Consul
Mesh Configuration Entry
The mesh
configuration entry allows you to define a global default configuration that applies to all service mesh proxies.
Settings in this config entry apply across all namespaces and federated datacenters.
Sample Configuration Entries
Mesh-wide TLS Min Version
Enforce that service mesh mTLS traffic uses TLS v1.2 or newer.
Kind = "mesh"
TLS {
Incoming {
TLSMinVersion = "TLSv1_2"
}
}
Note that the Kubernetes example does not include a partition
field. Configuration entries are applied on Kubernetes using custom resource definitions (CRD), which can only be scoped to their own partition.
Mesh Destinations Only
Only allow transparent proxies to dial addresses in the mesh.
Kind = "mesh"
TransparentProxy {
MeshDestinationsOnly = true
}
Note that the Kubernetes example does not include a partition
field. Configuration entries are applied on Kubernetes using custom resource definitions (CRD), which can only be scoped to their own partition.
Peer Through Mesh Gateways
Set the PeerThroughMeshGateways
parameter to true
to route peering control plane traffic through mesh gateways.
Kind = "mesh"
Peering {
PeerThroughMeshGateways = true
}
Note that the Kubernetes example does not include a partition
field. Configuration entries are applied on Kubernetes using custom resource definitions (CRD), which can only be scoped to their own partition.
Available Fields
Kind
- Must be set tomesh
Namespace
(string: "default")
Enterprise - Must be set todefault
. The configuration will apply to all namespaces.Partition
(string: "default")
Enterprise - Specifies the name of the admin partition in which the configuration entry applies. Refer to the Admin Partitions documentation for additional information.Meta
(map<string|string>: nil)
- Specifies arbitrary KV metadata pairs. Added in Consul 1.8.4.TransparentProxy
(TransparentProxyConfig: <optional>)
- Controls configuration specific to proxies intransparent
mode. Added in v1.10.0.MeshDestinationsOnly
(bool: false)
- Determines whether sidecar proxies operating in transparent mode can proxy traffic to IP addresses not registered in Consul's mesh. If enabled, traffic will only be proxied to upstream proxies or mesh-native services. If disabled, requests will be proxied as-is to the original destination IP address. Consul will not encrypt the connection.
AllowEnablingPermissiveMutualTLS
(bool: false)
- Controls whetherMutualTLSMode=permissive
can be set in theproxy-defaults
andservice-defaults
configuration entries.ValidateClusters
(bool: false)
- Controls whether the clusters the route table refers to are validated. The default value is false. When set to false and a route refers to a cluster that does not exist, the route table loads and routing to a non-existent cluster results in a 404. When set to true and the route is set to a cluster that do not exist, the route table will not load. For more information, refer to HTTP route configuration in the Envoy docs for more details.TLS
(TLSConfig: <optional>)
- TLS configuration for the service mesh.Incoming
(TLSDirectionConfig: <optional>)
- TLS configuration for inbound mTLS connections targeting the public listener onconnect-proxy
andterminating-gateway
proxy kinds.TLSMinVersion
(string: "")
- Set the default minimum TLS version supported. One ofTLS_AUTO
,TLSv1_0
,TLSv1_1
,TLSv1_2
, orTLSv1_3
. If unspecified, Envoy v1.22.0 and newer will default to TLS 1.2 as a min version, while older releases of Envoy default to TLS 1.0.TLSMaxVersion
(string: "")
- Set the default maximum TLS version supported. Must be greater than or equal toTLSMinVersion
. One ofTLS_AUTO
,TLSv1_0
,TLSv1_1
,TLSv1_2
, orTLSv1_3
. If unspecified, Envoy will default to TLS 1.3 as a max version for incoming connections.CipherSuites
(array<string>: <optional>)
- Set the default list of TLS cipher suites to support when negotiating connections using TLS 1.2 or earlier. If unspecified, Envoy will use a default server cipher list. The list of supported cipher suites can seen inconsul/types/tls.go
and is dependent on underlying support in Envoy. Future releases of Envoy may remove currently-supported but insecure cipher suites, and future releases of Consul may add new supported cipher suites if any are added to Envoy.
Outgoing
(TLSDirectionConfig: <optional>)
- TLS configuration for outbound mTLS connections dialing upstreams fromconnect-proxy
andingress-gateway
proxy kinds.TLSMinVersion
(string: "")
- Set the default minimum TLS version supported. One ofTLS_AUTO
,TLSv1_0
,TLSv1_1
,TLSv1_2
, orTLSv1_3
. If unspecified, Envoy v1.22.0 and newer will default to TLS 1.2 as a min version, while older releases of Envoy default to TLS 1.0.TLSMaxVersion
(string: "")
- Set the default maximum TLS version supported. Must be greater than or equal toTLSMinVersion
. One ofTLS_AUTO
,TLSv1_0
,TLSv1_1
,TLSv1_2
, orTLSv1_3
. If unspecified, Envoy will default to TLS 1.2 as a max version for outgoing connections, but future Envoy releases may change this to TLS 1.3.CipherSuites
(array<string>: <optional>)
- Set the default list of TLS cipher suites to support when negotiating connections using TLS 1.2 or earlier. If unspecified, Envoy will use a default server cipher list. The list of supported cipher suites can seen inconsul/types/tls.go
and is dependent on underlying support in Envoy. Future releases of Envoy may remove currently-supported but insecure cipher suites, and future releases of Consul may add new supported cipher suites if any are added to Envoy.
HTTP
(HTTPConfig: <optional>)
- HTTP configuration for the service mesh.SanitizeXForwardedClientCert
(bool: <optional>)
- If configured totrue
, theforward_client_cert_details
option will be set toSANITIZE
for all Envoy proxies. As a result, Consul will not include thex-forwarded-client-cert
header in the next hop. If set tofalse
(default), the XFCC header is propagated to upstream applications.
Peering
(PeeringMeshConfig: <optional>)
- Controls configuration specific to peering connections.PeerThroughMeshGateways
(bool: <optional>)
- Determines if peering control-plane traffic should be routed through mesh gateways. When enabled, dialing cluster attempt to contact peers through their mesh gateway. Clusters that accept calls advertise the address of their mesh gateways, rather than the address of their Consul servers.
ACLs
Configuration entries may be protected by ACLs.
Reading a mesh
config entry requires no specific privileges.
Creating, updating, or deleting a mesh
config entry requires
operator:write
.