Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
    Blake Covarrubias
    @blake
    I was mobile earlier and was having some trouble replying from my phone. I tried to send a few messages, but it looks like they didn't go through.
    Michael Aldridge
    @the-maldridge
    the gitter/matrix ecosystem has been a little wobbly today, probably a little bit of both
    Blake Covarrubias
    @blake
    I'll discuss this PR with our team tomorrow, and will ask that someone follow up on the GitHub issue.
    lokesp11
    @lokesp11

    Does consul support CA Signed certificate for tls communication and can it be integrated with vault to get certificate from vault pki? We are exploring option to use VAULT PKI Infrastructure and trying to implement consul tls communication with certificate generated by vault pki instead of inbuild consul CA?

    Please suggest or help in pointing me to similar use case if exist?

    Thanks in advance

    1 reply
    Ross Has No Clever Friends
    @rosshasnocleve1_twitter
    Thanks Blake!
    Yann Huissoud
    @aiqency
    Any updates on hashicorp/consul#8687. Can we access the specific key modified through consul watch keyprefix as of now?
    2 replies
    Narendra Patel
    @narendrapatel
    Hi, has anyone tried the Escape-Hatch Overrides option? Need to configure envoy access logging. Able to configure it directly on envoy but struggling to set it via Consul. Also how are envoy cluster names formed? I see consul configuring something like api.default.dc1.internal.af617b02-1e21-52c2-d297-36b92be86af9.consul. Not sure what does this hexadecimal string signifies.
    5 replies
    John Spencer
    @johnnyplaydrums
    Noob question about service to service communication when services are using random, dynamically allocated ports (like in a Consul/Nomad cluster). If the port is know ahead of time, e.g. port 80, serviceA can talk to serviceB using the dns record serviceB.service.consul:80. But if the port is dynamically allocated, how does serviceA communicate with serviceB? It could find the port via dig SRV or consul API, but that's additional application code and overhead. Is there a better way?
    Yoan Blanc
    @greut
    @johnnyplaydrums you need some kind of load balancer, e.g. https://www.consul.io/docs/connect
    2 replies
    Sam Lee
    @D2Engine_twitter
    hi, i'd like to access consul ui by ingress subpath.
    deployed "hashicorp/consul:1.10.3" helm chart and tried this additional extraConfig. But it's redirected to "/" path . Is there anything i missed ?
      extraConfig: |
        {
          "ui_config": {
            "content_path": "/sandbox/consul"
          }
        }
    1 reply
    Ross Rochford
    @RossRochford_twitter

    @johnnyplaydrums I suspect a lot of people end up using consul upstreams (sidecars) in Nomad simply for the convenience of it. In this scenario Nomad gives your tasks a single addr/port to communicate through.

    It would be nice to have a similarly convenient setup but with the option of bypassing the security features (encryption, intentions) of consul connect. i.e. just the load balancing and service discovery pieces.

    1 reply
    Andreas Anderssson
    @dinapappor
    I am having a problem where consul isn't being updated fast enough with pods in kubernetes.
    Not sure how to solve that problem.
    We have consul-write-interval set to 1s.
    Yet, our loadbalancer (traefik) is still trying to send traffic to old pods.
    I am not sure if it's because
    1) We don't execute healthchecks from consul to kubernetes pods.
    2) The data in consul is stale.
    How have other people solved this problem?
    Narendra Patel
    @narendrapatel
    Hi, is it possible to set mTLS for ingress-gateways? We want to set inbound mTLS to the mesh for one of our services. Not able to find options for the same. Saw an option for mTLS with https://www.hashicorp.com/blog/proxy-ingress-to-consul-service-mesh but it involves too many moving parts. Preference is for Ingress Gateway with envoy proxy.
    4 replies
    Alex Oskotsky
    @aoskotsky-amplify
    I'm seeing a weird issue where every 10 minutes envoy logs a line this this add 3 cluster(s), remove 2 cluster(s). During that time I'll also see /failed_eds_health for a few seconds when viewing the cluster from the envoy admin UI. The nodes show as healthy in the consul UI during time this is happening. This started happening after upgrading to Consul 1.10. Has anyone ever seen this or have any suggestions?
    2 replies
    Chris Johnson
    @chrisjohnson
    @blake in your demo of using transparent proxies, you were JUST about to start typing a curl command so I could finally understand how they decide the service to route to, but then you got sidetracked chasing down problems in the demo hahaha
    Demo of using transparent proxies on VMs, not k8s, that is
    Anyway, it's still unclear to me. What does an application have to be configured to use as the DNS name when making the request? Should the application use http or https? And does the port need to be something specific?
    2 replies
    Right now I'm in the middle of reconfiguring my tooling to produce a local IP and whatever the upstream port is for that service. Using transparent proxies, would it be using the consul DNS name? And would that be the <svc>.service.consul form or <svc>.ingress.consul form?
    J. Gavin Ray
    @jgavinray
    Hello all!
    krishnaprateek6
    @krishnaprateek6
    Hi all, qq? failed to setup alloc: pre-run hook "network" failed: failed to create network for alloc: Failed to pull gcr.io/google_containers/pause-amd64:3.1: API error (500): Get https://gcr.io/v2/: net/http: TLS handshake timeout we are seeing this when we start a nomad job even though we have pause-amd64 image loaded locally but since one of our env's has strictly no internet access to outside world is there a way in nomad that you can force it to not look into google container registry?
    1 reply
    linuxbsdfreak
    @linuxbsdfreak

