Consul Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Raft quorum size

For N servers the quorum is (N/2)+1, so a 3-server cluster tolerates one failure, a 5-server cluster tolerates two, and a 2-server cluster tolerates none.

Consul client agent

A lightweight agent on every node that registers local services and checks, joins LAN gossip, caches catalog data, and forwards RPCs to servers without holding Raft state.

Consul server agent

An agent that participates in the Raft quorum, stores catalog and KV state, processes writes, and answers consistent reads; production deployments run three or five servers.

LAN versus WAN gossip

LAN gossip on port 8301 handles membership inside one datacenter, while WAN gossip on port 8302 links servers of different datacenters so cross-datacenter requests can be forwarded.

Stale read consistency

A read answered by any server without contacting the leader; it is fast and highly available but may return data older than the leader's current committed state.

bootstrap_expect setting

A server option declaring how many servers form the initial cluster; every bootstrap server must use the same value, usually 3 or 5, and bootstrap completes automatically when that many join.

retry_join

An agent option listing server addresses, DNS names, or cloud auto-join strings that the agent keeps retrying until it joins, which keeps membership stable across restarts and rolling boots.

consul keygen

A CLI command that generates a base64-encoded 32-byte symmetric key for the encrypt option; every agent sharing a gossip pool must use the identical key.

Server data_dir

The filesystem path where a server persists Raft logs and snapshots and where the agent stores local state; it must be writable, persistent, and never shared between agents.

Adding a server to cluster

Install the agent with server = true and the same encrypt key, join the LAN pool via retry_join, then wait for Autopilot to promote the non-voter after it catches up on the Raft log.

TTL health check

A check that stays passing only while the service periodically calls /v1/agent/check/pass/<check_id>; missing the TTL deadline marks the check critical and drops the instance from DNS.

Service DNS record format

Queries use <service>.service.<dc>.consul for A or SRV records, and prefixing a tag such as <tag>.<service>.service.consul returns only instances carrying that tag.

Prepared query

A named query stored in the catalog and executed via DNS or HTTP that supports tag filters, near=_agent sorting, and automatic failover to remote datacenters.

Health check statuses

Consul reports passing, warning, or critical for each check; DNS lookups and API calls using the ?passing filter return only instances whose checks are passing.

Anti-entropy sync

A periodic agent process that reconciles services and checks registered locally with the catalog on the servers, repairing drift caused by outages or failed RPCs.

Check-and-set KV write

A PUT with ?cas=<ModifyIndex> that succeeds only when the stored entry's index matches; ?cas=0 creates the key only if it is absent, and a mismatch returns HTTP 409.

KV blocking query

A read that passes ?index=<X-Consul-Index> and ?wait=<duration>; the server holds the request until the data changes or the wait expires, with a maximum of ten minutes.

KV session lock

A session created with a TTL and behavior release or delete; a key is locked by writing it with ?acquire=<session-id> and is released automatically when the session expires.

KV value size limit

Each key may hold a value of at most 512 KB, because KV entries are stored in Raft state and replicated to every server in the datacenter.

ACL default policy

When ACLs are enabled the default policy is deny, meaning requests without a token granting access are rejected unless acl_default_policy is explicitly set to allow.

Management token

An ACL token with unrestricted access to every resource; it is created by consul acl bootstrap or by an existing management token and bypasses normal policy evaluation.

Gossip key rotation

Install a new key with consul keyring -install, switch agents to it with -use, then remove the old key with -remove; every agent in the pool must converge on the same key.

verify_server_hostname

When set true, agents verify the presented certificate contains server.<datacenter>.consul, which prevents man-in-the-middle attacks against RPC and HTTPS connections.

ACL token passing methods

Tokens are supplied through the X-Consul-Token HTTP header, the token query parameter, or the CONSUL_HTTP_TOKEN environment variable used by the Consul CLI.

Connect intention default

When no intention matches a source and destination pair, the connection is denied; explicit allow intentions are required for service-to-service traffic through the mesh.

Sidecar proxy registration

Consul registers the proxy as <service>-sidecar with kind connect-proxy; each sidecar handles inbound and outbound mutual TLS for exactly one service instance.

Mesh gateway

A Connect gateway that proxies mesh traffic between datacenters or network segments, letting services communicate when no direct network path exists between them.

Connect certificate authority

Consul's built-in CA or an external Vault provider issues short-lived certificates to each proxy, and leaf certificates are rotated automatically before expiry to maintain mutual TLS.

consul snapshot save

Writes a Raft snapshot file containing the KV store, catalog, ACLs, sessions, prepared queries, and intentions; the matching consul snapshot restore recreates that state in the datacenter.

cleanup_dead_servers

An Autopilot setting that removes servers unreachable for longer than last_contact_threshold once doing so will not jeopardize quorum stability.

raft list-peers command

consul operator raft list-peers shows each server's ID, address, state, voter status, and Raft protocol version, which is used to confirm quorum during upgrades.

Leader status endpoint

GET /v1/status/leader returns the current Raft leader address, or an empty string when no leader is elected; /v1/status/peers returns the list of known server peers.