diff --git a/website/content/docs/concepts/service-mesh.mdx b/website/content/docs/concepts/service-mesh.mdx index 2e793f2441c8..947984484e45 100644 --- a/website/content/docs/concepts/service-mesh.mdx +++ b/website/content/docs/concepts/service-mesh.mdx @@ -53,13 +53,13 @@ The API gateway will route the incoming requests to the respective service. The A service mesh specializes in the network management of services and the communication between services. The mesh is responsible for keeping track of services and their health status, IP address, and traffic routing and ensuring all traffic between services is authenticated and encrypted. -Unlike API gateways, a service mesh will track all registered services' lifecycle and ensure requests are routed to healthy instances of the service. +Unlike some API gateways, a service mesh will track all registered services' lifecycle and ensure requests are routed to healthy instances of the service. API gateways are frequently deployed alongside a load balancer to ensure traffic is directed to healthy and available instances of the service. The mesh reduces the load balancer footprint as routing responsibilities are handled in a decentralized manner. API gateways can be used with a service mesh to bridge external networks (non-mesh) with a service mesh. --> **API gateways and traffic direction:** API gateways are often used to accept north-south traffic. North-south traffic is networking traffic that either enters or exits a data center or a virtual private network (VPC). +-> **API gateways and traffic direction:** API gateways are often used to accept north-south traffic. North-south traffic is networking traffic that either enters or exits a datacenter or a virtual private network (VPC). You can connect API gateways to a service mesh and provide access to it from outside the mesh. A service mesh is primarily used for handling east-west traffic. East-west traffic traditionally remains inside a data center or a VPC. A service mesh can be connected to another service mesh in another data center or VPC to form a federated mesh. diff --git a/website/content/docs/connect/config-entries/ingress-gateway.mdx b/website/content/docs/connect/config-entries/ingress-gateway.mdx index dc36c9fb0b38..63d990f9d864 100644 --- a/website/content/docs/connect/config-entries/ingress-gateway.mdx +++ b/website/content/docs/connect/config-entries/ingress-gateway.mdx @@ -7,6 +7,14 @@ description: >- # Ingress gateway configuration entry reference + + +Ingress gateway is deprecated and will not be enhanced beyond its current capabilities. Ingress gateway is fully supported in this version but will be removed in a future release of Consul. + +Consul's API gateway is the recommended alternative to ingress gateway. + + + This topic provides configuration reference information for the ingress gateway configuration entry. An ingress gateway is a type of proxy you register as a service in Consul to enable network connectivity from external services to services inside of the service mesh. Refer to [Ingress gateways overview](/consul/docs/connect/gateways/ingress-gateway) for additional information. ## Configuration model diff --git a/website/content/docs/connect/config-entries/jwt-provider.mdx b/website/content/docs/connect/config-entries/jwt-provider.mdx index 8867a3e4f972..8716dde8c23f 100644 --- a/website/content/docs/connect/config-entries/jwt-provider.mdx +++ b/website/content/docs/connect/config-entries/jwt-provider.mdx @@ -28,6 +28,18 @@ The following list outlines field hierarchy, language-specific data types, and r - [`RequestTimeoutMs`](#jsonwebkeyset-remote-requesttimeoutms): integer - [`CacheDuration`](#jsonwebkeyset-remote-cacheduration): string | `5m` - [`FetchAsynchronously`](#jsonwebkeyset-remote-fetchasynchronously): boolean | `false` + - [`JWKSCluster`](#jsonwebkeyset-remote-jwkscluster): map + - [`DiscoveryType`](#jsonwebkeyset-remote-jwkscluster-discoverytype): string | `STRICT_DNS` + - [`ConnectTimeout`](#jsonwebkeyset-remote-jwkscluster-connecttimeout): string | `5s` + - [`TLSCertificates`](#jsonwebkeyset-remote-jwkscluster-tlscertificates): map + - [`CaCertificateProviderInstance`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance): map + - [`InstanceName`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance): string | `default` + - [`CertificateName`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance): string + - [`TrustedCA`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): map + - [`Filename`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string + - [`EnvironmentVariable`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string + - [`InlineString`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string + - [`InlineBytes`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string - [`RetryPolicy`](#jsonwebkeyset-remote-retrypolicy): map - [`NumRetries`](#jsonwebkeyset-remote-retrypolicy-numretries): integer | `0` - [`RetryPolicyBackoff`](#jsonwebkeyset-remote-retrypolicy-retry-policy-backoff): map @@ -75,6 +87,18 @@ The following list outlines field hierarchy, language-specific data types, and r - [`retryPolicyBackoff`](#spec-jsonwebkeyset-remote-retrypolicy-retry-policy-backoff): map - [`baseInterval`](#spec-jsonwebkeyset-remote-retrypolicy-retry-policy-backoff): string - [`maxInterval`](#spec-jsonwebkeyset-remote-retrypolicy-retry-policy-backoff): string + - [`jwksCluster`](#spec-jsonwebkeyset-remote-jwkscluster): map + - [`discoveryType`](#spec-jsonwebkeyset-remote-jwkscluster-discoverytype): string | `STRICT_DNS` + - [`connectTimeout`](#spec-jsonwebkeyset-remote-jwkscluster-connecttimeout): string | `5s` + - [`tlsCertificates`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates): map + - [`caCertificateProviderInstance`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance): map + - [`instanceName`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance): string | `default` + - [`certificateName`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance): string + - [`trustedCA`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): map + - [`filename`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string + - [`environmentVariable`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string + - [`inlineString`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string + - [`inlineBytes`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca): string - [`audiences`](#spec-audiences): list of strings - [`locations`](#spec-locations): list of maps - [`header`](#spec-locations-header): map @@ -126,8 +150,29 @@ JSONWebKeySet = { MaxInterval = "10s" } } + JWKSCluster = { + DiscoveryType = "STATIC" + ConnectTimeout = "10s" + # specify only one child: TrustedCA or CaCertificateProviderInstance + TLSCertificates = { + # specify only one child: Filename, EnvironmentVariable, InlineString or InlineBytes + TrustedCA = { + Filename = "" + EnvironmentVariable = "" + InlineString = "" + InlineBytes = "\302\000\302\302\302\302" + } + } + TLSCertificates = { + CaCertificateProviderInstance = { + InstanceName = "" + CertificateName = "" + } + } + } } } + Audiences = [""] Locations = [ { @@ -185,6 +230,25 @@ CacheConfig = { "BaseInterval": "1s", "MaxInterval": "10s" } + }, + "JWKSCluster": { + "DiscoveryType": "STATIC", + "ConnectTimeout": "10s", + // specify only one child: TrustedCA or CaCertificateProviderInstance + "TLSCertificates": { + // specify only one child: Filename, EnvironmentVariable, InlineString or InlineBytes + "TrustedCA": { + "Filename": "", + "EnvironmentVariable": "", + "InlineString": "", + "InlineBytes": "\302\000\302\302\302\302" + }, + "TLSCertificates": { + "CaCertificateProviderInstance": { + "InstanceName": "", + "CertificateName": "" + } + } } } }, @@ -246,6 +310,21 @@ spec: # required retryPolicyBackoff: baseInterval: 1s maxInterval: 10s + jwksCluster: + discoveryType: STATIC + connectTimeout: 10s + # specify only one child: trustedCA or caCertificateProviderInstance + tlsCertificates: + # specify only one child: filename, environmentVariable, inlineString or inlineBytes + trustedCA: + filename: + environmentVariable: + inlineString: + inlineBytes: \302\000\302\302\302\302 + tlsCertificates: + caCertificateProviderInstance: + instanceName: + certificateName: audiences: [] locations: header: @@ -360,6 +439,7 @@ Specifies a remote source for the JSON Web Key Set and configures behavior when - [`CacheDuration`](#jsonwebkeyset-remote-cacheduration) - [`FetchAsynchronously`](#jsonwebkeyset-remote-fetchasynchronously) - [`RetryPolicy`](#jsonwebkeyset-remote-retrypolicy) + - [`JWKSCluster`](#jsonwebkeyset-remote-jwkscluster) ### `JSONWebKeySet{}.Remote{}.URI` @@ -436,6 +516,93 @@ Specifies a jittered exponential backoff strategy. When this field is empty, Env | `BaseInterval`| Specifies the base interval to use for the next back off computation. | String | `1s` | | `MaxInterval` | Specifies the maximum interval between retries. By default, this value is 10 times `BaseInterval`. | String | `10s` | +### `JSONWebKeySet{}.Remote{}.JWKSCluster` + +Defines how Envoy fetches the remote JSON Web Key Set URI. + +#### Values + +- Default: None +- Data type: Map that can contain the following parameters: + + - [`DiscoveryType`](#jsonwebkeyset-remote-jwkscluster-discoverytype) + - [`ConnectTimeout`](#jsonwebkeyset-remote-jwkscluster-connecttimeout) + - [`TLSCertificates`](#jsonwebkeyset-remote-jwkscluster-tlscertificates) + + +### `JSONWebKeySet{}.Remote{}.JWKSCluster{}.DiscoveryType` + +Specifies the service discovery type to use for resolving