hashicorp / hashicorp/consul

consul connect proxy: Add a http proxy

Open
#4,298 4 comments 2 reactions 0 assignees View on GitHub
theme/connect type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Feature Description

It would be great to add an http proxy to the consul connect proxy command.

Usage:

```
consul connect proxy -http-proxy-listen=8080
```
```
http_proxy=http://127.0.0.1:8080 curl myconsulservice-proxy:1234
```

The http proxy would basically round trip the http queries, adding the required tls certificates to the queries.

#### Use Case(s)

Prometheus monitoring. Prometheus can get the addresses of the services but it can not add the connect tls config, and native integration is not likely to happen (1). However, as prometheus supports http proxies out of the box this would be awesome to have the feature delivered by consul connect proxy.

I am guessing other projects could use that too.

#### Advantages vs the current approach

The current approach means that for every service you want to connect to, you need to open a 1-to-1 tcp port.
This is not helpful for monitoring where you monitor dozens, hundreds, thousands of services which yoy might now know about when you start the proxy.

The http proxy approach provides:
- a standard way to connect to consul services
- a dynamic approach that lets you connect to multiple consul connect services over one port.

#### Notes
(1) here is why connect will not be implemented in prometheus natively
- Prometheus project does not want to integrate service mesh or advanced security features into the product
- Prometheus does not mix service discovery and scraping mechanism so that would be technically a problem
- Even if we could provide tls certs on disk, prometheus requires a restart to read new ssl certificates at the moment
- it would make no sense to require a prometheus upgrate to benefit for consul connect security upgrades

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.