Ingress Gateway for Inbound Mesh Traffic

Every service in a Consul service mesh only accepts mutual-TLS connections from other verified sidecars, so a plain client from outside the mesh, a browser, a load balancer, or a legacy app, cannot reach a mesh service directly. An ingress gateway is the controlled front door that solves this north-south problem.

In this lab you work with a small mesh: one Consul server, a backend VM running two mesh services (`web` and `api`), and a dedicated gateway VM. You will:

• Register and start the ingress gateway (a Consul-managed Envoy proxy) at the

edge of the mesh

• Write an `ingress-gateway` config entry that exposes the `web` service on an

HTTP listener, then reach it from outside the mesh through the gateway

• Add the `api` service to the same listener and route to each service by its

`<service>.ingress.consul` host header

• Prove the zero-trust boundary is intact: an intention still gates traffic from

the gateway to a backend service, exactly like any other mesh hop

Everything runs on Consul Community Edition on Ubuntu, with Consul and Envoy installed at pinned versions by the lab's setup scripts.