hashicorp / hashicorp/consul

Proxy Defaults - Enabling Transparent Proxy Impacts API Gateway Service Registration

Open
#19,579 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

#### Overview of the Issue

Setting `mode = "transparent"` in the proxy-defaults configuration entry causes subsequent API Gateway service registration to fail with -

```log
2023-10-31T20:20:35.192Z [ERROR] agent.client: RPC failed to server: method=Catalog.Register server=172.24.0.8:8300
error=
| rpc error making call: 1 error occurred:
| \t* The Proxy.Upstreams configuration is invalid for a api-gateway
|

2023-10-31T20:20:35.192Z [WARN] agent: Syncing service failed.: service=default/default/api-gateway
error=
| rpc error making call: 1 error occurred:
| \t* The Proxy.Upstreams configuration is invalid for a api-gateway
|

2023-10-31T20:20:35.192Z [ERROR] agent: failed to sync changes:
error=
| 1 error occurred:
| \t* rpc error making call: 1 error occurred:
| \t* The Proxy.Upstreams configuration is invalid for a api-gateway
|
|
|

Registered service: api-gateway
```

> Note: Although the client agent log output suggests the `api-gateway` service was registered after the error, the service is never synchronized to the catalog.

For context, I had enabled the dependencies for Permissive mTLS and was deploying API Gateway to the same partition when this issue was uncovered. Applying transparent proxy on individual services/service-defaults allows API Gateway service registration to succeed.

---

#### Reproduction Steps

```sh
curl "${CONSUL_HTTP_ADDR}/v1/config" \
--header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \
--request PUT \
--data @- <

- VM-based
- Consul Ent 1.16.2

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the proxy-defaults configuration and API Gateway registration sequence in the issue, then inspect the proxy-defaults handling and API Gateway service-registration entry points implicated by the error. Confirm the fix by repeating the commands and verifying that api-gateway is synchronized to the catalog without the invalid Proxy.Upstreams error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.