Save exposed ports in agent's store and expose them via API (#10173)

* Save exposed HTTP or GRPC ports to the agent's store
* Add those the health checks API so we can retrieve them from the API
* Change redirect-traffic command to also exclude those ports from inbound traffic redirection when expose.checks is set to true.

.changelog/10173.txt

@@ -0,0 +1,9 @@
+```release-note:improvement
+agent: Save exposed Envoy ports to the agent's state when `Expose.Checks` is true in proxy's configuration.
+```
+```release-note:improvement
+api: Add `ExposedPort` to the health check API resource.
+```
+```release-note:improvement
+command: Exclude exposed Envoy ports from traffic redirection when providing `-proxy-id` and `Expose.Checks` is set.
+```

agent/agent.go

@@ -2555,6 +2555,7 @@ func (a *Agent) addCheck(check *structs.HealthCheck, chkType *structs.CheckType,
 					return err
 				}
 				http.ProxyHTTP = httpInjectAddr(http.HTTP, proxy.Address, port)
+				check.ExposedPort = port
 			}
 
 			http.Start()
@@ -2624,6 +2625,7 @@ func (a *Agent) addCheck(check *structs.HealthCheck, chkType *structs.CheckType,
 					return err
 				}
 				grpc.ProxyGRPC = grpcInjectAddr(grpc.GRPC, proxy.Address, port)
+				check.ExposedPort = port
 			}
 
 			grpc.Start()
@@ -3809,6 +3811,8 @@ func (a *Agent) rerouteExposedChecks(serviceID structs.ServiceID, proxyAddr stri
 			return err
 		}
 		c.ProxyHTTP = httpInjectAddr(c.HTTP, proxyAddr, port)
+		hc := a.State.Check(cid)
+		hc.ExposedPort = port
 	}
 	for cid, c := range a.checkGRPCs {
 		if c.ServiceID != serviceID {
@@ -3819,6 +3823,8 @@ func (a *Agent) rerouteExposedChecks(serviceID structs.ServiceID, proxyAddr stri
 			return err
 		}
 		c.ProxyGRPC = grpcInjectAddr(c.GRPC, proxyAddr, port)
+		hc := a.State.Check(cid)
+		hc.ExposedPort = port
 	}
 	return nil
 }
@@ -3831,12 +3837,16 @@ func (a *Agent) resetExposedChecks(serviceID structs.ServiceID) {
 	for cid, c := range a.checkHTTPs {
 		if c.ServiceID == serviceID {
 			c.ProxyHTTP = ""
+			hc := a.State.Check(cid)
+			hc.ExposedPort = 0
 			ids = append(ids, cid)
 		}
 	}
 	for cid, c := range a.checkGRPCs {
 		if c.ServiceID == serviceID {
 			c.ProxyGRPC = ""
+			hc := a.State.Check(cid)
+			hc.ExposedPort = 0
 			ids = append(ids, cid)
 		}
 	}

agent/agent_test.go

@@ -1389,6 +1389,7 @@ func TestAgent_IndexChurn(t *testing.T) {
 // verifyIndexChurn registers some things and runs anti-entropy a bunch of times
 // in a row to make sure there are no index bumps.
 func verifyIndexChurn(t *testing.T, tags []string) {
+	t.Helper()
 	a := NewTestAgent(t, "")
 	defer a.Shutdown()
 
@@ -4299,8 +4300,8 @@ func TestAgent_RerouteExistingHTTPChecks(t *testing.T) {
 		t.Fatalf("failed to add svc: %v", err)
 	}
 
-	// Register a proxy and expose HTTP checks
+	// Register a proxy and expose HTTP checks.
-	// This should trigger setting ProxyHTTP and ProxyGRPC in the checks
+	// This should trigger setting ProxyHTTP and ProxyGRPC in the checks.
 	proxy := &structs.NodeService{
 		Kind:    "connect-proxy",
 		ID:      "web-proxy",
@@ -4324,36 +4325,30 @@ func TestAgent_RerouteExistingHTTPChecks(t *testing.T) {
 
 	retry.Run(t, func(r *retry.R) {
 		chks := a.ServiceHTTPBasedChecks(structs.NewServiceID("web", nil))
+		require.Equal(r, chks[0].ProxyHTTP, "http://localhost:21500/mypath?query")
+	})
 
-		got := chks[0].ProxyHTTP
+	retry.Run(t, func(r *retry.R) {
-		if got == "" {
+		hc := a.State.Check(structs.NewCheckID("http", nil))
-			r.Fatal("proxyHTTP addr not set in check")
+		require.Equal(r, hc.ExposedPort, 21500)
-		}
-
-		want := "http://localhost:21500/mypath?query"
-		if got != want {
-			r.Fatalf("unexpected proxy addr in check, want: %s, got: %s", want, got)
-		}
 	})
 
 	retry.Run(t, func(r *retry.R) {
 		chks := a.ServiceHTTPBasedChecks(structs.NewServiceID("web", nil))
 
-		// Will be at a later index than HTTP check because of the fetching order in ServiceHTTPBasedChecks
+		// GRPC check will be at a later index than HTTP check because of the fetching order in ServiceHTTPBasedChecks.
-		got := chks[1].ProxyGRPC
+		// Note that this relies on listener ports auto-incrementing in a.listenerPortLocked.
-		if got == "" {
+		require.Equal(r, chks[1].ProxyGRPC, "localhost:21501/myservice")
-			r.Fatal("ProxyGRPC addr not set in check")
-		}
-
-		// Node that this relies on listener ports auto-incrementing in a.listenerPortLocked
-		want := "localhost:21501/myservice"
-		if got != want {
-			r.Fatalf("unexpected proxy addr in check, want: %s, got: %s", want, got)
-		}
 	})
 
-	// Re-register a proxy and disable exposing HTTP checks
+	retry.Run(t, func(r *retry.R) {
+		hc := a.State.Check(structs.NewCheckID("grpc", nil))
+		require.Equal(r, hc.ExposedPort, 21501)
+	})
+
+	// Re-register a proxy and disable exposing HTTP checks.
 	// This should trigger resetting ProxyHTTP and ProxyGRPC to empty strings
+	// and reset saved exposed ports in the agent's state.
 	proxy = &structs.NodeService{
 		Kind:    "connect-proxy",
 		ID:      "web-proxy",
@@ -4377,21 +4372,24 @@ func TestAgent_RerouteExistingHTTPChecks(t *testing.T) {
 
 	retry.Run(t, func(r *retry.R) {
 		chks := a.ServiceHTTPBasedChecks(structs.NewServiceID("web", nil))
+		require.Empty(r, chks[0].ProxyHTTP, "ProxyHTTP addr was not reset")
+	})
 
