CCNA Service Mesh With Consul Connect Questions

The 'consul health service' command displays the health checks associated with a service, including the sidecar proxy if it is registered as a service. For a Connect-enabled service, the sidecar proxy is registered as a separate service named 'inventory-sidecar-proxy'. Running 'consul health service inventory' shows the health of the main service, and you can also check the sidecar proxy's health. This command is the standard way to verify service and proxy status.

Cross-signing the new intermediate with the old root creates a chain of trust that both old and new proxies can validate. Updating the CA configuration with the bundle lets Consul distribute the new root while the old root remains trusted. Leaf certificates are rotated automatically by the CA provider, so existing connections are not forcibly broken and the transition is seamless.

The 'connect' stanza with 'enabled = true' in the Consul agent configuration enables the Connect feature on that agent. When enabled on servers, it allows the datacenter to issue and manage certificates for Connect. This is the correct setting to globally enable Connect and mTLS. Without it, Connect features are not active.

Intentions provide this.

`consul intention list` queries the intention endpoint directly, returning every active intention across the mesh with source, destination and action. It satisfies the stem's requirement to display all active intentions without filtering by service name, unlike `consul intention check`, which tests a single source-destination pair.

Consul Connect enforces mutual TLS between services, issuing SPIFFE-based identities via its built-in CA, so every connection is authenticated and encrypted regardless of network location. That satisfies zero-trust networking, where trust derives from verified service identity rather than perimeter defences.

The `consul intention check` command evaluates the intention rules governing a connection between a specified source and destination service, returning whether that traffic is permitted or denied. It directly satisfies the stem's requirement to verify authorisation between two services, without modifying any configuration.

Upstreams are declared on the consuming service's sidecar proxy. Specifying destination_name (and optionally a local_bind_port) instructs the sidecar to open a local listener that forwards to the database through the mesh, so the application uses a stable local address rather than a hard-coded IP.

Connect uses a default-deny posture for inbound mesh traffic, so a service with a sidecar rejects any connection that is not explicitly authorized by an intention. Creating allow intentions for the specific callers grants exactly the required access. The sidecar also requires mTLS, so callers without a valid Connect certificate cannot complete the handshake in the first place.

The sidecar proxy for a service named 'inventory' is registered as 'inventory-sidecar-proxy'. The 'consul health service' command queries the health of a specific service, returning checks and node information. This directly verifies that the sidecar proxy is running and healthy, which is the required task.

Consul Connect uses a default-deny model for intentions. When no intention explicitly allows a connection, it is denied. In this scenario, only 'web' is allowed to connect to 'api', so all other services are denied by default. This ensures a secure zero-trust network. The default behavior applies unless overridden by a higher-priority intention or a wildcard allow.

The `kind` field declares the service registration type, with `connect-proxy` marking a sidecar proxy instance rather than a standard service. This satisfies Consul's requirement to distinguish proxy registrations from application services, enabling Connect to route traffic through the correct proxy for mTLS enforcement.

Consul Connect native integration embeds the mTLS handshake directly into the application, which manages its own certificates and identity rather than delegating to a sidecar proxy. This app-managed handshake is the defining feature distinguishing native integration from proxy-based service mesh.

The identity certificate, issued by Consul's CA to the service, supplies the client or server leaf credential presented during the TLS exchange. Its embedded SPIFFE URI determines the peer identity verified against intentions, directly shaping the mTLS handshake outcome.

The consul intention list command queries the intention endpoint and prints every intention in the current datacenter, including source, destination, action, and precedence metadata. It is the direct, read-only way to audit mesh authorization rules. Operators use it to confirm that expected allow or deny rules exist before troubleshooting connectivity.

Intentions enforce service-to-service authorisation by evaluating allow or deny rules against the source and destination service identities in a mutual TLS session. This directly satisfies the stem's requirement for service authorization, since Consul Connect uses intentions as its mechanism for permitting or refusing connections between services.

Intentions enforce service-to-service authorization based on service identity, and mTLS ensures that only services with valid certificates from the Consul CA can establish connections. This combination restricts incoming traffic to 'checkout' while requiring certificate validation, meeting both requirements.

Mesh gateways provide a single entry point that routes Consul Connect traffic between datacenters, letting services in separate datacenters reach each other without direct network peering or sidecar-to-sidecar links across WAN boundaries. This satisfies the stem's cross-datacenter communication requirement, unlike ingress gateways, which only expose services within one datacenter.

