Consul Basic Setup

Базовая настройка Hashicorp Consul

• Для использования в качестве бекенда для Hashicorp Vault)
• Очень базовая однонодовая конфигурация

Установка

curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
sudo apt-get update && sudo apt-get install consul

Базовая настройка

Unit немного исправлен

# systemctl  cat consul.service

[Unit]
Description="HashiCorp Consul - A service mesh solution"
Documentation=https://www.consul.io/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/consul.d/consul-server.json

[Service]
EnvironmentFile=-/etc/consul.d/consul.env
User=consul
Group=consul
ExecStart=/usr/bin/consul agent -config-dir=/etc/consul.d/
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGTERM
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Конфигурационные файлы

consul-server.json

cat /etc/consul.d/consul-server.json

{
    "node_name": "consul",
    "disable_remote_exec": true,
    "disable_update_check": true,
    "leave_on_terminate": false,
    "enable_script_checks": true,
    "data_dir": "/opt/consul",
    "server": true,
    "performance": {
        "raft_multiplier": 1
    },
    "ports": {
        "dns": 8600,
        "http": 8500,
        "https": -1,
        "server": 8300
    },
    "log_level": "DEBUG",
    "ui_config": {
        "enabled": true
    }
}

/etc/consul.d/agent-network.json

cat /etc/consul.d/agent-network.json

{
    "advertise_addr": "10.14.15.201",
    "bind_addr": "0.0.0.0",
    "client_addr": "0.0.0.0",
    "bootstrap_expect": 1,
    "datacenter": "kilda-fred"
}

/etc/consul.d/agent-security.json

• Мастер токен - для примера ("333293a8-de42-11eb-bb8c-fffb98445924")
• По сути это просто "секретная строка"
• uuidgen

cat /etc/consul.d/agent-security.json

{
    "primary_datacenter": "kilda-fred",
    "acl": {
        "enabled": true,
        "default_policy": "deny",
        "tokens": {
            "master": "333293a8-de42-11eb-bb8c-fffb98445924"
        }
    },
    "encrypt": "dNEwk144P3GugO3fhEIAKl4gjyS8gLpggM41lmm+zug=",
    "acl_enforce_version_8": true,
    "raft_protocol": 3
}