hashicorp / hashicorp/consul

Connect Envoy: Intentions not working on L4 Traffic

Open
#6,977 0 comments 0 reactions 0 assignees View on GitHub
theme/connect theme/envoy/xds
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Intentions not Working with Envoy Proxy on L4 Traffic

#### What I am doing when this happend?

- Consul v1.6.2 and Envoy v1.11.1

- Couter Service

A HTTP Server written in Python, accept PUT request for adding counts, accept GET requests for getting counts. [src](https://github.com/VitoVan/demo-service-counter/blob/85b9eb3282b65a044e03d8248ba59cee81803d2b/server.py)

- Timer Service

A HTTP Server emulated by `nc -l -s 0.0.0.0 -p 80`, simply reply the time and IP no matter what/how you send to that port. [src](https://github.com/VitoVan/demo-service-timer/blob/aa762545c76165851d1554650d9233f6160b27bc/server.sh)

- Dashboard Service

A Nginx instance with a static HTML and configured with 2 upstreams connect to 127.0.0.1 8080 and 8081, which will be provided by Sidecar. [src](https://github.com/VitoVan/demo-service-dashboard/blob/8600ca790b79efe4a1588e553ac32cdad3c7fdcf/nginx.conf)

#### What I have done caused this happen?

For the Sidecars, they worked very well, then I tried to create Intentions.

- First, `deny` from `dashboard` to `counter`, the time I created the intention, the dashboard lost the connection to counter, this worked as my wish.

- Second, `deny` from `dashboard` to `timer`, after I created the intention, nothing happened. The timer keeps refreshing, this intention does not work.

I checked the consul log, it indeed said something about denying access from `dashboard` to `timer`, but what actually happening is it is not denied.

#### What I have done after this happened?

- First, I stoped the Envoy based timer-sidecar-proxy, and start another one with Consul Native Proxy, intentions worked fine.

- Second, I switch back to the Envoy based timer-sidecar-proxy, then modified the source code of timer service, use Python for a standard HTTP implementation ([src](https://github.com/VitoVan/demo-service-timer/blob/15ecebe664c654a3dccacd40bfd8ae6d01a2ad87/server.py)). This time, Intentions with Envoy Proxy works fine.

- Third, I also tried Envoy Proxy with Redis, intentions not working.

#### Question

Are Intentions NOT supposed to work when use Envoy integration on L4 or "Bad Implemented HTTP"?

Thanks in advance, for your great work on Consul.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.