consul

Consul API Gateway 0.2 Brings New Cross-Namespace Controls

Consul API Gateway 0.2, now generally available, enhances the gateway’s traffic management capabilities by adding cross-namespace reference policy enforcement.

Apr 27 2022Jeff Apple, Peter McCarron

Today we’re pleased to announce the general availability of the Consul API Gateway version 0.2. This release includes an update that allows users to better control how traffic is routed between Kubernetes namespaces. Previously, users could route requests from the API Gateway across various namespaces without providing any sort of explicit permissions. While this meant that any service connected to the service mesh was reachable, it didn’t allow users to set the more granular restrictions or permissions that they may expect. In this blog post, we’ll explain how Consul API Gateway 0.2 solves for this challenge using cross-namespace reference policies.

»Enforcing Cross-Namespace Communication

In the Kubernetes Gateway API specification, an administrator of a namespace needs to create ReferencePolicies in order for their services to receive traffic routed to them from gateway routes in other namespaces. This can help prevent things like accidentally exposing a service externally when it shouldn’t be. As an example, here is a ReferencePolicy that is created in the same namespace that the services are in and allows them to receive traffic from an HTTPRoute in the prod-gw-ns namespace:

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: ReferencePolicy
metadata:
  name: allow-prod-traffic
  namespace: the-services-ns
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    namespace: prod-gw-ns
  to:
    kind: Service

ReferencePolicies are used in conjunction with the various route types supported by the API Gateway: HTTProutes and TCProutes. One important note: ReferencePolicies can support only one from and to section, so if you intend to create enforcement rules for more than two namespaces, you will need to create policies for each combination of namespaces. This creates a better security model, ensuring that all communication between namespaces is authorized. The diagram below illustrates this architecture:

Cross-namespace gateway policies

»Next Steps

Version 0.2 of the Consul API Gateway is now generally available for all users. To get started, use the latest Consul Helm chart and be sure to install the most recent version of the Consul API Gateway CRDs. For more information, please visit the Consul API Gateway documentation.

Kubernetes

Sign up for the latest HashiCorp news

By submitting this form, you acknowledge and agree that HashiCorp will process your personal information in accordance with the Privacy Policy

More blog posts like this one

Deploy Consul cluster peering locally with Minikube
July 05 2023 | Products & Technology
Deploy Consul cluster peering locally with Minikube

Use Minikube to create multiple Kubernetes clusters with Consul and test cluster peering configurations in your local development environment.

Consul 1.16 enhances service mesh reliability, user experience, and security
June 30 2023 | Products & Technology
Consul 1.16 enhances service mesh reliability, user experience, and security

Consul 1.16 adds new reliability, scalability, security, service mesh UX, extensibility, and service discovery capabilities.

Announcing HCP Consul management plane with cloud-based observability
June 29 2023 | Products & Technology
Announcing HCP Consul management plane with cloud-based observability

The HCP Consul management plane now offers deeper insights to your Consul deployments via cloud-based observability and seamlessly links new and existing self-managed Consul clusters.