Testing the Consul built-in proxy

commands.sh

# Start fake-service on upstream  
export LISTEN_ADDR=0.0.0.0:9093
./fake-service

# Start upstream proxy
consul connect proxy -sidecar-for=testing-upstream


# Start fake-service on downstream
export LISTEN_ADDR=0.0.0.0:9092
export UPSTREAM_URIS=http://127.0.0.1:9005
./fake-service 

# Start downstream proxy
consul connect proxy -sidecar-for=testing

# Test connectivity  
curl localhost:9092
{
  "name": "testing",
  "uri": "/",
  "type": "HTTP",
  "ip_addresses": [
    "192.168.11.196",
    "172.17.0.1"
  ],
  "start_time": "2026-05-11T17:06:05.291790",
  "end_time": "2026-05-11T17:06:05.310513",
  "duration": "18.722946ms",
  "body": "Hello World",
  "upstream_calls": {
    "http://127.0.0.1:9005": {
      "name": "testing-upstream",
      "uri": "http://127.0.0.1:9005",
      "type": "HTTP",
      "ip_addresses": [
        "192.168.11.196",
        "172.17.0.1"
      ],
      "start_time": "2026-05-11T17:06:05.308992",
      "end_time": "2026-05-11T17:06:05.309101",
      "duration": "108.738µs",
      "headers": {
        "Content-Length": "287",
        "Content-Type": "text/plain; charset=utf-8",
        "Date": "Mon, 11 May 2026 22:06:05 GMT"
      },
      "body": "Hello World",
      "code": 200
    }
  },
  "code": 200
}

gistfile1.txt

# No intention
2026-05-11T16:48:58.887-0500 [ERROR] proxy.connect: authz call denied: service=testing-upstream reason="Default behavior configured by ACLs"

# Deny intention
2026-05-11T16:50:24.005-0500 [ERROR] proxy.connect: authz call denied: service=testing-upstream reason="Matched L4 intention: default/default/testing => default/default/testing-upstream (Precedence: 9, Action: DENY)"

testing-upstream.hcl

service {
  name = "testing-upstream"
  port = 9093

  connect {
    sidecar_service {
      proxy {
        config {}
      }
    }
  }
  check {
    id       = "testing-upstream"
    http     = "http://127.0.0.1:9093/health"
    method   = "GET"
    interval = "10s"
    timeout  = "1s"
  }

  token = "<service_identity_acl>"
}

testing.hcl

service {
  name = "testing-built-in"
  port = 9093

  connect {
    sidecar_service {
      proxy {
        config {
          # Sane defaults will be used here if not added
          #bind_address = "127.0.0.1"
          #bind_port = 21000
          # tcp_check_address = ""
          #local_service_address = "127.0.0.1:9092"
        }
      }
    }
  }
  check {
    id       = "counting-check"
    http     = "http://127.0.0.1:9093/health"
    method   = "GET"
    interval = "10s"
    timeout  = "1s"
  }
  token = "<service_identity_acl>"
}