From f6685177f0601377fc816e626f2e47eb388d8a24 Mon Sep 17 00:00:00 2001 From: Mitchell Hashimoto Date: Wed, 6 Jun 2018 21:18:32 -0700 Subject: [PATCH] website: document the precedence table --- website/source/api/connect/intentions.html.md | 2 ++ website/source/docs/connect/intentions.html.md | 18 +++++++++++++++--- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/website/source/api/connect/intentions.html.md b/website/source/api/connect/intentions.html.md index fc45e5fd7a..292e17f876 100644 --- a/website/source/api/connect/intentions.html.md +++ b/website/source/api/connect/intentions.html.md @@ -128,6 +128,7 @@ $ curl \ "DefaultAddr": "", "DefaultPort": 0, "Meta": {}, + "Precedence": 9, "CreatedAt": "2018-05-21T16:41:27.977155457Z", "UpdatedAt": "2018-05-21T16:41:27.977157724Z", "CreateIndex": 11, @@ -175,6 +176,7 @@ $ curl \ "DefaultAddr": "", "DefaultPort": 0, "Meta": {}, + "Precedence": 9, "CreatedAt": "2018-05-21T16:41:27.977155457Z", "UpdatedAt": "2018-05-21T16:41:27.977157724Z", "CreateIndex": 11, diff --git a/website/source/docs/connect/intentions.html.md b/website/source/docs/connect/intentions.html.md index 6c0c61d03a..74be661a87 100644 --- a/website/source/docs/connect/intentions.html.md +++ b/website/source/docs/connect/intentions.html.md @@ -81,10 +81,22 @@ Created At: Friday, 25-May-18 02:07:51 CEST ## Precedence and Match Order Intentions are matched in an implicit order based on specificity, preferring -deny over allow. The full precedence table is shown below and is evaluated -top to bottom. +deny over allow. Specificity is determined by whether a value is an exact +specified value or is the wildcard value `*`. +The full precedence table is shown below and is evaluated +top to bottom, with larger numbers being evaluated first. -TODO +| Source Name | Destination Name | Precedence | +| ----------- | ---------------- | ---------- | +| Exact | Exact | 9 | +| `*` | Exact | 8 | +| Exact | `*` | 6 | +| `*` | `*` | 5 | + +The precedence value can be read from the [API](/api/connect/intentions.html) +after an intention is created. +Precedence cannot be manually overridden today. This is a feature that will +be added in a later version of Consul. ## Intention Management Permissions