connect mesh.

Answer

Direct VPC peering.

Answer

An external service definition.

Answer

A global intention.

Question 6

A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?

Accepted Answer

Update the CA configuration to include the new root in the 'additional_roots' field.. Consul supports a 'prepared_ca' rotation where the new CA is added to the trust bundle before the old one is removed.

Answer

Disable mTLS globally, update, and re-enable.

Answer

Delete the existing CA and restart all agents.

Answer

Use the 'consul tls ca create' command with the --rotate flag.

Question 7

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

Accepted Answer

consul intention create -deny service-a service-b. Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.

Answer

consul intention create -allow-none service-a service-b

Answer

consul intention set -action=drop service-a service-b

Answer

consul intention delete service-a service-b

Question 8

You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?

Accepted Answer

Envoy access log. The sidecar proxy logs, typically routed to stdout or a specific file via the proxy configuration, contain Envoy access logs.

Answer

System syslog

Answer

Consul server audit log

Answer

Consul agent log

Question 9

You are configuring a sidecar proxy for a service named 'web'. Which configuration stanza in the service definition correctly defines the proxy's inbound port for Connect traffic?

Accepted Answer

proxy { local_bind_port = 8080 }. The 'proxy' configuration block within the service definition allows for the 'local_bind_port' and 'config' keys to define proxy behavior.

Answer

sidecar { port = 8080 }

Answer

config { inbound_port = 8080 }

Answer

service { connect { port = 8080 } }

Question 10

Which command displays all active intentions in the Consul mesh?

Accepted Answer

consul intention list. The 'consul intention list' command provides the current list of intentions.

Answer

consul connect intentions

Answer

consul kv get intentions

Answer

consul services intentions

Question 11

What is the primary role of the Consul Connect 'upstream' configuration?

Accepted Answer

To define the services that a local service can connect to.. Upstreams define the dependencies of a service, allowing the proxy to route to specific services.

Answer

To set intention priority.

Answer

To register external services.

Answer

To define health check ports.

Question 12

What is the function of the 'consul connect envoy' command?

Accepted Answer

To launch and manage the Envoy proxy sidecar for a service.. This command bootstraps and manages the lifecycle of the Envoy sidecar process.

Answer

To generate TLS certificates for Envoy.

Answer

To verify the Envoy binary installation.

Answer

To update the Envoy configuration via CLI.

Question 13

How are intentions applied to services in different partitions or namespaces?

Accepted Answer

You must specify the namespace in the intention definition.. Intentions are scoped to the namespace, and cross-namespace intentions require the namespace name.

Answer

Intentions only work within the 'default' namespace.

Answer

Intentions are always global.

Answer

They must be created via API only.

Question 14

Which protocol is used for the control plane communication between the Consul agent and the sidecar proxy?

Accepted Answer

gRPC. The Consul agent communicates with the sidecar proxy (Envoy) using the Envoy xDS API.

Answer

Consul RPC

Answer

REST

Answer

HTTP/1.1

Question 15

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

Accepted Answer

Consul Connect can delegate CA operations to an external provider like SPIRE.. SPIRE can act as the CA (Certificate Authority) for Consul, issuing identities to services within the mesh.

Answer

Only static certificates can be used.

Answer

Consul must be disabled.

Answer

SPIRE replaces the Consul agent.

Question 16

Which service definition field is used to link a sidecar proxy to its parent service?

Accepted Answer

destination_service_name. The 'proxy' block inside the 'service' definition contains the 'destination_service_name' to link it.

Answer

parent_service

Answer

service_id

Answer

linked_service

Question 17

What happens if a service proxy loses its connection to the local Consul agent?

Accepted Answer

The proxy enters a 'stale' state and uses the last known config.. The proxy will be unable to receive configuration updates and health status, potentially leading to service disruption.

Answer

The proxy shuts down automatically.

Answer

The proxy automatically switches to a local health-check mode.

Answer

The proxy attempts to connect to a random Consul server.

Question 18

Which CLI command would you use to check the status of a Connect-enabled service?

Accepted Answer

consul health service <name>. The 'consul catalog services' or 'consul health service' command shows the status, including Connect capabilities.

Answer

consul status

Answer

consul connect status

Answer

consul proxy check

Question 19

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

Accepted Answer

It enables communication between services in different datacenters.. Mesh gateways provide a single point of ingress/egress for cross-datacenter traffic, reducing the need for direct cross-DC networking.

Answer

It encrypts traffic at the storage layer.

Answer

It improves local mTLS performance.

Answer

It provides load balancing for local services.

Question 20

What is the purpose of the 'upstreams' block in a service definition?

Accepted Answer

To configure the outbound dependencies of the service.. It defines the targets that the sidecar proxy should be allowed to proxy requests to.

Answer

To set the service's health check interval.

Answer

To limit the total number of connections.

Answer

To define the ingress rules.