An upstream entry causes the web sidecar to open a local port that the web application connects to. The sidecar then forwards that traffic through the mesh to a healthy api proxy instance, using the port specified in the upstream. This decouples the application from service discovery and lets Connect handle mTLS and load balancing.

The local_bind_port field fixes the port on which the sidecar listens for that upstream. Assigning 8080 makes the application's hard-coded address valid. After updating the registration and restarting the sidecar, the listener binds to the chosen port and forwards to the upstream over the mesh.

Service splitting uses a service resolver with a splitter configuration to route a defined percentage of traffic to the canary subset while the remainder goes to the stable version, satisfying the gradual, controlled traffic-shifting constraint of a canary deployment.

Consul accepts JSON service definition files as a first-class configuration method, loaded via the agent's config directory or the /agent/service/register endpoint. This satisfies the stem's requirement for a valid Connect configuration mechanism alongside HCL definitions.

Using a wildcard source intention for the 'frontend' namespace allows all services within that namespace to access 'payments', while setting the default intention behavior to deny ensures that any other source is blocked. This is efficient because it requires only one intention and a global default, rather than creating individual intentions for every service in the frontend namespace. It leverages Consul Enterprise namespaces to group services logically.

Creating a wildcard deny intention for all sources to 'payments' blocks any service by default. Then a specific allow intention for 'checkout' to 'payments' overrides the deny for that source. Consul evaluates intentions with specificity, so the more specific allow takes precedence. This achieves the desired least-privilege access control.

Ingress gateway listeners that terminate TLS require a server certificate and key. Without them the listener cannot complete the handshake, which matches the observed failures. Consul can source these from inline configuration, a file path, or an external SDS provider such as Vault, and the gateway then presents the certificate to clients.

Consul's client agent obtains the leaf certificate and key from the server via the Connect CA, then serves them to the local Envoy sidecar through the xDS API. This satisfies the requirement that certificates reach proxies without manual distribution.

Cross-datacenter service-to-service traffic traverses the WAN through mesh gateways, which proxy Consul's mTLS connections between datacenters. Deploying a mesh gateway in each datacenter is required so the local sidecar can reach the remote service without direct network peering.

Consul Connect's CA interface is pluggable, so it can delegate certificate signing and issuance to an external provider such as SPIRE rather than using the built-in CA. This lets SPIRE-issued identities secure service mesh mTLS without replacing Connect.

Sidecar proxies can be configured to emit access logs that record each incoming connection, including source service identity and timestamp. This provides the necessary audit trail for connections to 'api'. Configuring access logs on the proxy is the standard way to achieve connection logging in Consul Connect.

Envoy's `/stats` endpoint exposes per-sidecar metrics for every proxied connection, including request rates, latency histograms and upstream health. Since Consul Connect injects Envoy as the data-plane proxy, scraping these endpoints directly satisfies the requirement to monitor service-mesh performance at the connection level.

Envoy is the default sidecar proxy that Consul Connect injects alongside services, handling mTLS and L4 authorisation between them. It satisfies the stem because Consul ships Envoy as the built-in proxy, though the interface allows alternative proxies to be registered.

The upstreams block declares a service's outbound dependencies, letting Consul register each remote service as a local listener that load-balances across healthy instances. This satisfies the stem's requirement to define what the service calls out to, distinct from service registration or health checking.

Consul Connect follows a default-deny model for intentions. If no intention explicitly allows traffic between two services, the connection is denied. For connections that are allowed, mTLS is automatically enforced by the sidecar proxies. This ensures a secure Zero Trust network.

Envoy proxy logs contain detailed information about connection attempts, including upstream cluster selection, TLS handshakes, and errors such as connection refused or timeout. Since the sidecar proxy is Envoy, its logs are the most direct source for diagnosing why it cannot reach the 'backend' upstream. These logs are typically written to a file or stdout depending on the proxy configuration. Inspecting them first will reveal specific failure reasons.

With Consul Connect native integration, the application itself performs mTLS by calling the local Consul agent's API to obtain its leaf identity certificate and CA bundle, then uses those credentials directly for encrypted, authenticated service-to-service communication.

To enable L7 features such as path-based routing, the service must declare its protocol as 'http' or 'grpc'. Then a service-router config entry can define routing rules based on HTTP attributes. This combination allows Consul to configure Envoy to inspect HTTP requests and route accordingly, meeting the requirement.

