Consul Intention Allow Rule Not Enforced

You encounter a consul configuration issue that prevents your workflow from completing. This guide walks through the fix step by step.

Wrong ❌

apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceIntentions
metadata: { name: allow-web-to-api }
spec:
  destination: { name: api-service }
  sources: [{ name: web-service, action: allow }]

Wrong Output

Web service requests to API denied. Default deny-all intention takes precedence.

Right ✅

apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceIntentions
metadata: { name: allow-web-to-api }
spec:
  destination: { name: api-service }
  sources:
    - name: web-service
      action: allow
      precedence: 10
      permissions:
        - paths: [{ exact: /api/v1/users }]
          methods: [GET]

Right Output

Web to API allowed. GET /api/v1/users returns 200. Other paths still denied.

Prevention

• Set explicit precedence (lower = higher priority).
• Use permissions for path and method-level control.
• Default deny has precedence 0.
• Test both allowed and denied paths.
• Monitor intention evaluations in Consul logs.

DodaTech applies similar defensive patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro infrastructure for production reliability.

Common Mistakes with intention allow

1. Forgetting deriving (Show, Eq) on custom data types needed for debugging
2. Placing the wildcard pattern first in case expressions, making all subsequent patterns unreachable
3. Using head and tail instead of pattern matching, causing runtime errors on empty lists

These mistakes appear frequently in real-world CONSUL code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

This quick fix is part of the DodaTech infrastructure engineering series. Learn more at DodaTech tutorials.