-		got := chks[0].ProxyHTTP
+	retry.Run(t, func(r *retry.R) {
-		if got != "" {
+		hc := a.State.Check(structs.NewCheckID("http", nil))
-			r.Fatal("ProxyHTTP addr was not reset")
+		require.Equal(r, hc.ExposedPort, 0)
-		}
 	})
 
 	retry.Run(t, func(r *retry.R) {
 		chks := a.ServiceHTTPBasedChecks(structs.NewServiceID("web", nil))
 
-		// Will be at a later index than HTTP check because of the fetching order in ServiceHTTPBasedChecks
+		// Will be at a later index than HTTP check because of the fetching order in ServiceHTTPBasedChecks.
-		got := chks[1].ProxyGRPC
+		require.Empty(r, chks[1].ProxyGRPC, "ProxyGRPC addr was not reset")
-		if got != "" {
+	})
-			r.Fatal("ProxyGRPC addr was not reset")
+
-		}
+	retry.Run(t, func(r *retry.R) {
+		hc := a.State.Check(structs.NewCheckID("grpc", nil))
+		require.Equal(r, hc.ExposedPort, 0)
 	})
 }
 
@@ -4480,31 +4478,24 @@ func TestAgent_RerouteNewHTTPChecks(t *testing.T) {
 
 	retry.Run(t, func(r *retry.R) {
 		chks := a.ServiceHTTPBasedChecks(structs.NewServiceID("web", nil))
+		require.Equal(r, chks[0].ProxyHTTP, "http://localhost:21500/mypath?query")
+	})
 
-		got := chks[0].ProxyHTTP
+	retry.Run(t, func(r *retry.R) {
-		if got == "" {
+		hc := a.State.Check(structs.NewCheckID("http", nil))
-			r.Fatal("ProxyHTTP addr not set in check")
+		require.Equal(r, hc.ExposedPort, 21500)
-		}
-
-		want := "http://localhost:21500/mypath?query"
-		if got != want {
-			r.Fatalf("unexpected proxy addr in http check, want: %s, got: %s", want, got)
-		}
 	})
 
 	retry.Run(t, func(r *retry.R) {
 		chks := a.ServiceHTTPBasedChecks(structs.NewServiceID("web", nil))
 
-		// Will be at a later index than HTTP check because of the fetching order in ServiceHTTPBasedChecks
+		// GRPC check will be at a later index than HTTP check because of the fetching order in ServiceHTTPBasedChecks.
-		got := chks[1].ProxyGRPC
+		require.Equal(r, chks[1].ProxyGRPC, "localhost:21501/myservice")
-		if got == "" {
+	})
-			r.Fatal("ProxyGRPC addr not set in check")
-		}
 
-		want := "localhost:21501/myservice"
+	retry.Run(t, func(r *retry.R) {
-		if got != want {
+		hc := a.State.Check(structs.NewCheckID("grpc", nil))
-			r.Fatalf("unexpected proxy addr in grpc check, want: %s, got: %s", want, got)
+		require.Equal(r, hc.ExposedPort, 21501)
-		}
 	})
 }
 

agent/structs/structs.go

@@ -1400,7 +1400,7 @@ type NodeServiceList struct {
 	Services []*NodeService
 }
 
-// HealthCheck represents a single check on a given node
+// HealthCheck represents a single check on a given node.
 type HealthCheck struct {
 	Node        string
 	CheckID     types.CheckID // Unique per-node ID
@@ -1413,6 +1413,10 @@ type HealthCheck struct {
 	ServiceTags []string      // optional service tags
 	Type        string        // Check type: http/ttl/tcp/etc
 
+	// ExposedPort is the port of the exposed Envoy listener representing the
+	// HTTP or GRPC health check of the service.
+	ExposedPort int
+
 	Definition HealthCheckDefinition `bexpr:"-"`
 
 	EnterpriseMeta `hcl:",squash" mapstructure:",squash" bexpr:"-"`

agent/structs/structs_filtering_test.go

@@ -9,7 +9,7 @@ import (
 	"sync"
 	"testing"
 
-	bexpr "github.com/hashicorp/go-bexpr"
+	"github.com/hashicorp/go-bexpr"
 	"github.com/mitchellh/pointerstructure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -545,6 +545,11 @@ var expectedFieldConfigHealthCheck bexpr.FieldConfigurations = bexpr.FieldConfig
 		SupportedOperations: []bexpr.MatchOperator{bexpr.MatchEqual, bexpr.MatchNotEqual, bexpr.MatchIn, bexpr.MatchNotIn, bexpr.MatchMatches, bexpr.MatchNotMatches},
 		StructFieldName:     "Type",
 	},
+	"ExposedPort": &bexpr.FieldConfiguration{
+		CoerceFn:            bexpr.CoerceInt,
+		SupportedOperations: []bexpr.MatchOperator{bexpr.MatchEqual, bexpr.MatchNotEqual},
+		StructFieldName:     "ExposedPort",
+	},
 }
 
 var expectedFieldConfigCheckServiceNode bexpr.FieldConfigurations = bexpr.FieldConfigurations{

api/agent.go

@@ -63,6 +63,7 @@ type AgentCheck struct {
 	ServiceID   string
 	ServiceName string
 	Type        string
+	ExposedPort int
 	Definition  HealthCheckDefinition
 	Namespace   string `json:",omitempty"`
 }

command/connect/redirecttraffic/redirect_traffic.go

@@ -197,6 +197,21 @@ func (c *cmd) generateConfigFromFlags() (iptables.Config, error) {
 				cfg.ExcludeInboundPorts = append(cfg.ExcludeInboundPorts, strconv.Itoa(exposePath.ListenerPort))
 			}
 		}
+
+		// Exclude any exposed health check ports when Proxy.Expose.Checks is true.
+		if svc.Proxy.Expose.Checks {
+			// Get the health checks of the destination service.
+			checks, err := c.client.Agent().ChecksWithFilter(fmt.Sprintf("ServiceName == %q", svc.Proxy.DestinationServiceName))
+			if err != nil {
+				return iptables.Config{}, err
+			}
+
+			for _, check := range checks {
+				if check.ExposedPort != 0 {
+					cfg.ExcludeInboundPorts = append(cfg.ExcludeInboundPorts, strconv.Itoa(check.ExposedPort))
+				}
+			}
+		}
 	}
 
