Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
    lokesp11
    @lokesp11
    @sstent It's list of nodes . Is there any limitation with list of nodes?
    Even if one server is down all server peers/agents will have the info about it leaving the mesh and catalog will also be updated accordingly . I am trying to understand once this info is updated is there any possibility if consul agent will still try to connect the server which not reachable?
    johnny101
    @johnny101:matrix.org
    [m]
    We seem to be hitting an issue with token rotation and the consul-agent token in our Nomad cluster. If indeed an issue that needs fixing (rather than some kind of approach change), I'm not sure if this would fall more under Nomad or Consul. Hence the cross post here in addition to the Nomad room. I described the setup and the issue here: https://github.com/hashicorp/nomad/issues/9813#issuecomment-930456285. If anyone has any feedback, that would be appreciated.
    Ross Has No Clever Friends
    @rosshasnocleve1_twitter
    Hashicorp devs, do any of you know someone who works on go-discover? There is a pull request lingering since February that looks approved but not merged, and a lot of people are waiting for it.
    Blake Covarrubias
    @blake
    The Consul team has been reviewing go-discover PRs pretty regularly. Which PR are you referring to?
    Michael Aldridge
    @the-maldridge
    reviewing yes, but merging relatively infrequently. I'd bet this is in reference to either proxmox or hetzner, as those are the only two from February
    Ross Has No Clever Friends
    @rosshasnocleve1_twitter
    HI Blake, this one: hashicorp/go-discover#167
    Blake Covarrubias
    @blake
    I was mobile earlier and was having some trouble replying from my phone. I tried to send a few messages, but it looks like they didn't go through.
    Michael Aldridge
    @the-maldridge
    the gitter/matrix ecosystem has been a little wobbly today, probably a little bit of both
    Blake Covarrubias
    @blake
    I'll discuss this PR with our team tomorrow, and will ask that someone follow up on the GitHub issue.
    lokesp11
    @lokesp11

    Does consul support CA Signed certificate for tls communication and can it be integrated with vault to get certificate from vault pki? We are exploring option to use VAULT PKI Infrastructure and trying to implement consul tls communication with certificate generated by vault pki instead of inbuild consul CA?

    Please suggest or help in pointing me to similar use case if exist?

    Thanks in advance

    1 reply
    Ross Has No Clever Friends
    @rosshasnocleve1_twitter
    Thanks Blake!
    Yann Huissoud
    @aiqency
    Any updates on hashicorp/consul#8687. Can we access the specific key modified through consul watch keyprefix as of now?
    2 replies
    Narendra Patel
    @narendrapatel
    Hi, has anyone tried the Escape-Hatch Overrides option? Need to configure envoy access logging. Able to configure it directly on envoy but struggling to set it via Consul. Also how are envoy cluster names formed? I see consul configuring something like api.default.dc1.internal.af617b02-1e21-52c2-d297-36b92be86af9.consul. Not sure what does this hexadecimal string signifies.
    5 replies
    John Spencer
    @johnnyplaydrums
    Noob question about service to service communication when services are using random, dynamically allocated ports (like in a Consul/Nomad cluster). If the port is know ahead of time, e.g. port 80, serviceA can talk to serviceB using the dns record serviceB.service.consul:80. But if the port is dynamically allocated, how does serviceA communicate with serviceB? It could find the port via dig SRV or consul API, but that's additional application code and overhead. Is there a better way?
    Yoan Blanc
    @greut
    @johnnyplaydrums you need some kind of load balancer, e.g. https://www.consul.io/docs/connect
    2 replies
    Sam Lee
    @D2Engine_twitter
    hi, i'd like to access consul ui by ingress subpath.
    deployed "hashicorp/consul:1.10.3" helm chart and tried this additional extraConfig. But it's redirected to "/" path . Is there anything i missed ?
      extraConfig: |
        {
          "ui_config": {
            "content_path": "/sandbox/consul"
          }
        }
    1 reply
    Ross Rochford
    @RossRochford_twitter

    @johnnyplaydrums I suspect a lot of people end up using consul upstreams (sidecars) in Nomad simply for the convenience of it. In this scenario Nomad gives your tasks a single addr/port to communicate through.

    It would be nice to have a similarly convenient setup but with the option of bypassing the security features (encryption, intentions) of consul connect. i.e. just the load balancing and service discovery pieces.

    1 reply
    Andreas Anderssson
    @dinapappor
    I am having a problem where consul isn't being updated fast enough with pods in kubernetes.
    Not sure how to solve that problem.
    We have consul-write-interval set to 1s.
    Yet, our loadbalancer (traefik) is still trying to send traffic to old pods.
    I am not sure if it's because
    1) We don't execute healthchecks from consul to kubernetes pods.
    2) The data in consul is stale.
    How have other people solved this problem?
    Narendra Patel
    @narendrapatel
    Hi, is it possible to set mTLS for ingress-gateways? We want to set inbound mTLS to the mesh for one of our services. Not able to find options for the same. Saw an option for mTLS with https://www.hashicorp.com/blog/proxy-ingress-to-consul-service-mesh but it involves too many moving parts. Preference is for Ingress Gateway with envoy proxy.
    4 replies
    Alex Oskotsky
    @aoskotsky-amplify
    I'm seeing a weird issue where every 10 minutes envoy logs a line this this add 3 cluster(s), remove 2 cluster(s). During that time I'll also see /failed_eds_health for a few seconds when viewing the cluster from the envoy admin UI. The nodes show as healthy in the consul UI during time this is happening. This started happening after upgrading to Consul 1.10. Has anyone ever seen this or have any suggestions?
    2 replies
    Chris Johnson
    @chrisjohnson
    @blake in your demo of using transparent proxies, you were JUST about to start typing a curl command so I could finally understand how they decide the service to route to, but then you got sidetracked chasing down problems in the demo hahaha
    Demo of using transparent proxies on VMs, not k8s, that is
    Anyway, it's still unclear to me. What does an application have to be configured to use as the DNS name when making the request? Should the application use http or https? And does the port need to be something specific?
    2 replies
    Right now I'm in the middle of reconfiguring my tooling to produce a local IP and whatever the upstream port is for that service. Using transparent proxies, would it be using the consul DNS name? And would that be the <svc>.service.consul form or <svc>.ingress.consul form?
    J. Gavin Ray
    @jgavinray
    Hello all!
    krishnaprateek6
    @krishnaprateek6
    Hi all, qq? failed to setup alloc: pre-run hook "network" failed: failed to create network for alloc: Failed to pull gcr.io/google_containers/pause-amd64:3.1: API error (500): Get https://gcr.io/v2/: net/http: TLS handshake timeout we are seeing this when we start a nomad job even though we have pause-amd64 image loaded locally but since one of our env's has strictly no internet access to outside world is there a way in nomad that you can force it to not look into google container registry?
    1 reply
    linuxbsdfreak
    @linuxbsdfreak

    Hi . I installed consul on K8s with the following command

    helm -n consul-server install --create-namespace -g hashicorp/consul -f consul-values.yaml

    cat consul-values.yaml                                                                                                                   ✔  10:52:28 
    ---
    
    global:
      enabled: true
      name: consul
      acls:
        manageSystemACLs: true
      metrics:
        enabled: true
        enableAgentMetrics: true
      image: "hashicorp/consul:1.10.3"
      imageK8S: "hashicorp/consul-k8s-control-plane:0.36.0"
    
    prometheus:
      enabled: true
    
    server:
      replicas: 1
    
    client:
      enabled: true
    
    connectInject:
      enabled: false
      transparentProxy:
        defaultEnabled: false
    
    ui:
      enabled: true
      service:
        type: LoadBalancer
    
    controller:
      enabled: true

    I opened the Ingress endpoint. However where do i find the token to login to save data under the KV? i always get 403 since i am not logged in

    1 reply
    Yann Huissoud
    @aiqency
    From a golang perspective what's the benefit of using hcl:"foo" instead of json:"foo"?
    Yann Huissoud
    @aiqency
    basically we are writing our own library and was wondering what is the benefit of using hcl?
    1 reply
    Narendra Patel
    @narendrapatel
    What is the standard way to override envoy configs via envoy_public_listener_json and envoy_listener_json in kubernetes. On VM able to override via sidecar_service block.
    Also how to access envoy config dump from the envoy sidecar in kubernetes
    Ravindra Verma
    @Ravindraverma1
    @Ravindraverma1
    Hi experts, I need some help in consul-nomad cluster setup, I have installed the consul cluster on azure Vm's , but its not coming up as a cluster getting error :
    Nov 15 06:37:26 nomad-consul-vm1 consul[29364]: 2021-11-15T06:37:26.941Z [ERROR] agent.anti_entropy: failed to sync remote state: error="No cluster leader"
    9:40
    Nov 15 06:36:18 nomad-consul-vm2 consul[382]: 2021-11-15T06:36:18.676Z [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.0.138.69:3929
    Yoan Blanc
    @greut
    check the encrypt config.
    Ravindra Verma
    @Ravindraverma1
    could you provide a reference , so i can match my file
    @greut
    Ravindra Verma
    @Ravindraverma1
    I have installed the consul cluster on azure Vms 3nodes, can anyone suggest how to set up DNS for this? shall I use internal LB or any other method which I can use? Please guide
    Shantanu Gadgil
    @shantanugadgil
    Hi @Ravindraverma1 what have you tried so far? Can you post your config files with secrets redacted? What you are asking are too much of open ended questions. I assume by DNS you mean services looking up each other by name? Or some thing else?
    GOEDP
    @GOEDP

    Hello all! Maybe someone can point me in the right direction.
    I am in the process of finalizing a Proof of Concept using Nomad and Consul.
    My remaining issue is with Consul Federation.

    I currently have 2 separate Nomad Clusters, and 2 separate Consul clusters
    I have federates the Consul clusters, and when I use "consul members -wan" I can evidently see that all required Consul server nodes are listed across data centres.

    I have deployed a nomad job (docker http-echo) named "webserver". I have deployed 1 instance of this on Nomad dc1 and Nomad dc2, and registered it to Consul using the following stanza:
    service {
    name = "webserver"
    tags = ["webserver"]
    port = "http"
    meta {
    meta = "Consul Connect Test"
    }
    }

    I used the same service stanza when deploying my job to both Nomad clusters, however, when I login to the Consul UI, dc1 Consul is showing 1 instance of webserver, whilst dc2 Consul is showing another instance of webserver.

    Is there anyway that Consul would be aware that these are in fact yet another replica to the same deployment?

    The idea is to use 1 single source of truth from Consul to integrate with a Load Balancer with AS3.

    5 replies
    I can also select between the different Consul DCs in the web UI - further indicating that federation should be OK
    tirelibirefe
    @tirelibirefe
    hello all, I have installed consul in Kubernetes Token page says "you are not authorized 403" how can I fix that problem?
    image.png
    1 reply
    André Ilhicas
    @Ilhicas

    Hi folks, I'm trying to implement a "hackfix" solution to use consul transparent proxy within nomad, and I'm able to correctly register the connect evoy sidecar proxy and have healthchecks ok etc
    However, I'm trying to curl another connect enabled service and I'm always greeted by the Empty Reply from server, despite having the clusters registered within envoy /clusters endpoint meaning that the outbound traffic grabbed by the proxy A is not correctly using mtls to communicate with the service B

    Anyone tried something similar or faced a similar issue?

    (moving same message I pasted in nomad group)

    1 reply
    parmsib
    @parmsib:matrix.org
    [m]
    Hello!
    Is it expected behavior for a consul agent to return a 500 Internal Server Error response code when trying to deregister a service that is not registered in the agent, through an HTTP API call to /v1/agent/service/deregister/:service-id?
    I'd expect maybe a 400 Bad Request ("can't deregister something that's not registered") or even a 200 Ok ("already deregistered, nothing to do "(idempotency-like)), but 500 is a bit strange.
    4 replies