the cluster. +You can specify the following discovery types: +- `STRICT_DNS` +- `STATIC` +- `LOGICAL_DNS` +- `EDS` +- `ORIGINAL_DST` + +#### Values + +- Default: `STRICT_DNS` +- Data type: String + +### `JSONWebKeySet{}.Remote{}.JWKSCluster{}.ConnectTimeout` + +Specifies the duration of time new network connections attempt to connect to hosts in the cluster before they timeout. + +#### Values + +- Default: `5s` +- Data type: String + +### `JSONWebKeySet{}.Remote{}.JWKSCluster{}.TLSCertificates` + +Specifies the data containing certificate authority certificates to use for verifying a presented peer certificate. +Envoy does not verify certificates that peers present if this field is not configured. + +You cannot specify [`TLSCertificates{}.CaCertificateProviderInstance`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance) and [`TLSCertificates{}.TrustedCA`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca) in the same map. + +#### Values + +- Default: None +- Data type: Map that can contain the following parameters: + + - [`CaCertificateProviderInstance`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance) + - [`TrustedCA`](#jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca) + +### `JSONWebKeySet{}.Remote{}.JWKSCluster{}.TLSCertificates{}.CaCertificateProviderInstance` + +Speficies the certificate provider instance for fetching TLS certificates. + +#### Values + +- Default: None +- Data type: Map that can contain the following parameters: + +| Parameter | Description | Data type | Default value | +| :-------- | :------------------------------------------------- | :-------- | :------------ | +| `InstanceName`| Refers to the certificate provider instance name. | String | `default` | +| `CertificateName` | Specifies the certificate instances or types. For example, use `ROOTCA` to specify a root-certificate. | String | None | + +### `JSONWebKeySet{}.Remote{}.JWKSCluster{}.TLSCertificates{}.TrustedCA` + +Specifies TLS certificate data containing certificate authority certificates. Specify exactly one of the following data holders: +- `Filename` +- `EnvironmentVariable` +- `InlineString` +- `InlineBytes` + +#### Values + +- Default: None +- Data type: Map containing one of the following parameters: + +| Parameter | Description | Data type | Default value | +| :-------- | :------------------------------------------------- | :-------- | :------------ | +| `Filename`| The name of the file on the local system to use a data source for trusted CA certificates. | String | None | +| `EnvironmentVariable` | The environment variable on the local system to use a data source for trusted CA certificates. | String | None | +| `InlineString` | A string to inline in the configuration for use as a data source for trusted CA certificates. | String | None | +| `InlineBytes` | A sequence of bytes to inline in the configuration for use as a data source for trusted CA certificates. | String | None | + ### `Audiences` Specifies a set of audiences that the JWT is allowed to access, formatted as a list of `aud` (audience) claims. When this field is specified, all JWTs verified with the provider must address at least one of the audiences in order to be considered valid. @@ -794,6 +961,94 @@ Specifies a jittered exponential backoff strategy. When this field is empty, Env | `baseInterval`| Specifies the base interval to use for the next back off computation. | String | `1s` | | `maxInterval` | Specifies the maximum interval between retries. By default, this value is 10 times `BaseInterval`. | String | `10s` | +### `spec.jsonWebKeySet.remote.jwksCluster` + +Defines how Envoy fetches the remote JSON Web Key Set URI. + +#### Values + +- Default: None +- Data type: Map that can contain the following parameters: + + - [`discoveryType`](#spec-jsonwebkeyset-remote-jwkscluster-discoverytype) + - [`connectTimeout`](#spec-jsonwebkeyset-remote-jwkscluster-connecttimeout) + - [`tlsCertificates`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates) + +### `spec.jsonWebKeySet.remote.jwksCluster.discoveryType` + +Specifies the service discovery type to use for resolving the cluster. +You can specify the following discovery types: +- `STRICT_DNS` +- `STATIC` +- `LOGICAL_DNS` +- `EDS` +- `ORIGINAL_DST` + +String values must be a valid [Cluster DiscoveryType](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-enum-config-cluster-v3-cluster-discoverytype). + +#### Values + +- Default: `STRICT_DNS` +- Data type: String + +### `spec.jsonWebKeySet.remote.jwksCluster.connectTimeout` + +Specifies the timeout for new network connections to hosts in the cluster. + +#### Values + +- Default: `5s` +- Data type: String + +### `spec.jsonWebKeySet.remote.jwksCluster.tlsCertificates` + +Specifies the data containing certificate authority