 	for _, port := range c.excludeInboundPorts {

command/connect/redirecttraffic/redirect_traffic_test.go

@@ -62,11 +62,11 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name         string
+		name           string
-		command      func() cmd
+		command        func() cmd
-		proxyService *api.AgentServiceRegistration
+		consulServices []api.AgentServiceRegistration
-		expCfg       iptables.Config
+		expCfg         iptables.Config
-		expError     string
+		expError       string
 	}{
 		{
 			"proxyID with service port provided",
@@ -77,14 +77,16 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
+						DestinationServiceName: "foo",
+					},
 				},
 			},
 			iptables.Config{
@@ -103,16 +105,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"bind_port": 21000,
+						Config: map[string]interface{}{
+							"bind_port": 21000,
+						},
 					},
 				},
 			},
@@ -132,16 +136,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"bind_port": "21000",
+						Config: map[string]interface{}{
+							"bind_port": "21000",
+						},
 					},
 				},
 			},
@@ -161,16 +167,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"bind_port": "invalid",
+						Config: map[string]interface{}{
+							"bind_port": "invalid",
+						},
 					},
 				},
 			},
@@ -186,16 +194,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					TransparentProxy: &api.TransparentProxyConfig{
+						DestinationServiceName: "foo",
-						OutboundListenerPort: 21000,
+						TransparentProxy: &api.TransparentProxyConfig{
+							OutboundListenerPort: 21000,
+						},
 					},
 				},
 			},
@@ -228,11 +238,13 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				ID:      "test-proxy-id",
+				{
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
+					Address: "1.1.1.1",
+				},
 			},
 			iptables.Config{},
 			"service test-proxy-id is not a proxy service",
@@ -357,16 +369,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"envoy_prometheus_bind_addr": "0.0.0.0:9000",
+						Config: map[string]interface{}{
+							"envoy_prometheus_bind_addr": "0.0.0.0:9000",
+						},
 					},
 				},
 			},
@@ -387,16 +401,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"envoy_prometheus_bind_addr": "9000",
+						Config: map[string]interface{}{
+							"envoy_prometheus_bind_addr": "9000",
+						},
 					},
 				},
 			},
@@ -412,16 +428,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"envoy_stats_bind_addr": "0.0.0.0:8000",
+						Config: map[string]interface{}{
+							"envoy_stats_bind_addr": "0.0.0.0:8000",
+						},
 					},
 				},
 			},
@@ -442,16 +460,18 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Config: map[string]interface{}{
+						DestinationServiceName: "foo",
-						"envoy_stats_bind_addr": "8000",
+						Config: map[string]interface{}{
+							"envoy_stats_bind_addr": "8000",
+						},
 					},
 				},
 			},
@@ -467,20 +487,22 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 				c.proxyID = "test-proxy-id"
 				return c
 			},
-			&api.AgentServiceRegistration{
+			[]api.AgentServiceRegistration{
-				Kind:    api.ServiceKindConnectProxy,
+				{
-				ID:      "test-proxy-id",
+					Kind:    api.ServiceKindConnectProxy,
-				Name:    "test-proxy",
+					ID:      "test-proxy-id",
-				Port:    20000,
+					Name:    "test-proxy",
-				Address: "1.1.1.1",
+					Port:    20000,
-				Proxy: &api.AgentServiceConnectProxyConfig{
+					Address: "1.1.1.1",
-					DestinationServiceName: "foo",
+					Proxy: &api.AgentServiceConnectProxyConfig{
-					Expose: api.ExposeConfig{
+						DestinationServiceName: "foo",
-						Paths: []api.ExposePath{
+						Expose: api.ExposeConfig{
-							{
+							Paths: []api.ExposePath{
-								ListenerPort:  23000,
+								{
-								LocalPathPort: 8080,
+									ListenerPort:  23000,
-								Path:          "/health",
+									LocalPathPort: 8080,
+									Path:          "/health",
+								},
 							},
 						},
 					},
@@ -494,12 +516,63 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 			},
 			"",
 		},
+		{
+			"proxy config has expose paths with checks set to true",
+			func() cmd {
+				var c cmd
+				c.init()
+				c.proxyUID = "1234"
+				c.proxyID = "test-proxy-id"
+				return c
+			},
+			[]api.AgentServiceRegistration{
+				{
+					ID:      "foo-id",
+					Name:    "foo",
+					Port:    8080,
+					Address: "1.1.1.1",
+					Checks: []*api.AgentServiceCheck{
+						{
+							Name:     "http",
+							HTTP:     "1.1.1.1:8080/health",
+							Interval: "10s",
+						},
+						{
+							Name:     "grpc",
+							GRPC:     "1.1.1.1:8081",
+							Interval: "10s",
+						},
+					},
+				},
+				{
+					Kind:    api.ServiceKindConnectProxy,
+					ID:      "test-proxy-id",
+					Name:    "test-proxy",
+					Port:    20000,
+					Address: "1.1.1.1",
+					Proxy: &api.AgentServiceConnectProxyConfig{
+						DestinationServiceName: "foo",
+						DestinationServiceID:   "foo-id",
+						Expose: api.ExposeConfig{
+							Checks: true,
+						},
+					},
+				},
+			},
+			iptables.Config{
+				ProxyUserID:         "1234",
+				ProxyInboundPort:    20000,
+				ProxyOutboundPort:   iptables.DefaultTProxyOutboundPort,
+				ExcludeInboundPorts: []string{"21500", "21501"},
+			},
+			"",
+		},
 	}
 
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			cmd := c.command()
-			if c.proxyService != nil {
+			if c.consulServices != nil {
 				testServer, err := testutil.NewTestServerConfigT(t, nil)
 				require.NoError(t, err)
 				testServer.WaitForLeader(t)
@@ -507,11 +580,12 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 
 				client, err := api.NewClient(&api.Config{Address: testServer.HTTPAddr})
 				require.NoError(t, err)
-
-				err = client.Agent().ServiceRegister(c.proxyService)
-				require.NoError(t, err)
-
 				cmd.client = client
+
+				for _, service := range c.consulServices {
+					err = client.Agent().ServiceRegister(&service)
+					require.NoError(t, err)
+				}
 			} else {
 				client, err := api.NewClient(&api.Config{Address: "not-reachable"})
 				require.NoError(t, err)
@@ -522,7 +596,7 @@ func TestGenerateConfigFromFlags(t *testing.T) {
 
 			if c.expError == "" {
 				require.NoError(t, err)
-				require.Equal(t, c.expCfg, cfg)
+				require.EqualValues(t, c.expCfg, cfg)
 			} else {
 				require.Error(t, err)
 				require.Contains(t, err.Error(), c.expError)

