|
|
|
@ -407,7 +407,9 @@ The following are not part of the threat model for client agents:
|
|
|
|
|
configured identity, and extract information from Consul when ACLs are disabled. |
|
|
|
|
|
|
|
|
|
- **DNS** - Malicious actors with access to a Consul agent DNS endpoint may be able to extract service catalog |
|
|
|
|
information. Gossip - Malicious actors with access to a Consul agent Serf gossip endpoint may be able to impersonate |
|
|
|
|
information. |
|
|
|
|
|
|
|
|
|
- **Gossip** - Malicious actors with access to a Consul agent Serf gossip endpoint may be able to impersonate |
|
|
|
|
agents within a datacenter. Gossip encryption should be enabled, with a regularly rotated gossip key. |
|
|
|
|
|
|
|
|
|
- **Proxy (xDS)** - Malicious actors with access to a Consul agent xDS endpoint may be able to extract Envoy service |
|
|
|
|