certificates to use for verifying a presented peer certificate. +Envoy does not verify certificates that peers present if this field is not configured. + +You cannot specify [`spec.tlsCertificates.caCertificateProviderInstance`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance) and [`spec.tlsCertificates.trustedCA`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca) in the same map. + +#### Values + +- Default: None +- Data type: Map that can contain the following parameters: + + - [`caCertificateProviderInstance`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-cacertificateproviderinstance) + - [`trustedCA`](#spec-jsonwebkeyset-remote-jwkscluster-tlscertificates-trustedca) + +### `spec.jsonWebKeySet.remote.jwksCluster.tlsCertificates.caCertificateProviderInstance` + +Speficies the certificate provider instance for fetching TLS certificates. + +#### Values + +- Default: None +- Data type: Map that can contain the following parameters: + +| Parameter | Description | Data type | Default value | +| :-------- | :------------------------------------------------- | :-------- | :------------ | +| `instanceName`| Refers to the certificate provider instance name. | String | `default` | +| `certificateName` | Specifies the certificate instances or types. For example, use `ROOTCA` to specify a root-certificate. | String | None | + +### `spec.jsonWebKeySet.remote.jwksCluster.tlsCertificates.trustedCA` + +Specifies TLS certificate data containing certificate authority certificates. Specify exactly one of the following data holders: +- `Filename` +- `EnvironmentVariable` +- `InlineString` +- `InlineBytes` + +#### Values + +- Default: None +- Data type: Map containing one of the following parameters: + +| Parameter | Description | Data type | Default value | +| :-------- | :------------------------------------------------- | :-------- | :------------ | +| `filename`| The name of the file on the local system to use a data source for trusted CA certificates. | String | None | +| `environmentVariable` | The environment variable on the local system to use a data source for trusted CA certificates. | String | None | +| `inlineString` | A string to inline in the configuration for use as a data source for trusted CA certificates. | String | None | +| `inlineBytes` | A sequence of bytes to inline in the configuration for use as a data source for trusted CA certificates. | String | None | + ### `spec.audiences` Specifies a set of audiences that the JWT is allowed to access, formatted as a list of `aud` (audience) claims. When this field is specified, all JWTs verified with the provider must address at least one of the audiences in order to be considered valid. diff --git a/website/content/docs/connect/gateways/index.mdx b/website/content/docs/connect/gateways/index.mdx index b333615c4ed0..0a002523af14 100644 --- a/website/content/docs/connect/gateways/index.mdx +++ b/website/content/docs/connect/gateways/index.mdx @@ -17,8 +17,6 @@ This topic provides an overview of the gateway features shipped with Consul. Gat ## Mesh Gateways --> **1.6.0+:** This feature is available in Consul versions 1.6.0 and newer. - Mesh gateways enable service mesh traffic to be routed between different Consul datacenters and admin partitions. The datacenters or partitions can reside in different clouds or runtime environments where general interconnectivity between all services in all datacenters isn't feasible. @@ -35,9 +33,37 @@ Mesh gateways enable the following scenarios: -> **Mesh gateway tutorial**: Follow the [mesh gateway tutorial](/consul/tutorials/developer-mesh/service-mesh-gateways) to learn concepts associated with mesh gateways. +## API Gateways + +API gateways enable network access, from outside a service mesh, to services running in a Consul service mesh. The +systems accessing the services in the mesh, may be within your organizational network or external to it. This type of +network traffic is commonly called _north-south_ network traffic because it refers to the flow of data into and out of +a specific environment. + +API gateways solve the following primary use cases: + +- **Control access at the point of entry**: Set the protocols of external connection + requests and secure inbound connections with TLS certificates from trusted + providers, such as Verisign and Let's Encrypt. +- **Simplify traffic management**: Load balance requests across services and route + traffic to the appropriate service by matching one or more criteria, such as + hostname, path, header presence or value, and HTTP method. + +Refer to the following documentation for information on how to configure and deploy API gateways: +- [API Gateways on VMs](/consul/docs/connect/gateways/api-gateway/usage) +- [API Gateways for Kubernetes](/consul/docs/api-gateway). + + ## Ingress