hashicorp / hashicorp/consul

Envoy sidecar filter config incorrectly generated

Open
#17,475 3 comments 0 reactions 0 assignees View on GitHub
theme/connect theme/terminating-gw
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Overview of the Issue

I have a service within the mesh running with a transparent proxy, and a database outside the service mesh, and I want to connect them through the terminating-gateway. However the envoy sidecar configuration is being generated as if it were an http service, whereas I have set the service up to use tcp by default.

---

#### Reproduction Steps

1. Set up consul service mesh in transparent proxy mode with a terminating gateway
2. Register a dummy service named "my-service" with the consul catalog
3. Register these configuration objects:

```
proxy-defaults:
- protocol: http

service-defaults:
- name: database
- protocol: tcp

terminating-gateway:
- name: tgw
- services:
- name: database

service-intention:
- destination: my-service
- sources:
- name: database
````

4. Start the sidecar for my-service so it retrieves configuration from consul
5. Observe that the configuration contains an http-connection-manager that attempts to route traffic based on the request path and name like so:

![image](https://github.com/hashicorp/consul/assets/590320/bc28681a-b9e1-455c-95af-070c39370fe6)

6. Observe from the http api that the discovery-chain for database claims that traffic is tcp and not http

I found that the problem could be fixed by overriding the upstream protocol for my-service:

```
service-defaults:
- name: my-service
- protocol: http
- upstreamConfig:
overrides:
- name: database
protocol: tcp
```

Yielding:
![image](https://github.com/hashicorp/consul/assets/590320/49036446-1aaf-4c0c-a0ee-5a3e5f37e7ad)

I believe that the upstream config is incorrectly coming from the proxy-defaults and not the defaults for the target service.

I also tried with and without specifying a Destination entry on the service-defaults for database, but that did not affect the presence of the http-connection-manager

-->

### Consul info for both Client and Server

Helm chart: 1.1.1, overridden to use the server 1.15.2 image
Environment: AWS EKS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.