Consul service mesh relies on Envoy sidecar proxies to handle all inbound and outbound traffic for registered services. Configuring these proxies correctly is central to operating a reliable service mesh, and Consul provides two complementary mechanisms for this: the global proxy-defaults configuration entry and per-service proxy configuration embedded in service definitions. Together, these mechanisms give operators layered control from mesh-wide defaults down to individual service instances. The proxy-defaults configuration entry sets global passthrough Envoy settings for all proxies in the mesh, including sidecars and gateways. It must use Kind set to proxy-defaults and Name set to global, as Consul supports only one such entry at a time. Within the Config block, operators can supply arbitrary key-value pairs that are forwarded to Envoy, such as envoy_prometheus_bind_addr to expose metrics or local_connect_timeout_ms to tune connection behavior. The Mode field controls whether proxies operate in direct mode, where applications dial proxy listeners explicitly, or transparent mode, where inbound and outbound traffic is captured and redirected automatically. The MeshGateway block sets the default mode for reaching services in other datacenters, with valid values of local, remote, and none. The Expose block enables HTTP paths to be exposed through Envoy for non-mesh traffic such as Prometheus scrapes or kubelet health checks, using the Expose.Checks boolean for agent-registered checks or the Expose.Paths list for specific endpoints. Per-service proxy configuration is declared inside the proxy block of a connect-proxy service registration. Required fields include destination_service_name, which identifies which service the proxy represents, and port, where other services can reach the proxy. The upstreams array defines outbound listeners the proxy creates for downstream connections. Each upstream entry requires destination_name and local_bind_port, and can optionally specify datacenter, destination_namespace, destination_partition, destination_peer, and a per-upstream config block for timeouts and retries. The expose block is also available at the per-service level and is only compatible with Envoy proxies. Unix domain sockets are supported for both ingress and egress using local_service_socket_path and local_bind_socket_path respectively, and these conflict with port-based configuration. For proxy mode resolution, Consul follows a precedence chain: the proxy service's own Proxy configuration takes highest priority, then service-defaults for the proxied service, and finally the global proxy-defaults. If no mode is set anywhere, the proxy defaults to direct mode.
The proxy-defaults configuration entry uses Kind set to proxy-defaults and Name set to global, and Consul enforces that only one such entry can exist at a time, applying to all proxies including sidecars and gateways.
The Config block in both proxy-defaults and per-service proxy registrations accepts arbitrary key-value pairs that are forwarded to the Envoy proxy, enabling fine-grained tuning such as envoy_prometheus_bind_addr and local_connect_timeout_ms.
Each entry in the upstreams array requires destination_name and local_bind_port, and optionally supports destination_namespace, destination_partition, destination_peer, datacenter, and a per-upstream config block for timeouts and retries.
The expose block, available in both proxy-defaults and per-service registrations, allows non-mesh traffic to reach services listening only on localhost by configuring Envoy listeners at specific ports for paths like /healthz or /metrics; it is only compatible with Envoy proxies.
Proxy mode resolution follows a precedence chain from the proxy service's own configuration, to service-defaults, to global proxy-defaults, with a fallback of direct mode if none of these specify a value.
Unix domain socket support for upstream connections uses local_bind_socket_path and local_bind_socket_mode in the upstream config, and these conflict with local_bind_port and local_bind_address within the same upstream entry.