Gateways --> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer. + + +Ingress gateway is deprecated and will not be enhanced beyond its current capabilities. Ingress gateway is fully supported +in this version but will be removed in a future release of Consul. + +Consul's API gateway is the recommended alternative to ingress gateway. + + Ingress gateways enable connectivity within your organizational network from services outside the Consul service mesh to services in the mesh. To accept ingress traffic from the public internet, use Consul's @@ -56,8 +82,6 @@ and the [ingress gateway tutorial](/consul/tutorials/developer-mesh/service-mesh ## Terminating Gateways --> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer. - Terminating gateways enable connectivity within your organizational network from services in the Consul service mesh to services outside the mesh. Services outside the mesh do not have sidecar proxies or are not [integrated natively](/consul/docs/connect/native). diff --git a/website/content/docs/connect/gateways/ingress-gateway/index.mdx b/website/content/docs/connect/gateways/ingress-gateway/index.mdx index 6d686c2c737b..3f0b4ea836f9 100644 --- a/website/content/docs/connect/gateways/ingress-gateway/index.mdx +++ b/website/content/docs/connect/gateways/ingress-gateway/index.mdx @@ -11,6 +11,15 @@ An ingress gateway is a type of proxy that enables network connectivity from ext ![Ingress Gateway Architecture](/img/ingress-gateways.png) + + +Ingress gateway is deprecated and will not be enhanced beyond its current capabilities. Ingress gateway is fully supported +in this version but will be removed in a future release of Consul. + +Consul's API gateway is the recommended alternative to ingress gateway. + + + ## Workflow The following stages describe how to add an ingress gateway to your service mesh: diff --git a/website/content/docs/k8s/connect/ingress-gateways.mdx b/website/content/docs/k8s/connect/ingress-gateways.mdx index 8deab0e03750..be1d8e297d2e 100644 --- a/website/content/docs/k8s/connect/ingress-gateways.mdx +++ b/website/content/docs/k8s/connect/ingress-gateways.mdx @@ -7,7 +7,14 @@ description: >- # Configure Ingress Gateways for Consul on Kubernetes --> 1.9.0+: This feature is available in Consul versions 1.9.0 and higher + + +Ingress gateway is deprecated and will not be enhanced beyond its current capabilities. Ingress gateway is fully supported +in this version but will be removed in a future release of Consul. + +Consul's API gateway is the recommended alternative to ingress gateway. + + ~> This topic requires familiarity with [Ingress Gateways](/consul/docs/connect/gateways/ingress-gateway). diff --git a/website/content/docs/services/usage/checks.mdx b/website/content/docs/services/usage/checks.mdx index afbf53dcc99b..e72b219dd0bd 100644 --- a/website/content/docs/services/usage/checks.mdx +++ b/website/content/docs/services/usage/checks.mdx @@ -170,7 +170,7 @@ To enable script checks, you must first enable the agent to send external reques ``` -Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. +Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. ### Script check exit codes The following exit codes returned by the script check determine the health check status: @@ -185,7 +185,7 @@ Any output of the script is captured and made available in the `Output` field of _HTTP_ checks send an HTTP request to the specified URL and report the service health based on the [HTTP response code](#http-check-response-codes). We recommend using HTTP checks over [script checks](#script-checks) that use cURL or another external process to check an HTTP operation. ### HTTP check configuration -Add an `http` field to the `check` block in your service definition file and specify the HTTP address, including port number, for the check to call. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. +Add an `http` field to the `check` block in your service definition file and specify the HTTP address, including port number, for the check to call. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. In the following example, an HTTP check named `HTTP API on port 5000` sends a `POST` request to the `health` endpoint every 10 seconds: @@ -245,7 +245,7 @@ Responses larger than 4KB are truncated. The HTTP response determines the status TCP checks establish connections to the specified IPs or hosts. If the check successfully establishes a connection, the service status is reported as `success`. If the IP or host does not accept the connection, the service status is reported as `critical`. We recommend TCP checks over [script checks](#script-checks) that use netcat or another external process to check a socket operation. ### TCP check configuration -Add a `tcp` field to the `check` block in your service definition file and specify the address, including port number, for the check to call. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. +Add a `tcp` field to the `check` block in your service definition file and specify the address, including port number, for the check to call. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. In the following example, a TCP check named `SSH TCP on port 22` attempts to connect to `localhost:22` every 10 seconds: @@ -320,7 +320,7 @@ By default, UDP checks timeout at 10 seconds, but you can specify a custom timeo OSService checks if an OS service is running on the host. OSService checks support Windows services on Windows hosts or SystemD services on Unix hosts. The check logs the service as `healthy` if it is running. If the service is not running, the status is logged as `critical`. All other results are logged with `warning`. A `warning` status indicates that the check is not reliable because an issue is preventing it from determining the health of the service. ### OSService check configurations -Add an `os_service` field to the `check` block in your service definition file and specify the name of the service to check. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference] for information about all health check configurations. +Add an `os_service` field to the `check` block in your service definition file and specify the name of the service to check. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. In the following example, an OSService check named `svcname-001 Windows Service Health` verifies that the `myco-svctype-svcname-001` service is running every 10 seconds: @@ -363,7 +363,7 @@ TTL checks also persist their last known status to disk so that the Consul agent You can manually mark a service as unhealthy using the [`consul maint` CLI command](/consul/commands/maint) or [`agent/maintenance` HTTP API endpoint](/consul/api-docs/agent#enable-maintenance-mode), rather than waiting for a TTL health check if the `ttl` duration is high. ### TTL check configuration -Add a `ttl` field to the `check` block in your service definition file and specify how long to wait for an update from the external process. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference] for information about all health check configurations. +Add a `ttl` field to the `check` block in your service definition file and specify how long to wait for an update from the external process. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. In the following example, a TTL check named `Web App Status` logs the application as `critical` if a status update is not received every 30 seconds: @@ -450,7 +450,7 @@ check = { gRPC checks send a request to the specified endpoint. These checks are intended for applications that support the standard [gRPC health checking protocol](https://github.com/grpc/grpc/blob/master/doc/health-checking.md). ### gRPC check configuration -Add a `grpc` field to the `check` block in your service definition file and specify the endpoint, including port number, for sending requests. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference] for information about all health check configurations. +Add a `grpc` field to the `check` block in your service definition file and specify the endpoint, including port number, for sending requests. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. In the following example, a gRPC check named `Service health status` probes the entire application by sending requests to `127.0.0.1:12345` every 10 seconds: @@ -564,7 +564,7 @@ For aliased services on the same agent, the check monitors the local state witho For the blocking query, the alias check presents the ACL token set on the actual service or the token configured in the check definition. If neither are available, the alias check falls back to the default ACL token set for the agent. Refer to [`acl.tokens.default`](/consul/docs/agent/config/config-files#acl_tokens_default) for additional information about the default ACL token. ### Alias checks configuration -Add an `alias_service` field to the `check` block in your service definition file and specify the name of the service or node to alias. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference] for information about all health check configurations. +Add an `alias_service` field to the `check` block in your service definition file and specify the name of the service or node to alias. All other fields are optional. Refer to [Health Checks Configuration Reference](/consul/docs/services/configuration/checks-configuration-reference) for information about all health check configurations. In the following example, an alias check with the ID `web-alias` reports the health state of the `web` service: