I85PREP
⌘ K
HFCP study materials
HFCP study resources

HFCP: Service Networking and Service Mesh

HFCP · Work through your exam, one topic at a time.

All guide sections

Service Networking and Service Mesh

Domain 5 - Service Networking and Service Mesh. This domain tests service discovery and secure service-to-service communication, primarily with Consul. Expect questions on the catalog, health checks, DNS/HTTP interfaces, Connect, intentions, and gateways.

Core rules

  • Services register with Consul, including name, address, port, tags, and health checks. The catalog is the source of truth for discovery.
  • Health checks determine readiness. A critical check removes the instance from healthy DNS and API results, so traffic stops routing to it.
  • Discovery works over DNS (service.service.consul) and the HTTP API. Consul DNS returns healthy instances; the API exposes catalog and health endpoints.
  • Consul Connect provides mutual TLS and identity-based authorization. Sidecar proxies handle traffic; services present certificates issued by Consul. Intentions define which source service may talk to which destination service, and are enforced at the proxy.
  • Gateways extend the mesh: ingress for external traffic, terminating for external destinations, mesh for cross-cluster or cross-datacenter traffic.
  • ACLs protect the API and catalog; tokens must be supplied for registration and queries when ACLs are enabled.

Worked example

An api service must call payments. You register both with health checks, enable Connect, and deploy sidecars. Create an intention allowing api to payments; leave other sources denied. The sidecars establish mTLS using service identities, and the intention authorizes the connection at the destination proxy. If payments fails its health check, Consul removes that instance from healthy discovery results and the api sidecar stops sending new traffic to it. The reasoning: identity comes from the service registration, encryption comes from Connect, and authorization comes from intentions - discovery alone is not security.

Traps

  • Enabling Connect and assuming the mesh is zero-trust without defining intentions and considering the default intention action.
  • Forgetting that intentions are service-to-service (L4), not end-user authentication.
  • Registering a service with a failing health check and expecting DNS to return it.
  • Using the HTTP API without an ACL token when ACLs are enabled.
  • Assuming a sidecar is optional for all workloads; native integrations exist, but most services need a proxy.