    Hi . I installed consul on K8s with the following command

    helm -n consul-server install --create-namespace -g hashicorp/consul -f consul-values.yaml

    cat consul-values.yaml                                                                                                                   ✔  10:52:28 
    ---
    
    global:
      enabled: true
      name: consul
      acls:
        manageSystemACLs: true
      metrics:
        enabled: true
        enableAgentMetrics: true
      image: "hashicorp/consul:1.10.3"
      imageK8S: "hashicorp/consul-k8s-control-plane:0.36.0"
    
    prometheus:
      enabled: true
    
    server:
      replicas: 1
    
    client:
      enabled: true
    
    connectInject:
      enabled: false
      transparentProxy:
        defaultEnabled: false
    
    ui:
      enabled: true
      service:
        type: LoadBalancer
    
    controller:
      enabled: true

    I opened the Ingress endpoint. However where do i find the token to login to save data under the KV? i always get 403 since i am not logged in

    1 reply
    Yann Huissoud
    @aiqency
    From a golang perspective what's the benefit of using hcl:"foo" instead of json:"foo"?
    Yann Huissoud
    @aiqency
    basically we are writing our own library and was wondering what is the benefit of using hcl?
    1 reply
    Narendra Patel
    @narendrapatel
    What is the standard way to override envoy configs via envoy_public_listener_json and envoy_listener_json in kubernetes. On VM able to override via sidecar_service block.
    Also how to access envoy config dump from the envoy sidecar in kubernetes
    Ravindra Verma
    @Ravindraverma1
    @Ravindraverma1
    Hi experts, I need some help in consul-nomad cluster setup, I have installed the consul cluster on azure Vm's , but its not coming up as a cluster getting error :
    Nov 15 06:37:26 nomad-consul-vm1 consul[29364]: 2021-11-15T06:37:26.941Z [ERROR] agent.anti_entropy: failed to sync remote state: error="No cluster leader"
    9:40
    Nov 15 06:36:18 nomad-consul-vm2 consul[382]: 2021-11-15T06:36:18.676Z [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.0.138.69:3929
    Yoan Blanc
    @greut
    check the encrypt config.
    Ravindra Verma
    @Ravindraverma1
    could you provide a reference , so i can match my file
    @greut
    Ravindra Verma
    @Ravindraverma1
    I have installed the consul cluster on azure Vms 3nodes, can anyone suggest how to set up DNS for this? shall I use internal LB or any other method which I can use? Please guide
    Shantanu Gadgil
    @shantanugadgil
    Hi @Ravindraverma1 what have you tried so far? Can you post your config files with secrets redacted? What you are asking are too much of open ended questions. I assume by DNS you mean services looking up each other by name? Or some thing else?
    GOEDP
    @GOEDP

    Hello all! Maybe someone can point me in the right direction.
    I am in the process of finalizing a Proof of Concept using Nomad and Consul.
    My remaining issue is with Consul Federation.

    I currently have 2 separate Nomad Clusters, and 2 separate Consul clusters
    I have federates the Consul clusters, and when I use "consul members -wan" I can evidently see that all required Consul server nodes are listed across data centres.

    I have deployed a nomad job (docker http-echo) named "webserver". I have deployed 1 instance of this on Nomad dc1 and Nomad dc2, and registered it to Consul using the following stanza:
    service {
    name = "webserver"
    tags = ["webserver"]
    port = "http"
    meta {
    meta = "Consul Connect Test"
    }
    }

    I used the same service stanza when deploying my job to both Nomad clusters, however, when I login to the Consul UI, dc1 Consul is showing 1 instance of webserver, whilst dc2 Consul is showing another instance of webserver.