proto/pbservice/healthcheck.gen.go

@@ -80,6 +80,7 @@ func HealthCheckToStructs(s HealthCheck) structs.HealthCheck {
 	t.ServiceName = s.ServiceName
 	t.ServiceTags = s.ServiceTags
 	t.Type = s.Type
+	t.ExposedPort = int(s.ExposedPort)
 	t.Definition = HealthCheckDefinitionToStructs(s.Definition)
 	t.EnterpriseMeta = EnterpriseMetaToStructs(s.EnterpriseMeta)
 	t.RaftIndex = RaftIndexToStructs(s.RaftIndex)
@@ -97,6 +98,7 @@ func NewHealthCheckFromStructs(t structs.HealthCheck) HealthCheck {
 	s.ServiceName = t.ServiceName
 	s.ServiceTags = t.ServiceTags
 	s.Type = t.Type
+	s.ExposedPort = int32(t.ExposedPort)
 	s.Definition = NewHealthCheckDefinitionFromStructs(t.Definition)
 	s.EnterpriseMeta = NewEnterpriseMetaFromStructs(t.EnterpriseMeta)
 	s.RaftIndex = NewRaftIndexFromStructs(t.RaftIndex)

proto/pbservice/healthcheck.pb.go

@@ -52,6 +52,8 @@ type HealthCheck struct {
 	pbcommon.RaftIndex `protobuf:"bytes,11,opt,name=RaftIndex,proto3,embedded=RaftIndex" json:"RaftIndex"`
 	// mog: func-to=EnterpriseMetaToStructs func-from=NewEnterpriseMetaFromStructs
 	EnterpriseMeta pbcommon.EnterpriseMeta `protobuf:"bytes,13,opt,name=EnterpriseMeta,proto3" json:"EnterpriseMeta"`
+	// mog: func-to=int func-from=int32
+	ExposedPort int32 `protobuf:"varint,14,opt,name=ExposedPort,proto3" json:"ExposedPort,omitempty"`
 }
 
 func (m *HealthCheck) Reset()         { *m = HealthCheck{} }
@@ -285,72 +287,73 @@ func init() {
 func init() { proto.RegisterFile("proto/pbservice/healthcheck.proto", fileDescriptor_8a6f7448747c9fbe) }
 
 var fileDescriptor_8a6f7448747c9fbe = []byte{
-	// 1031 bytes of a gzipped FileDescriptorProto
+	// 1051 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x56, 0x4d, 0x73, 0xdb, 0x44,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x56, 0xcd, 0x52, 0xe3, 0x46,
-	0x18, 0xb6, 0xe2, 0x7c, 0x69, 0x9d, 0xa4, 0xc9, 0x36, 0x0d, 0xdb, 0xb4, 0xa3, 0x98, 0xc0, 0xc1,
+	0x17, 0xb5, 0x30, 0x3f, 0x56, 0x1b, 0x18, 0xe8, 0x61, 0xf8, 0x7a, 0x98, 0x29, 0xe1, 0x8f, 0x64,
-	0x0c, 0x41, 0x9e, 0x31, 0x03, 0x03, 0xcc, 0x00, 0x13, 0xdb, 0x6d, 0x62, 0x26, 0x09, 0x46, 0x16,
+	0x41, 0x2a, 0x44, 0xae, 0x22, 0x95, 0x54, 0x92, 0xaa, 0x24, 0x85, 0x31, 0x03, 0x4e, 0x01, 0x71,
-	0x3d, 0x70, 0x53, 0xe4, 0xb5, 0xad, 0xb1, 0xac, 0xf5, 0xac, 0x56, 0x99, 0x98, 0x2b, 0x7f, 0xa0,
+	0x64, 0x65, 0x16, 0xd9, 0x09, 0xb9, 0x6d, 0xab, 0x2c, 0xab, 0x55, 0xad, 0x16, 0x85, 0xf3, 0x14,
-	0xc7, 0xfe, 0x07, 0xfe, 0x48, 0x8e, 0x39, 0x72, 0x0a, 0x90, 0xfc, 0x0b, 0x4e, 0xcc, 0xbe, 0x2b,
+	0xb3, 0x9c, 0x17, 0xc8, 0x2a, 0x2f, 0xc2, 0x92, 0x65, 0x56, 0x24, 0x81, 0xb7, 0xc8, 0x2a, 0xd5,
-	0x39, 0x72, 0xad, 0x62, 0xd3, 0x69, 0x4f, 0x7e, 0x3f, 0x77, 0xb5, 0xef, 0xfb, 0x3c, 0x4f, 0x82,
+	0xb7, 0x25, 0x23, 0x8f, 0x35, 0xb1, 0x33, 0x35, 0x59, 0xd1, 0xf7, 0xdc, 0x7b, 0xbb, 0xd5, 0x7d,
-	0x3e, 0x1c, 0x72, 0x26, 0x58, 0x79, 0x78, 0x1e, 0x52, 0x7e, 0xe1, 0xb9, 0xb4, 0xdc, 0xa3, 0x8e,
+	0xcf, 0x39, 0x06, 0xfd, 0x3f, 0xe4, 0x4c, 0xb0, 0x6a, 0x78, 0x11, 0x51, 0x7e, 0xe9, 0xb9, 0xb4,
-	0x2f, 0x7a, 0x6e, 0x8f, 0xba, 0x7d, 0x13, 0x72, 0x58, 0x1f, 0x27, 0x77, 0x8d, 0x2e, 0x63, 0x5d,
+	0xda, 0xa3, 0x8e, 0x2f, 0x7a, 0x6e, 0x8f, 0xba, 0x7d, 0x13, 0x72, 0x58, 0x1f, 0x25, 0xb7, 0x8c,
-	0x9f, 0x96, 0x21, 0x71, 0x1e, 0x75, 0xca, 0xed, 0x88, 0x3b, 0xc2, 0x63, 0x81, 0x2a, 0xdd, 0x7d,
+	0x2e, 0x63, 0x5d, 0x9f, 0x56, 0x21, 0x71, 0x11, 0x77, 0xaa, 0xed, 0x98, 0x3b, 0xc2, 0x63, 0x81,
-	0x92, 0x9c, 0xe6, 0xb2, 0xc1, 0x80, 0x05, 0x65, 0xf5, 0x13, 0x27, 0xb7, 0xbb, 0xac, 0xcb, 0x54,
+	0x2a, 0xdd, 0x7a, 0x96, 0xee, 0xe6, 0xb2, 0xc1, 0x80, 0x05, 0x55, 0xf5, 0x27, 0x49, 0x6e, 0x74,
-	0x81, 0xb4, 0x54, 0x74, 0xff, 0xb7, 0x45, 0x54, 0x38, 0x86, 0x3b, 0x6b, 0xf2, 0x4e, 0x8c, 0xd1,
+	0x59, 0x97, 0xa9, 0x02, 0xb9, 0x52, 0xe8, 0xce, 0x2f, 0xf3, 0xa8, 0x7c, 0x02, 0x67, 0x1e, 0xca,
-	0xe2, 0x19, 0x6b, 0x53, 0xa2, 0x15, 0xb5, 0x92, 0x6e, 0x81, 0x8d, 0x8f, 0xd0, 0x0a, 0x24, 0x1b,
+	0x33, 0x31, 0x46, 0xf3, 0xe7, 0xac, 0x4d, 0x89, 0x56, 0xd1, 0x76, 0x75, 0x0b, 0xd6, 0xf8, 0x18,
-	0x75, 0xb2, 0x20, 0xc3, 0xd5, 0xcf, 0xfe, 0xb9, 0xd9, 0xfb, 0xa4, 0xeb, 0x89, 0x5e, 0x74, 0x6e,
+	0x2d, 0x41, 0xb2, 0x51, 0x27, 0x73, 0x12, 0xae, 0x7d, 0xf2, 0xd7, 0xed, 0xf6, 0x47, 0x5d, 0x4f,
-	0xba, 0x6c, 0x50, 0xee, 0x39, 0x61, 0xcf, 0x73, 0x19, 0x1f, 0x96, 0x5d, 0x16, 0x84, 0x91, 0x5f,
+	0xf4, 0xe2, 0x0b, 0xd3, 0x65, 0x83, 0x6a, 0xcf, 0x89, 0x7a, 0x9e, 0xcb, 0x78, 0x58, 0x75, 0x59,
-	0x16, 0xa3, 0x21, 0x0d, 0xcd, 0xb8, 0xc9, 0x4a, 0xba, 0xe1, 0x70, 0x67, 0x40, 0x49, 0x3e, 0x3e,
+	0x10, 0xc5, 0x7e, 0x55, 0x0c, 0x43, 0x1a, 0x99, 0x49, 0x93, 0x95, 0x76, 0xc3, 0xe6, 0xce, 0x80,
-	0xdc, 0x19, 0x50, 0xbc, 0x83, 0x96, 0x5b, 0xc2, 0x11, 0x51, 0x48, 0x16, 0x21, 0x1a, 0x7b, 0x78,
+	0x92, 0x62, 0xb2, 0xb9, 0x33, 0xa0, 0x78, 0x13, 0x2d, 0xb6, 0x84, 0x23, 0xe2, 0x88, 0xcc, 0x03,
-	0x1b, 0x2d, 0x9d, 0x31, 0x41, 0x43, 0xb2, 0x04, 0x61, 0xe5, 0xc8, 0xea, 0x1f, 0x23, 0x31, 0x8c,
+	0x9a, 0x44, 0x78, 0x03, 0x2d, 0x9c, 0x33, 0x41, 0x23, 0xb2, 0x00, 0xb0, 0x0a, 0x64, 0xf5, 0xf7,
-	0x04, 0x59, 0x56, 0xd5, 0xca, 0xc3, 0x4f, 0x91, 0xde, 0x52, 0x43, 0x6a, 0xd4, 0xc9, 0x0a, 0xa4,
+	0xb1, 0x08, 0x63, 0x41, 0x16, 0x55, 0xb5, 0x8a, 0xf0, 0x73, 0xa4, 0xb7, 0xd4, 0x23, 0x35, 0xea,
-	0xee, 0x03, 0xb8, 0x88, 0x0a, 0xb1, 0x03, 0xd7, 0xaf, 0x42, 0x3e, 0x1d, 0x4a, 0x55, 0xd8, 0x4e,
+	0x64, 0x09, 0x52, 0x0f, 0x00, 0xae, 0xa0, 0x72, 0x12, 0xc0, 0xf1, 0x25, 0xc8, 0x67, 0xa1, 0x4c,
-	0x37, 0x24, 0x7a, 0x31, 0x9f, 0xaa, 0x90, 0x21, 0xf9, 0xed, 0xf6, 0x68, 0x48, 0xc9, 0x9a, 0xfa,
+	0x85, 0xed, 0x74, 0x23, 0xa2, 0x57, 0x8a, 0x99, 0x0a, 0x09, 0xc9, 0x6f, 0xb7, 0x87, 0x21, 0x25,
-	0x76, 0x69, 0xe3, 0xe7, 0x08, 0xd5, 0x69, 0xc7, 0x0b, 0x3c, 0xb9, 0x03, 0x82, 0x8a, 0x5a, 0xa9,
+	0xcb, 0xea, 0xdb, 0xe5, 0x1a, 0xbf, 0x40, 0xa8, 0x4e, 0x3b, 0x5e, 0xe0, 0xc9, 0x19, 0x10, 0x54,
-	0x50, 0x29, 0x9a, 0xe3, 0x7d, 0x99, 0xa9, 0xc1, 0xde, 0xd7, 0x55, 0x17, 0xaf, 0x6e, 0xf6, 0x72,
