consul.api.connect module

class consul.api.connect.Intention[source]

Bases: TypedDict

SourceNS: str
SourceName: str
DestinationNS: str
DestinationName: str
SourcePartition: str
DestinationPartition: str
SourcePeer: str
SourceType: str
Action: str
Permissions: list[dict[str, Any]]
Description: str
Meta: dict[str, str]
Precedence: int
CreateIndex: int
ModifyIndex: int
class consul.api.connect.Connect(agent)[source]

Bases: object

class CA(agent)[source]

Bases: object

roots(pem=False, token=None)[source]
Parameters:
configuration(token=None)[source]
Parameters:

token (str | None)

class Intentions(agent)[source]

Bases: object

Manages intentions using the exact-match model (Consul 1.9+). The legacy UUID-based CRUD model (/v1/connect/intentions/:uuid) is deprecated and intentionally not implemented here.

upsert(source, destination, token=None, action=None, source_type='consul', description='', meta=None, permissions=None, dc=None)[source]

Creates or updates an intention between source and destination. Requires a token with intentions:write on the destination service. :param source: The source service name (or “*” for wildcard). :param destination: The destination service name (or “*” for wildcard). :param token: token with intentions:write capability :param action: Either “allow” or “deny”. Mutually exclusive with permissions. :param source_type: Currently only “consul” is supported by Consul itself. :param description: Free form human-readable description of the intention. :param meta: Optional key/value metadata to attach to the intention. :param permissions: Optional list of L7 permissions. Mutually exclusive with action. :param dc: Optional datacenter to target; defaults to the client’s own dc. :return: True if the intention was created or updated

Parameters:
Return type:

bool

read(source, destination, token=None, dc=None)[source]

Reads the intention between source and destination. Requires a token with intentions:read on either the source or the destination service.

Parameters:

  • source (str)

  • destination (str)

  • token (str | None)

  • dc (str | None)

Return type:

Intention

delete(source, destination, token=None, dc=None)[source]

Deletes the intention between source and destination. Requires a token with intentions:write on the destination service.

Parameters:

  • source (str)

  • destination (str)

  • token (str | None)

  • dc (str | None)

Return type:

bool

list(token=None, dc=None, filter_expr=None)[source]

Lists all intentions. Requires a token with intentions:read capability. :param filter_expr: Optional bexpr filter expression.

Parameters:

  • token (str | None)

  • dc (str | None)

  • filter_expr (str | None)

Return type:

builtins.list[Intention]

check(source, destination, token=None, source_type=None, dc=None)[source]

Evaluates whether a connection from source to destination is allowed given the current intentions. Requires a token with intentions:read capability. :param source_type: Defaults to “consul” server-side if omitted. :return: True if the connection is allowed

Parameters:

  • source (str)

  • destination (str)

  • token (str | None)

  • source_type (str | None)

  • dc (str | None)

Return type:

bool

match(by, name, token=None, dc=None)[source]

Returns the list of intentions matching name, in evaluation order. Requires a token with intentions:read capability. :param by: Either “source” or “destination”. :param name: The service name to match against.

Parameters:
Return type:

dict[str, builtins.list[Intention]]