    Is there anyway that Consul would be aware that these are in fact yet another replica to the same deployment?

    The idea is to use 1 single source of truth from Consul to integrate with a Load Balancer with AS3.

    5 replies
    I can also select between the different Consul DCs in the web UI - further indicating that federation should be OK
    tirelibirefe
    @tirelibirefe
    hello all, I have installed consul in Kubernetes Token page says "you are not authorized 403" how can I fix that problem?
    image.png
    1 reply
    André Ilhicas
    @Ilhicas

    Hi folks, I'm trying to implement a "hackfix" solution to use consul transparent proxy within nomad, and I'm able to correctly register the connect evoy sidecar proxy and have healthchecks ok etc
    However, I'm trying to curl another connect enabled service and I'm always greeted by the Empty Reply from server, despite having the clusters registered within envoy /clusters endpoint meaning that the outbound traffic grabbed by the proxy A is not correctly using mtls to communicate with the service B

    Anyone tried something similar or faced a similar issue?

    (moving same message I pasted in nomad group)

    1 reply
    parmsib
    @parmsib:matrix.org
    [m]
    Hello!
    Is it expected behavior for a consul agent to return a 500 Internal Server Error response code when trying to deregister a service that is not registered in the agent, through an HTTP API call to /v1/agent/service/deregister/:service-id?
    I'd expect maybe a 400 Bad Request ("can't deregister something that's not registered") or even a 200 Ok ("already deregistered, nothing to do "(idempotency-like)), but 500 is a bit strange.
    4 replies
    inouthack
    @inouthack
    Hi

    export GOPATH=/opt/gows

    git clone'd consul; make tools

    make dev throws the following error

    $ make dev
    ==> Building Consul - OSes: linux, Architectures: amd64
    Building sequentially with go install
    ---> linux/amd64
    cp: cannot stat '/opt/gows/bin/consul': No such file or directory
    ERROR: Failed to build Consul for linux/amd64
    make: * [GNUmakefile:150: dev-build] Error 1

    anyone knows why is this failing ?

    1 reply
    Ravindra Verma
    @Ravindraverma1
    Hi experts, i have created infra on azure and installed nomad and consul cluster there . could you please confirm to setup consul DNS on clients, i followed few steps but its not working out . can anyone suggest a good way to setup this
    1 reply
    Owen Byrne
    @byrneo

    hey folks - i'm beginning to use consul-connect on kubernetes. I want to set forward_client_cert_details: ALWAYS_FORWARD_ONLY as a default in the public and outbound envoy listeners . I'm struggling to find a straightforward way to do this. Would the only option be to use escape hatches: https://www.consul.io/docs/connect/proxies/envoy#envoy_public_listener_json and https://www.consul.io/docs/connect/proxies/envoy#envoy_listener_json ?

    If i were to use the escape hatch approach, would I need to wire it up with things such as the IP address and port number which would otherwise be dynamically configured e.g.:

    dynamic_listeners": [
            {
              "name": "public_listener:100.96.140.127:20000",
              "active_state": {
                "version_info": "509d3db3174c07668c164b6772525adbb945e5fcbacaeddacf9364512e06d91b",
                "listener": {
                  "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
                  "name": "public_listener:100.96.140.127:20000",
                  "address": {
                    "socket_address": {
                      "address": "100.96.140.127",
                      "port_value": 20000
                    }
                  },

    Any alternative methods to solve this? Could it be configured via bootstrap somehow?

    2 replies
    johnny101
    @johnny101:matrix.org
    [m]
    Hello, I'm looking at using maglev load balancing algorithm to a connect service for consistent load balance hashing. Ideally, I'd like this connect service to act as a active/hot-standby cluster, so that n instances are available, but only 1 is routed to at any given time as long as it stays healthy. I can do this with with maglev load balancing using an HTTP header that is constant -- then all requests are routed to that instance. For this, the requesting app must ensure the appropriate static HTTP header is added.
    I see that in consul 1.11.0-beta3 HTTPHeaderModifiers for request and response headers has been added, which is a great feature. Ideally, I'd like to configure the static header that maglev would consume for consistent hashing in a service-resolver config kind by setting up a "RequestHeader" "Set" to inject that static header in a service-router config kind.