Consul: Connect (Service Mesh) & Operations

Service Mesh: Sidecar Proxies & mTLS

// Sidecar proxy config -- a dedicated Envoy process per service
// instance intercepts traffic, handling mTLS + authorization
// transparently -- the application just talks to localhost.
service {
  name = "web-frontend"
  port = 8080

  connect {
    sidecar_service {}
  }
}

Intentions: Zero-Trust Authorization

# Explicitly declare allowed service-to-service communication --
# enforced by the sidecar proxies at the mesh level
consul intention create web-frontend api
consul intention create -deny api database-admin

# Even a compromised/misconfigured service trying to reach
# something it shouldn't gets blocked by the sidecar proxy
# enforcing these intentions, not by application-level logic.

Consul-Template: Bridging to File-Based Config

# nginx.conf.ctmpl -- watches Consul, re-renders on change, then
# can reload nginx automatically. Bridges Consul's dynamic data
# into apps that expect a static config FILE, not a live API query.
upstream payments {
{{ range service "payments-service" }}
  server {{ .Address }}:{{ .Port }};
{{ end }}
}

# consul-template -template="nginx.conf.ctmpl:/etc/nginx/nginx.conf" \
#   -exec "nginx -s reload"

ACLs & Security

• ACL tokens restrict what a given client/service/agent is authorized to do -- least-privilege beyond just network-level access control.

• Without ACLs, anyone with network access to Consul's API can read/write any KV data or service registration.

• A compromised service credential shouldn't automatically grant full control over the cluster's config/registry -- scoped ACL policies enforce that.

Where Consul Fits

• Best fit: heterogeneous infrastructure (a mix of Kubernetes, VMs, bare metal) needing consistent service discovery/mesh across all of it.

• Kubernetes's built-in discovery works well when everything is within one cluster -- Consul extends consistently beyond that boundary.

• Composes with other HashiCorp tools: Terraform (provisioning), Vault (secrets/certs for Connect's mTLS), Nomad (scheduling).