Consul
Securely connect your services with Consul service mesh
In this tutorial, you will deploy HashiCups, a demo application, and integrate it with Consul service mesh. After deploying HashiCups, you will explore service-to-service traffic permissions with intentions.
You will use the resources created in this tutorial in the following tutorials to enable external traffic ingress with Consul API Gateway and explore service mesh observability.
In this tutorial, you will:
- Deploy the demo application HashiCups
- View Consul services
- Test the demo application
- Configure service-to-service traffic permissions with intentions
Prerequisites
The tutorial assumes that you have successfully completed the first tutorial in this getting started collection.
For this tutorial, you will need:
Deploy the demo application
In this section, you will deploy the demo application HashiCups that will let you explore Consul's service mesh features.
Consul uses Envoy proxy sidecars to provide service mesh capabilities to your applications. In this case, each HashiCups Kubernetes deployment spec contains the consul.hashicorp.com/connect-inject: "true" Kubernetes annotation. This annotation deploys an Envoy proxy sidecar alongside the application.
hashicups/v1/frontend.yaml
## ...
apiVersion: apps/v1
kind: Deployment
## ...
spec:
replicas: 1
## ...
template:
metadata:
labels:
service: frontend
app: frontend
annotations:
consul.hashicorp.com/connect-inject: "true"
spec:
serviceAccountName: frontend
containers:
- name: frontend
## ...
Deploy the HashiCups application.
$ kubectl apply --filename hashicups/v1/
Check the pods to confirm they are all running.
$ kubectl get pods --namespace default
NAMESPACE NAME READY STATUS RESTARTS AGE
default frontend-5d7f97456b-4h7mj 2/2 Running 0 67s
default nginx-7445d8d8c4-nmht9 2/2 Running 0 67s
default payments-6888957c45-r5lks 2/2 Running 0 68s
default product-api-7fcf6cd96f-brdvf 2/2 Running 0 67s
default product-api-db-855dbcc787-4pv9k 2/2 Running 0 67s
default public-api-7b985f985c-8hwwf 2/2 Running 0 67s
Tip
The initial HashiCups deployment will take about 1-2 minutes to complete.
The diagram below shows the services running in your Kubernetes cluster. This includes the service mesh layer and HashiCups microservice application pods.
View Consul services
In this section, you will view your Consul services with the CLI, UI, and/or API to explore the details of your service mesh.
In your terminal, run the CLI command consul catalog services to return the list of services registered in Consul. Notice each service has a corresponding sidecar proxy.
$ consul catalog services
consul
frontend
frontend-sidecar-proxy
nginx
nginx-sidecar-proxy
payments
payments-sidecar-proxy
product-api
product-api-db
product-api-db-sidecar-proxy
product-api-sidecar-proxy
public-api
public-api-sidecar-proxy
This configuration deployed Consul in secure mode with ACLs set to a default deny policy and is automatically managed by Consul and Kubernetes. This means that the only allowed service-to-service communications are the ones explicitly specified by intentions.
Run the CLI command consul intention list to return the list of intentions defined in Consul.
$ consul intention list
There are no intentions.
Since you have not defined any intentions yet, at this time Consul will deny all service-to-service traffic.
Test the demo application
Open a separate terminal window and expose the HashiCups UI with kubectl port-forward using the nginx service name as the target.
$ kubectl port-forward svc/nginx --namespace default 8080:80
Open http://localhost:8080 in your browser. Notice that while you can reach the nginx instance because of the port forwarding, the nginx service is unable to access its upstreams and the connection is refused. This is expected behavior since you have not defined any intentions yet.
Create intentions
To see how intentions affect communication between the services in your service mesh, you will create intentions following the "least-privilege" principle that allow communication between your services.
Open hashicups/intentions/allow.yaml to review the intentions configuration file. This file defines multiple intentions that will allow the HashiCups services to interact with each other.
hashicups/intentions/allow.yaml
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceIntentions
metadata:
name: frontend
namespace: default
# Allow traffic from nginx to frontend
spec:
destination:
name: frontend
sources:
- name: nginx
action: allow
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceIntentions
metadata:
name: public-api
namespace: default
# Allow traffic from nginx to public-api
spec:
destination:
name: public-api
sources:
- name: nginx
action: allow
## ...
Deploy the service intentions to allow the HashiCups services to interact with each other.
$ kubectl apply --filename hashicups/intentions/allow.yaml
Confirm applied intentions
Open a separate terminal window and expose the HashiCups UI with kubectl port-forward using the nginx service name as the target.
$ kubectl port-forward svc/nginx --namespace default 8080:80
Check out the HashiCups UI at http://localhost:8080. Notice that the application is now fully functional.
Next steps
In this tutorial, you deployed the demo application HashiCups into your Consul service mesh. After deploying HashiCups, you used intentions to control communication between services in your service mesh.
In the next tutorial, you will deploy a Consul API Gateway to control ingress into your service mesh applications.
For more information about the topics covered in this tutorial, refer to the following resources: