Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://developer.hashicorp.com/consul/docs/reference/config-entry/proxy-defaults below:

Proxy defaults configuration entry reference | Consul

This topic provides reference information for proxy defaults configuration entries. Refer to Service mesh proxy overview for information about using proxies in Consul.

Proxy defaults configuration entries set global passthrough Envoy settings for proxies in the service mesh, including sidecars and gateways. Proxy defaults configuration entries do not control features for peered clusters, transparent proxy, or TLS behavior. For information about configuring Consul settings that affect service mesh behavior, refer to the mesh configuration entry reference.

Consul only supports one global proxy defaults configuration entry at a time. If multiple configuration entries are defined in Consul Enterprise, Consul implements the configuration entry in the default partition.

The following list outlines field hierarchy, language-specific data types, and requirements in proxy defaults configuration entries. Click on a property name to view additional details, including default values.

When every field is defined, a proxy defaults configuration entry has the following form:

Kind      = "proxy-defaults"
Name      = "global"
Namespace = "default"
Meta {
  <arbitrary string key> = "<arbitrary string value>"
}
Config {
  <arbitrary string key> = <arbitrary value>
}
EnvoyExtensions = [
  {
    Name= "<name of the extension>"
    Required = "required"
    Arguments = "<arguments to pass to the extension>"
    ConsulVersion = "<Consul version required by the extension>"
    EnvoyVersion = "<Envoy version required by the extension>"
  }
]
Mode = "<name of proxy mode>"
TransparentProxy {
  OutboundListenerPort = <port the proxy should listen on for outbound traffic>
  DialedDirectly       = <true if proxy instances should be dialed directly>
}
MutualTLSMode = "<mutual TLS mode for all proxies>"
MeshGateway {
  Mode = "<name of mesh gateway configuration for all proxies>"
}
Expose {
  Checks = <true to expose all HTTP and gRPC checks through Envoy>

  Paths = [
    {
      Path          = "<the HTTP path to expose>"
      LocalPathPort = <port where the local service is listening for connections to the path>
      ListenerPort  = <port where the proxy will listen for connections>
      Protocol      = "<protocol of the listener>"
    }
  ]
}
PrioritizeByLocality = {
   Mode = "failover"
}
AccessLogs {
  Enabled              = < true | false >
  DisableListenerLogs  = < true | false , disables listener access logs for unrecognized traffic>
  Type                 = "< file | stdout | stdout, the destination for access logs >"
  Path                 = "< set the output path for 'file' based access logs >"
  JSONFormat           = "< json representation of access log format >"
  TextFormat           = "< text representation of access log format >"
}

apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
  namespace: default
spec:
  meta:
    <arbitrary string key>: <arbitrary string value>
  config:
    <arbitrary string key>: <arbitrary value>
  EnvoyExtensions:
  - name: <name of the extension>
    required: required
    arguments: <arguments to pass to the extension>
    consulVersion: <Consul version required by the extension>
    envoyVersion: <Envoy version required by the extension>
  mode: <name of proxy mode>
  transparentProxy:
    outboundListenerPort: <port the proxy should listen on for outbound traffic>
    dialedDirectly: <true if proxy instances should be dialed directly>
  mutualTLSMode: <mutual TLS mode for all proxies>
  meshGateway:
    mode: <name of mesh gateway configuration for all proxies>
  expose:
    checks: <true to expose all HTTP and gRPC checks through Envoy>
    paths:
      - path: <the HTTP path to expose>
        localPathPort: <port where the local service is listening for connections to the path>
        listenerPort: <port where the proxy will listen for connections>
        protocol:= <protocol of the listener>
  accessLogs:
    enabled: < true | false >
    disableListenerLogs:  < true | false , disables listener access logs for unrecognized traffic>
    type: < file | stdout | stdout, the destination for access logs >
    path: < set the output path for 'file' based access logs >
    jsonFormat: < json representation of access log format >
    textFormat: < text representation of access log format >

{
  "Kind": "proxy-defaults",
  "Name": "global",
  "Namespace": "default",
  "Meta": {
    "<arbitrary string key>": "<arbitrary string value>"
  },
  "Config": {
    "<arbitrary string key>": <arbitrary value>
  },
  "EnvoyExtensions": [
    {
      "Name": "<name of the extension>",
      "Required": "required",
      "Arguments": "<arguments to pass to the extension>",
      "ConsulVersion": "<Consul version required by the extension>",
      "EnvoyVersion": "<Envoy version required by the extension>"
    }
  ],
  "Mode": "<name of proxy mode>",
  "TransparentProxy": {
    "OutboundListenerPort": <port the proxy should listen on for outbound traffic>,
    "DialedDirectly": <true if proxy instances should be dialed directly>
  },
  "MutualTLSMode": "<mutual TLS mode for all proxies>",
  "MeshGateway": {
    "Mode": = "<name of mesh gateway configuration for all proxies>"
  },
  "Expose": {
    "Checks": <true to expose all HTTP and gRPC checks through Envoy>,
    "Paths": [
      {
        "Path": "<the HTTP path to expose>",
        "LocalPathPort": <port where the local service is listening for connections to the path>,
        "ListenerPort": <port where the proxy will listen for connections>,
        "Protocol": "<protocol of the listener>"
      }
    ]
  },
  "AccessLogs": {
    "Enabled": < true | false >,
    "DisableListenerLogs": < true | false , disables listener access logs for unrecognized traffic>,
    "Type": "< file | stdout | stdout, the destination for access logs >",
    "Path": "< set the output path for 'file' based access logs >",
    "JSONFormat": "< json representation of access log format >",
    "TextFormat": "< text representation of access log format >"
  }
}

This section provides details about the fields you can configure in the proxy defaults configuration entry.

Specifies the type of configuration entry to implement. Must be set to proxy-defaults.

• Default: None
• This field is required.
• Data type: String value that must be set to proxy-defaults.

Specifies a name for the configuration entry that is used to identify the configuration entry. Must be set to global.

• Default: None
• This field is required.
• Data type: String that must be set to global.

Specifies the namespace that the proxy defaults apply to. You can only specify the default namespace.

• Default: default
• Data type: String

Specifies the local admin partition that the proxy defaults apply to. Refer to admin partitions for more information.

• Default: default
• Data type: String

Specifies a set of custom key-value pairs to add the Consul KV store.

• Default: None
• Data type: Map of one or more key-value pairs.
  • Keys: String
  • Values: String, integer, or float

Specifies an arbitrary map of configuration values used by service mesh proxies. The available configurations depend on the mesh proxy you use. You can configure any global values that your proxy allows in this field. Refer to the following topics for additional information:

• Envoy proxy configuration option
• Built-in proxy configuration options

• Default: None
• Data type: Map

Specifies a list of extensions that modify Envoy proxy configurations. Refer to Envoy extensions for additional information.

• Default: None
• Data type: List of maps containing the following fields:
  • Name
  • Required
  • Arguments
  • ConsulVersion
  • EnvoyVersion

The following table describes how to configure values in the EnvoyExtensions map:

Use this parameter to ensure that extensions required for secure communication are not unintentionally bypassed.

Consul returns an error when Required is set to true and the extension does not update Envoy resources.

The ConsulVersion and EnvoyVersion must both validate for Consul to implement the extension.

The ConsulVersion and EnvoyVersion must both validate for Consul to implement the extension.

Specifies a mode for how proxies direct inbound and outbound traffic. You can specify one of the following values:

• transparent: In transparent mode, proxies capture and redirect inbound and outbound traffic. The mode does not enable traffic redirection, but directs Consul to configure Envoy as if traffic is already being redirected.

• direct: In this mode, the local application and other proxies must directly dial proxy listeners.

• Default: None
• Data type: String

Contains configurations for proxies that are running in transparent proxy mode. This mode enables permissive mTLS for Consul so that you can use your Kubernetes cluster's DNS service instead of Consul DNS. Refer to Transparent proxy mode for additional information.

• Default: None
• Data type: Map of containing the following fields:
  • OutboundListenerPort
  • DialedDirectly

The following table describes how to configure values in the TransparentProxy map:

Controls the default mutual TLS (mTLS) mode for all proxies. You can only set mutual TLS mode for services in transparent proxy mode.

You can specify one of the following modes:

strict: The sidecar proxy requires mTLS for incoming traffic. permissive: The sidecar proxy accepts mTLS traffic on the sidecar proxy service port and accepts any traffic on the destination service port. We recommend only using permissive mode if necessary while onboarding services to the service mesh.

• Default: strict
• Data type: One of the following string values:
  • strict
  • permissive

Sets the default mesh gateway mode field for all proxies. You can specify the following string values for the mode field:

• none: The proxy does not make outbound connections through a mesh gateway. Instead, it makes outbound connections directly to the destination services.
• local: The proxy makes an outbound connection to a gateway running in the same datacenter.
• remote: The proxy makes an outbound connection to a gateway running in the destination datacenter.

• Default: None
• Data type: Map containing the mode field

Specifies default configurations for exposing HTTP paths through Envoy. Exposing paths through Envoy enables services to protect themselves by only listening on localhost. Applications that are not Consul service mesh-enabled are still able to contact an HTTP endpoint.