The 'consul intention list' command queries Consul and displays all intentions that have been created. It shows the source and destination services, the action (allow or deny), and other metadata. This is the correct command to verify the current intentions in the mesh. It is a straightforward and commonly used command for auditing Connect authorization.

An upstream block declares the service dependencies a local sidecar proxy should establish, generating listeners and intentions for outbound Connect traffic. This satisfies the stem's constraint: defining which services the local service can connect to.

SourceNamespace is the correct attribute to enforce that the source service resides in a specific Consul Enterprise namespace. By setting SourceNamespace to the desired namespace, the intention only matches connections from 'frontend' within that namespace. This provides the granular control needed to restrict traffic based on namespace, which is critical in multi-tenant environments. Other attributes do not capture namespace information.

The upstreams block inside the service definition accepts destination_name to identify the target service and local_bind_port to fix the loopback port the sidecar listens on. This exact HCL syntax lets the local application reach the upstream at a predictable address.

In Consul 1.15, when no intention matches a service pair, Connect defaults to deny. Explicitly creating an allow intention between the source 'web' and destination 'payments' authorizes the L4 connection and is the intended way to open traffic under the default-deny model.

Connect must be enabled in the agent configuration so proxies can be injected, and a default-deny intention ensures no service is reachable over the mesh without an explicit allow. Restricting the application to loopback or making it reachable only via the proxy forces all inbound traffic through mTLS, so plaintext connections from non-mesh clients are refused.

Consul's default behavior when no intention matches is to deny the connection. By creating a single allow intention from checkout to payments, only checkout can connect; every other service falls through to the default deny. This is the least overhead because no wildcard deny rule is needed and future services are automatically blocked.

The upstream stanza in the 'frontend' service registration tells the sidecar proxy to create a local listener that forwards traffic to the 'backend' service. Without this configuration, the frontend application has no local endpoint to send requests to, and the sidecar will not establish the mTLS connection. This stanza is necessary for the proxy to know the destination service and port.

Intentions are scoped to a namespace, so cross-namespace traffic requires the namespace explicitly named in the intention definition. This satisfies the stem's constraint that source and destination in different namespaces cannot be matched by service name alone.

The error 'no healthy upstream' indicates that the sidecar proxy cannot find any healthy instances of the upstream service. In a cross-datacenter scenario, the local Consul servers must be able to discover the remote service via the mesh gateway. If 'api' is not registered or has no healthy instances in the remote datacenter, the local proxy will report this error. This is the most likely cause.

This command directly creates a deny-type intention.

Intentions are the authorization layer in Consul Connect. They evaluate the source identity (from the client certificate) against the destination service and return allow or deny. This is independent of network ACLs or firewall rules, and it is enforced by the sidecar proxies when a connection is established. Therefore, intentions are the correct mechanism for controlling service-to-service authorization.

The proxy block declares the sidecar or native proxy that mediates inbound and outbound Connect traffic for the service. It is a valid top-level component of a Consul Connect service definition, satisfying the stem's requirement to identify Connect definition components.

When destination_type is left at its default of service, the sidecar resolves the upstream through Consul's service discovery using destination_name. The proxy watches the catalog for healthy instances and load-balances across them, so IP changes and scaling events are handled automatically. Hard-coding an address would defeat the purpose of dynamic discovery.

The `consul connect envoy` command generates the Envoy bootstrap configuration and starts the sidecar proxy process, registering it with Consul's service mesh. This directly satisfies the stem's requirement by launching and managing the per-service Envoy sidecar, handling its lifecycle and configuration without manual bootstrap files.

The upstreams block names the destination service and the local port the sidecar listens on. Binding local port 6379 lets the application connect to localhost:6379, and the sidecar transparently forwards to the 'redis' service through mTLS, satisfying the application's expectation without code changes.

The `proxy` block configures the sidecar's Envoy settings, including upstreams, listeners and bootstrap options. Incorrect values here directly prevent the proxy from starting, so it is the field to inspect first when diagnosing startup failure.

The intention check subcommand evaluates the effective authorization decision between a source and destination, reporting whether the connection is allowed or denied. It accounts for matching intentions and the default policy, making it the right tool to verify permissions without generating actual mesh traffic.

Registering a service with kind = "connect-proxy" and a proxy destination identifies it as the sidecar that fronts another service, so Consul wires the proxy's listeners and upstreams to that target rather than treating it as an ordinary service.