Service Mesh Basics: Connect + Intentions

This is the service mesh lab for the Consul 101 course. Everything runs on a single VM using Docker Compose for three demo apps (web, api, and billing) and a Consul Community Edition single-server agent, so you can build a full Connect service mesh without a multi-node cluster.

You will:

• Register the web and api services with Connect sidecars, start their Envoy proxies, and prove web reaches api through mutual-TLS sidecar-to-sidecar traffic
• Flip the mesh to a zero-trust posture with a default-deny service-intentions config entry, then add a specific L4 allow so web can reach api while a third service (billing) stays blocked
• Declare the api protocol as http and write a Layer 7 application-aware intention that allows GET on one path but denies another, all within the already-authorized web-to-api relationship
• Inspect the Connect CA and a service's issued leaf certificate to see the SPIFFE identity that mTLS and intentions are enforced against

Intentions are managed the modern way throughout, as service-intentions and service-defaults config entries applied with consul config write, matching the Section 7 lessons and Consul 2.0.x, not the legacy consul intention create CLI.