Example use-cases include exposing the /metrics endpoint to a monitoring system, such as Prometheus, and exposing the /healthz endpoint to the kubelet for liveness checks. Refer to Expose Paths Configuration Reference for additional information.

• Default: None
• Data type: Map containing the following parameters:
  • Checks
  • Paths

Exposes all HTTP and gRPC checks registered with the agent when set to true. Envoy exposes listeners for the checks and only accepts connections originating from localhost or the Consul agent's advertise_addr. The ports for the listeners are dynamically allocated from the agent's expose_min_port and expose_max_port configurations.

We recommend enabling the Checks configuration when a Consul client cannot reach registered services over localhost.

• Default: false
• Data type: Boolean

Specifies a list of configuration maps that define paths to expose through Envoy when Expose.Checks is set to true.

• Default: None
• Data type: List of maps

The following table describes the parameters for each map you can define in the list:

Sets a mode for the service that allows instances to prioritize upstream targets that are in the same network region and zone. You can specify the following string values for the mode field:

• failover: If the upstream targets that a service is connected to become unreachable, the service prioritizes healthy upstream instances with matching Locality configuration. Refer to Route traffic to local upstreams for additional information.

• Default: None
• Data type: Map

Specifies Envoy access logger configurations for all proxies in the service mesh, including gateways. This field also configures access logs on Envoy's administration interface.

• Default: None
• Data type: Map

The following table describes the parameters you can define in the AccessLogs map:

Specifies the version of the Consul API to use to apply the configuration entry. This must be set to consul.hashicorp.com/v1alpha1.

• Default: None
• This field is required.
• Data type: String value that must be set to consul.hashicorp.com/v1alpha1.

Specifies the type of configuration entry to implement. Must be set to ProxyDefaults.

• Default: None
• This field is required.
• Data type: String value that must be set to ProxyDefaults.

Map that contains the service name, namespace, and admin partition that the configuration entry applies to.

• Default: none
• Map containing the following strings:
  • name
  • namespace

Specifies a name for the configuration entry that is used to identify the configuration entry. Must be set to global.

• Default: None
• This field is required.
• Data type: String that must be set to global.

Specifies the namespace that the proxy defaults apply to. If you are on the community version, Consul ignores the namespace field. Refer to Kubernetes namespaces in Consul for additional information. If you are on Consul Enterprise, refer to Kubernetes namespaces in Consul Enterprise for additional information.

• Default: default
• Data type: String

Map that contains the details about the ProxyDefaults configuration entry. The apiVersion, kind``, and metadatafields are siblings of thespec` field. All other configurations are children.

Specifies an arbitrary map of configuration values used by service mesh proxies. The available configurations depend on the mesh proxy you use. You can configure any global values that your proxy allows in this field. Refer to the following topics for additional information:

• Envoy proxy configuration option
• Built-in proxy configuration options

• Default: None
• Data type: Map

Specifies a list of extensions that modify Envoy proxy configurations. Refer to Envoy extensions for additional information.

• Default: None
• Data type: List of maps of containing the following fields:
  • name
  • required
  • arguments
  • consulVersion
  • envoyVersion

The following table describes how to configure values in the EnvoyExtensions map:

Use this parameter to ensure that extensions required for secure communication are not unintentionally bypassed.

Consul returns an error when Required is set to true and the extension does not update Envoy resources.

The consulVersion and envoyVersion must both validate for Consul to implement the extension.

The consulVersion and envoyVersion must both validate for Consul to implement the extension.

Specifies a mode for how proxies direct inbound and outbound traffic. You can specify one of the following values:

• transparent: In transparent mode, proxies capture and redirect inbound and outbound traffic. The mode does not enable traffic redirection, but directs Consul to configure Envoy as if traffic is already being redirected.

• direct: In this mode, the local application and other proxies must directly dial proxy listeners.

• Default: None
• Data type: String

Contains configurations for proxies that are running in transparent proxy mode. This mode enables permissive mTLS for Consul so that you can use your Kubernetes cluster's DNS service instead of Consul DNS. Refer to Transparent proxy mode for additional information.

• Default: None
• Data type: Map of containing the following fields:
  • outboundListenerPort
  • dialedDirectly

The following table describes how to configure values in the TransparentProxy map:

Controls the default mutual TLS (mTLS) mode for all proxies. You can only set mutual TLS mode for services in transparent proxy mode.

You can specify one of the following modes:

strict: The sidecar proxy requires mTLS for incoming traffic. permissive: The sidecar proxy accepts mTLS traffic on the sidecar proxy service port and accepts any traffic on the destination service port. We recommend only using permissive mode if necessary while onboarding services to the service mesh.

