Skip to content

Consul Connect




the listenerConfig must be either an InboundListener or an OutboundListener

inbound: {InboundListenerConfig}
outbound: {OutboundListenerConfig}

Field Type Label Description
inbound InboundListenerConfig
outbound OutboundListenerConfig


configuration for the inbound listener this listener does authentication and connects clients to the local service

auth_config: {AuthConfig}
local_service_address: string
local_service_name: string

Field Type Label Description
auth_config AuthConfig configuration for tls-based auth filter
local_service_address string the address of the local upstream being proxied the service being proxied must be reachable by Envoy
local_service_name string the name of the local consul service being proxied


AuthConfig contains information necessary to communicate with the Authentication Server (Consul Agent)

target: string
authorize_hostname: string
authorize_port: uint32
authorize_path: string
request_timeout: {google.protobuf.Duration}

Field Type Label Description
target string The name of the service who owns this proxy Target must be delivered by the filter as part of the authorize request payload
authorize_hostname string the hostname of the authorization REST service
authorize_port uint32 the port of the authorization REST service
authorize_path string the request path for the authorization REST service NOTE: currently ignored by the plugin and filter
request_timeout google.protobuf.Duration Connection Timeout tells the filter to set a timeout for unresponsive connections created to this upstream. If not provided by the user, it will set to a default value


The configuration for the outbound listeners which serve as "tcp routes"

destination_consul_service: string
destination_consul_type: string

Field Type Label Description
destination_consul_service string The name of the consul service which is the destination for the listener
destination_consul_type string TODO (ilackarms): support destination type in Consul Connect API