+	0xd1, 0x76, 0xcb, 0xfb, 0x15, 0x73, 0x34, 0x2f, 0x33, 0xf3, 0xb0, 0x0f, 0x75, 0xb5, 0xf9, 0xeb,
-	0x56, 0xaa, 0x13, 0x7f, 0x8d, 0x74, 0xcb, 0xe9, 0x88, 0x46, 0xd0, 0xa6, 0x97, 0xa4, 0x00, 0xc7,
+	0xdb, 0xed, 0x82, 0x95, 0xe9, 0xc4, 0x5f, 0x22, 0xdd, 0x72, 0x3a, 0xa2, 0x11, 0xb4, 0xe9, 0x15,
-	0x6c, 0x99, 0xf1, 0xf2, 0xc6, 0x89, 0xea, 0xaa, 0xec, 0xbb, 0xbe, 0xd9, 0xd3, 0xac, 0xfb, 0x6a,
+	0x29, 0xc3, 0x36, 0xeb, 0x66, 0x32, 0xbc, 0x51, 0xa2, 0x56, 0x92, 0x7d, 0x37, 0xb7, 0xdb, 0x9a,
-	0x5c, 0x47, 0x1b, 0xcf, 0x02, 0x41, 0xf9, 0x90, 0x7b, 0x21, 0x3d, 0xa5, 0xc2, 0x21, 0xeb, 0xd0,
+	0xf5, 0x50, 0x8d, 0xeb, 0x68, 0xf5, 0x28, 0x10, 0x94, 0x87, 0xdc, 0x8b, 0xe8, 0x19, 0x15, 0x0e,
-	0xbf, 0x93, 0xf4, 0x4f, 0x66, 0xe3, 0xcb, 0x5f, 0xeb, 0xd9, 0xff, 0x08, 0x40, 0xd0, 0xa6, 0xfc,
+	0x59, 0x81, 0xfe, 0xcd, 0xb4, 0x7f, 0x3c, 0x9b, 0x1c, 0xfe, 0x46, 0x8f, 0xbc, 0xfe, 0xd1, 0x55,
-	0x85, 0xe3, 0x47, 0x54, 0xce, 0x1e, 0x0c, 0xa2, 0xc1, 0x1c, 0x94, 0xb3, 0xff, 0x72, 0x05, 0x3d,
+	0xc8, 0x22, 0xda, 0x6e, 0x32, 0x2e, 0xc8, 0x6a, 0x45, 0xdb, 0x5d, 0xb0, 0xb2, 0xd0, 0xce, 0x07,
-	0xca, 0x7c, 0x91, 0x9c, 0xcd, 0xb1, 0x6d, 0x37, 0x13, 0xd0, 0x48, 0x1b, 0x7f, 0x8c, 0xd6, 0xed,
+	0x40, 0x93, 0x36, 0xe5, 0x2f, 0x1d, 0x3f, 0xa6, 0x72, 0x3a, 0xb0, 0x20, 0x1a, 0xbc, 0x94, 0x0a,
-	0x93, 0x96, 0x9c, 0x20, 0xe5, 0x30, 0xf5, 0x87, 0x90, 0x9c, 0x0c, 0x26, 0x55, 0x7d, 0x6f, 0xf8,
+	0x76, 0x5e, 0x2d, 0xa1, 0x27, 0xb9, 0x77, 0x96, 0xaf, 0x77, 0x62, 0xdb, 0xcd, 0x94, 0x56, 0x72,
-	0x82, 0x72, 0xaf, 0x33, 0x02, 0x80, 0xad, 0x5a, 0x93, 0x41, 0xfc, 0x03, 0x5a, 0x56, 0x9f, 0x47,
+	0x8d, 0x3f, 0x44, 0x2b, 0xf6, 0x69, 0x4b, 0xbe, 0x31, 0xe5, 0x30, 0x97, 0xc7, 0x90, 0x1c, 0x07,
-	0xf2, 0xc5, 0x7c, 0xa9, 0x50, 0x39, 0x98, 0x35, 0x63, 0x53, 0x95, 0x3f, 0x0b, 0x04, 0x1f, 0xc5,
+	0xd3, 0xaa, 0xbe, 0x17, 0xbe, 0xa4, 0xdc, 0xeb, 0x0c, 0x81, 0x82, 0x25, 0x6b, 0x1c, 0xc4, 0xdf,
-	0x4f, 0x8e, 0x4f, 0x90, 0x08, 0x3a, 0xa5, 0xa2, 0xc7, 0xda, 0x09, 0xde, 0x94, 0x27, 0xdf, 0x50,
+	0xa1, 0x45, 0xf5, 0x79, 0xa4, 0x58, 0x29, 0xee, 0x96, 0xf7, 0xf7, 0xa6, 0x4d, 0xc1, 0x54, 0xe5,
-	0x65, 0xed, 0x11, 0xc1, 0xea, 0x0d, 0xd2, 0xc6, 0x9b, 0x28, 0x6f, 0xd7, 0x9a, 0x31, 0x02, 0xa5,
+	0x47, 0x81, 0xe0, 0xc3, 0xe4, 0x51, 0x92, 0x1d, 0x24, 0xc7, 0xce, 0xa8, 0xe8, 0xb1, 0x76, 0xca,
-	0x89, 0xbf, 0x47, 0xab, 0x0d, 0x39, 0xba, 0x0b, 0xc7, 0x07, 0x04, 0x16, 0x2a, 0x8f, 0x4d, 0x45,
+	0x48, 0x15, 0xc9, 0x3b, 0xd4, 0x58, 0x7b, 0x48, 0xb0, 0xba, 0x83, 0x5c, 0xe3, 0x35, 0x54, 0xb4,
-	0x4a, 0x33, 0x21, 0xa5, 0x59, 0x8f, 0x49, 0xa9, 0x16, 0xf6, 0xea, 0xcf, 0x3d, 0xcd, 0x1a, 0x37,
+	0x0f, 0x9b, 0x09, 0x47, 0xe5, 0x12, 0x7f, 0x8b, 0x4a, 0x0d, 0xf9, 0xb8, 0x97, 0x8e, 0x0f, 0x1c,
-	0xc9, 0x07, 0x2b, 0xc8, 0x9e, 0x3a, 0x97, 0x2d, 0xef, 0x57, 0x4a, 0xf4, 0xa2, 0x56, 0x5a, 0xb7,
+	0x2d, 0xef, 0x3f, 0x35, 0x95, 0x6c, 0xcd, 0x54, 0xb6, 0x66, 0x3d, 0x91, 0xad, 0x1a, 0xe9, 0xeb,
-	0x26, 0x83, 0xf8, 0x5b, 0xb4, 0x62, 0x7b, 0x03, 0xca, 0x22, 0x01, 0x60, 0x9e, 0xf3, 0x96, 0xa4,
+	0xdf, 0xb7, 0x35, 0x6b, 0xd4, 0x24, 0x2f, 0xac, 0x48, 0x7d, 0xe6, 0x5c, 0xb5, 0xbc, 0x9f, 0x29,
-	0x07, 0xf7, 0x91, 0x51, 0xa7, 0x9c, 0x76, 0xbd, 0x50, 0x50, 0x5e, 0xe3, 0x9e, 0xf0, 0x5c, 0xc7,
+	0xd1, 0x2b, 0xda, 0xee, 0x8a, 0x35, 0x0e, 0xe2, 0xaf, 0xd1, 0x92, 0xed, 0x0d, 0x28, 0x8b, 0x05,
-	0x8f, 0xc1, 0x7c, 0xd8, 0x11, 0x94, 0x03, 0x05, 0xe6, 0x3c, 0x75, 0xc6, 0x51, 0xd8, 0x40, 0xa8,
+	0xd0, 0x7d, 0xc6, 0x53, 0xd2, 0x1e, 0xdc, 0x47, 0x46, 0x9d, 0x72, 0xda, 0xf5, 0x22, 0x41, 0xf9,
-	0xe5, 0x72, 0x6f, 0x28, 0x0e, 0x79, 0x37, 0x24, 0x08, 0x10, 0x93, 0x8a, 0xe0, 0x03, 0xb4, 0x55,
+	0x21, 0xf7, 0x84, 0xe7, 0x3a, 0x7e, 0x42, 0xf7, 0x83, 0x8e, 0xa0, 0x1c, 0x44, 0x32, 0xe3, 0xae,
-	0x67, 0x6e, 0x9f, 0xf2, 0x1a, 0x0b, 0x84, 0xe3, 0x05, 0x94, 0x37, 0xea, 0x00, 0x72, 0xdd, 0x9a,
+	0x53, 0xb6, 0xc2, 0x06, 0x42, 0x2d, 0x97, 0x7b, 0xa1, 0x38, 0xe0, 0xdd, 0x88, 0x20, 0x60, 0x4c,
-	0x4e, 0x48, 0xe8, 0xb5, 0x7a, 0xd4, 0xf7, 0x63, 0x9e, 0x29, 0x47, 0x2e, 0xed, 0xb8, 0xd2, 0x6c,
+	0x06, 0xc1, 0x7b, 0x68, 0xbd, 0xce, 0xdc, 0x3e, 0xe5, 0x87, 0x2c, 0x10, 0x8e, 0x17, 0x50, 0xde,
-	0x9c, 0x1d, 0x91, 0x6d, 0xb5, 0x34, 0xe5, 0xc9, 0xa5, 0x1d, 0x59, 0xcd, 0x1a, 0x60, 0x5e, 0xb7,
+	0xa8, 0x83, 0x0c, 0x74, 0x6b, 0x32, 0x21, 0xa9, 0xd7, 0xea, 0x51, 0xdf, 0x4f, 0x94, 0xa8, 0x02,
-	0xc0, 0x96, 0xdf, 0x23, 0x7f, 0x7f, 0x0e, 0xa9, 0x7d, 0xd2, 0x22, 0x1b, 0x80, 0xa7, 0x54, 0x44,
+	0x39, 0xb4, 0x93, 0xfd, 0x66, 0xe3, 0xfc, 0x98, 0x6c, 0xa8, 0xa1, 0xa9, 0x48, 0x0e, 0xed, 0xd8,
-	0x4a, 0xc5, 0xa1, 0xef, 0x39, 0x21, 0xc8, 0xdc, 0x03, 0x25, 0x15, 0xe3, 0x00, 0xde, 0x47, 0x6b,
+	0x6a, 0x1e, 0x82, 0x2a, 0x74, 0x0b, 0xd6, 0xf2, 0x7b, 0xe4, 0xdf, 0x1f, 0x23, 0x6a, 0x9f, 0xb6,
-	0xe0, 0xc4, 0x4f, 0x24, 0x9b, 0x50, 0x30, 0x11, 0xc3, 0x5f, 0xa0, 0xbc, 0x6d, 0x9f, 0x90, 0xad,
+	0x80, 0xec, 0x25, 0x2b, 0x83, 0x48, 0x33, 0x39, 0xf0, 0x3d, 0x27, 0x02, 0x23, 0x7c, 0xa4, 0xcc,
-	0xf9, 0x67, 0x28, 0xeb, 0x77, 0x7f, 0x4a, 0x48, 0x06, 0xb0, 0x94, 0xe0, 0xea, 0xd3, 0x51, 0xcc,
+	0x64, 0x04, 0xe0, 0x1d, 0xb4, 0x0c, 0x41, 0x72, 0x45, 0xb2, 0x06, 0x05, 0x63, 0x18, 0xfe, 0x0c,
-	0x19, 0x69, 0xe2, 0x03, 0xb4, 0x74, 0x01, 0xb4, 0x5b, 0x88, 0x29, 0x3c, 0x81, 0xf2, 0x84, 0x9d,
+	0x15, 0x6d, 0xfb, 0x94, 0xac, 0xcf, 0xfe, 0x86, 0xb2, 0x7e, 0xeb, 0x87, 0x54, 0x64, 0x40, 0x4b,
-	0x96, 0x2a, 0xfa, 0x66, 0xe1, 0x2b, 0x6d, 0xff, 0x77, 0x1d, 0xe9, 0x00, 0x7d, 0x90, 0xa3, 0x94,
+	0x49, 0xae, 0x3e, 0x1d, 0x26, 0x9a, 0x91, 0x4b, 0xbc, 0x87, 0x16, 0x2e, 0x41, 0x76, 0x73, 0x89,
-	0x4e, 0x6b, 0xef, 0x44, 0xa7, 0x17, 0x32, 0x75, 0x3a, 0x9f, 0xad, 0xd3, 0x8b, 0x69, 0x9d, 0x9e,
+	0xc8, 0xc7, 0x58, 0x9e, 0xaa, 0xd3, 0x52, 0x45, 0x5f, 0xcd, 0x7d, 0xa1, 0xed, 0xfc, 0xaa, 0x23,
-	0x04, 0xc5, 0xd2, 0x14, 0x28, 0x12, 0xc5, 0x58, 0x4e, 0x29, 0xc6, 0x77, 0x63, 0x96, 0x6f, 0x03,
+	0x1d, 0xa8, 0x0f, 0x86, 0x95, 0x71, 0x72, 0xed, 0xbd, 0x38, 0xf9, 0x5c, 0xae, 0x93, 0x17, 0xf3,
-	0xcb, 0xd3, 0x4a, 0x3a, 0x7e, 0xe4, 0x5c, 0xcc, 0x5e, 0xc9, 0x64, 0xf6, 0xee, 0x34, 0xb3, 0x57,
+	0x9d, 0x7c, 0x3e, 0xeb, 0xe4, 0xe3, 0xa4, 0x58, 0x98, 0x20, 0x45, 0xea, 0x18, 0x8b, 0x19, 0xc7,
-	0xb3, 0x99, 0xad, 0xbf, 0x0d, 0xb3, 0x27, 0x70, 0x85, 0x66, 0xe1, 0xaa, 0x90, 0x81, 0xab, 0x4c,
+	0xf8, 0x66, 0xa4, 0xf2, 0x0d, 0x50, 0x79, 0xd6, 0x6b, 0x47, 0x97, 0x9c, 0x49, 0xd9, 0x4b, 0xb9,
-	0xa6, 0xac, 0xcd, 0x64, 0xca, 0x7a, 0x36, 0x53, 0x9e, 0x66, 0x32, 0x65, 0xe3, 0x8d, 0x4c, 0x79,
+	0xca, 0xde, 0x9a, 0x54, 0x76, 0x29, 0x5f, 0xd9, 0xfa, 0xbb, 0x28, 0x7b, 0x8c, 0x57, 0x68, 0x1a,
-	0x30, 0xc5, 0x94, 0x29, 0x09, 0x7f, 0x32, 0x97, 0x84, 0x6f, 0x66, 0x49, 0x78, 0x4a, 0xd1, 0xb6,
+	0xaf, 0xca, 0x39, 0xbc, 0xca, 0x55, 0xca, 0xf2, 0x54, 0xa5, 0xac, 0xe4, 0x2b, 0xe5, 0x79, 0xae,
-	0xde, 0x42, 0xd1, 0x62, 0xca, 0xe1, 0xff, 0x47, 0x39, 0x5c, 0x41, 0xdb, 0xad, 0xc8, 0x75, 0x69,
+	0x52, 0x56, 0xdf, 0xaa, 0x94, 0x47, 0x13, 0x4a, 0x99, 0xb0, 0xf0, 0x67, 0x33, 0x59, 0xf8, 0x5a,
-	0x18, 0x56, 0x69, 0x87, 0x71, 0xda, 0x74, 0xc2, 0xd0, 0x0b, 0xba, 0xe4, 0x51, 0x51, 0x2b, 0x2d,
+	0x9e, 0x85, 0x67, 0x1c, 0x6d, 0xfd, 0x1d, 0x1c, 0x2d, 0x91, 0x1c, 0xfe, 0x77, 0x92, 0xc3, 0xfb,
-	0x59, 0x99, 0x39, 0xfc, 0x25, 0xda, 0x79, 0xee, 0x78, 0x7e, 0xc4, 0x69, 0x9c, 0x48, 0x54, 0x8f,
+	0x68, 0xa3, 0x15, 0xbb, 0x2e, 0x8d, 0xa2, 0x1a, 0xed, 0x30, 0x4e, 0x9b, 0x4e, 0x14, 0x79, 0x41,
-	0xec, 0x40, 0xd7, 0x1b, 0xb2, 0x72, 0xff, 0x4d, 0xce, 0x2e, 0x47, 0x80, 0xeb, 0x0f, 0xd4, 0xfe,
+	0x97, 0x3c, 0x81, 0x9f, 0xc0, 0xdc, 0x1c, 0xfe, 0x1c, 0x6d, 0xbe, 0x70, 0x3c, 0x3f, 0xe6, 0x34,
-	0xc7, 0x81, 0x71, 0x16, 0x96, 0x40, 0x52, 0x59, 0xd8, 0xc4, 0x6c, 0xc1, 0x7e, 0xf8, 0xee, 0x04,
+	0x49, 0xa4, 0xae, 0x47, 0x36, 0xa1, 0xeb, 0x2d, 0x59, 0x39, 0xff, 0x26, 0x67, 0x57, 0x43, 0xe0,
-	0x7b, 0xea, 0x4f, 0xd0, 0x63, 0x78, 0xd7, 0x64, 0xf0, 0x3d, 0xa8, 0x55, 0xf5, 0xf4, 0xea, 0x6f,
+	0xf5, 0xff, 0xd4, 0xfc, 0x47, 0xc0, 0x28, 0x0b, 0x43, 0x20, 0x99, 0x2c, 0x4c, 0x62, 0xba, 0x61,
-	0x23, 0x77, 0x75, 0x6b, 0x68, 0xd7, 0xb7, 0x86, 0xf6, 0xd7, 0xad, 0xa1, 0xbd, 0xbc, 0x33, 0x72,
+	0x3f, 0x7e, 0x7f, 0x86, 0x3d, 0xf1, 0x13, 0xf4, 0x14, 0xee, 0x35, 0x0e, 0xfe, 0x07, 0x6e, 0x55,
-	0xaf, 0xee, 0x8c, 0xdc, 0xf5, 0x9d, 0x91, 0xfb, 0xe3, 0xce, 0xc8, 0xfd, 0xf2, 0xe9, 0x7f, 0x89,
+	0x3b, 0xbb, 0xfe, 0xd3, 0x28, 0x5c, 0xdf, 0x19, 0xda, 0xcd, 0x9d, 0xa1, 0xfd, 0x71, 0x67, 0x68,
-	0xd5, 0x6b, 0xff, 0x2a, 0x9f, 0x2f, 0x43, 0xe0, 0xf3, 0x7f, 0x03, 0x00, 0x00, 0xff, 0xff, 0x5b,
+	0xaf, 0xee, 0x8d, 0xc2, 0xeb, 0x7b, 0xa3, 0x70, 0x73, 0x6f, 0x14, 0x7e, 0xbb, 0x37, 0x0a, 0x3f,
-	0x4c, 0x80, 0x35, 0x44, 0x0b, 0x00, 0x00,
+	0x7d, 0xfc, 0x4f, 0x66, 0xf5, 0xc6, 0x3f, 0xd3, 0x17, 0x8b, 0x00, 0x7c, 0xfa, 0x77, 0x00, 0x00,
+	0x00, 0xff, 0xff, 0x9d, 0xa1, 0x76, 0xfc, 0x66, 0x0b, 0x00, 0x00,
 }
 
 func (m *HealthCheck) Marshal() (dAtA []byte, err error) {
@@ -373,6 +376,11 @@ func (m *HealthCheck) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.ExposedPort != 0 {
+		i = encodeVarintHealthcheck(dAtA, i, uint64(m.ExposedPort))
+		i--
+		dAtA[i] = 0x70
+	}
 	{
 		size, err := m.EnterpriseMeta.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -1043,6 +1051,9 @@ func (m *HealthCheck) Size() (n int) {
 	}
 	l = m.EnterpriseMeta.Size()
 	n += 1 + l + sovHealthcheck(uint64(l))
+	if m.ExposedPort != 0 {
+		n += 1 + sovHealthcheck(uint64(m.ExposedPort))
+	}
 	return n
 }
 
@@ -1715,6 +1726,25 @@ func (m *HealthCheck) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 14:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExposedPort", wireType)
+			}
+			m.ExposedPort = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowHealthcheck
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ExposedPort |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipHealthcheck(dAtA[iNdEx:])

proto/pbservice/healthcheck.proto

@@ -41,6 +41,9 @@ message HealthCheck {
 
     // mog: func-to=EnterpriseMetaToStructs func-from=NewEnterpriseMetaFromStructs
     common.EnterpriseMeta EnterpriseMeta = 13  [(gogoproto.nullable) = false];
+
+    // mog: func-to=int func-from=int32
+    int32 ExposedPort = 14;
 }
 
 message HeaderValue {