• Default: strict
• Data type: One of the following string values:
  • strict
  • permissive

Sets the default mesh gateway mode field for all proxies. You can specify the following string values for the mode field:

• none: The proxy does not make outbound connections through a mesh gateway. Instead, it makes outbound connections directly to the destination services.
• local: The proxy makes an outbound connection to a gateway running in the same datacenter.
• remote: The proxy makes an outbound connection to a gateway running in the destination datacenter.

• Default: None
• Data type: Map containing the mode field

Specifies default configurations for exposing HTTP paths through Envoy. Exposing paths through Envoy enables services to protect themselves by only listening on localhost. Applications that are not Consul service mesh-enabled are still able to contact an HTTP endpoint.

Example use-cases include exposing the /metrics endpoint to a monitoring system, such as Prometheus, and exposing the /healthz endpoint to the kubelet for liveness checks. Refer to Expose Paths Configuration Reference for additional information.

• Default: None
• Data type: Map containing the following parameters:
  • checks
  • paths

Exposes all HTTP and gRPC checks registered with the agent when set to true. Envoy exposes listeners for the checks and only accepts connections originating from localhost or the Consul agent's advertise_addr. The ports for the listeners are dynamically allocated from the agent's expose_min_port and expose_max_port configurations.

We recommend enabling the Checks configuration when a Consul client cannot reach registered services over localhost, such as when Consul agents run in their own pods in Kubernetes.

• Default: false
• Data type: Boolean

Specifies a list of configuration maps that define paths to expose through Envoy when spec.expose.checks is set to true.

• Default: None
• Data type: List of maps.

The following table describes the parameters for each map you can define in the list:

Sets a mode for the service that allows instances to prioritize upstream targets that are in the same network region and zone. You can specify the following string values for the mode field:

• failover: If the upstream targets that a service is connected to become unreachable, the service prioritizes healthy upstream instances with matching locality configuration. Refer to Route traffic to local upstreams for additional information.

• Default: None
• Data type: Map

Specifies Envoy access logger configurations for all proxies in the service mesh, including gateways. This field also configures access logs on Envoy's administration interface.

• Default: None
• Data type: Map

The following table describes the parameters you can define in the accessLogs map:

The following examples demonstrate common patterns for configuring proxy defaults configuration entries.

The following example sets the default protocol for all proxies to http.

Kind      = "proxy-defaults"
Name      = "global"
Config {
  protocol = "http"
}

When using multiple namespaces with Consul Enterprise, the only configuration entry that affects proxy defaults is the one in the default namespace. This configuration applies to proxies in all namespaces.

Kind      = "proxy-defaults"
Name      = "global"
Namespace = "default" # Can only be set to "default".
Config {
  protocol = "http"
}

apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
spec:
  config:
    protocol: http

When using multiple namespaces with Consul Enterprise, the only configuration entry that affects proxy defaults is the one in the default namespace. This configuration applies to proxies in all namespaces.

apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
  namespace: default
spec:
  config:
    protocol: http

{
  "Kind": "proxy-defaults",
  "Name": "global",
  "Config": {
    "protocol": "http"
  }
}

When using multiple namespaces with Consul Enterprise, the only configuration entry that affects proxy defaults is the one in the default namespace. This configuration applies to proxies in all namespaces.

{
  "Kind": "proxy-defaults",
  "Name": "global",
  "Namespace": "default",
  "Config": {
    "protocol": "http"
  }
}

The following example configures all proxies to expose Prometheus metrics.

Kind      = "proxy-defaults"
Name      = "global"
Config {
  envoy_prometheus_bind_addr = "0.0.0.0:9102"
}

apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
spec:
  config:
    envoy_prometheus_bind_addr: '0.0.0.0:9102'

{
  "Kind": "proxy-defaults",
  "Name": "global",
  "Config": {
    "envoy_prometheus_bind_addr": "0.0.0.0:9102"
  }
}

The following example enables access logs for all proxies. Refer to access logs for more detailed examples.

Kind      = "proxy-defaults"
Name      = "global"
AccessLogs {
  Enabled = true
}

apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
spec:
  accessLogs:
    enabled: true

{
  "Kind": "proxy-defaults",
  "Name": "global",
  "AccessLogs": {
    "Enabled": true
  }
}

The following example configures custom default values for all proxies.

Kind      = "proxy-defaults"
Name      = "global"
Config {
  local_connect_timeout_ms = 1000
  handshake_timeout_ms     = 10000
}

apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
spec:
  config:
    local_connect_timeout_ms: 1000
    handshake_timeout_ms: 10000

{
  "Kind": "proxy-defaults",
  "Name": "global",
  "Config": {
    "local_connect_timeout_ms": 1000,
    "handshake_timeout_ms": 10000
  }
}

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4