Consul Associate key terms

The long-running Consul daemon installed on every node in a datacenter. It can run in client mode or server mode, maintains local service and check data, and exposes the HTTP, DNS, and gRPC interfaces.

An agent that stores cluster state, participates in the Raft consensus group, and answers catalog and query requests. Datacenters typically run three or five servers to tolerate failures without losing quorum.

A lightweight agent that registers local services and health checks, answers DNS queries, and forwards RPC calls to the servers. Client agents do not store cluster state or take part in Raft.

A logical grouping of agents that share low-latency networking and one set of servers. Each datacenter keeps its own catalog, and servers across datacenters federate over the WAN gossip pool.

A Serf-based, eventually consistent protocol used for cluster membership and failure detection. Consul runs a LAN pool in each datacenter and a WAN pool shared by servers across datacenters.

The embedded gossip library Consul uses for membership, failure detection, user events, and keyring management. Its state is separate from Raft, so a member can appear healthy in gossip while Raft is still catching up.

The consensus algorithm Consul servers use to replicate a shared state machine. Writes go through a leader, are appended to a log, and are committed once a quorum of servers acknowledges them.

The single server elected by the Raft group to accept writes and replicate log entries to followers. If it becomes unreachable, the remaining servers elect a replacement as long as quorum exists.

The strict majority of voting servers, calculated as half the cluster size plus one, needed to elect a leader and commit writes. Losing quorum makes the cluster read-only until enough servers return.

A periodic reconciliation in which a client agent re-sends its locally registered services and checks to the servers, repairing drift such as a catalog entry deleted on the server side.

A server configuration setting that tells an agent how many servers should eventually join the cluster. The server waits for that many peers before electing a leader, avoiding split-brain during initial startup.

A configuration option listing addresses or auto-join strings the agent keeps retrying until it successfully joins a cluster. It is preferred over one-time join commands because it survives restarts and boot ordering issues.

A feature that lets an agent discover peer addresses automatically by querying a cloud provider API, using a go-discover string that includes the provider, tag filters, and credentials.

A folder passed with -config-dir from which the agent loads every .hcl or .json file at startup. Files are merged together, with later-sorted files overriding earlier values.

A configuration block describing one service instance: its name, unique ID, address, port, tags, metadata, health checks, and optional Connect settings. It is submitted through the agent or the catalog API.

A test attached to a node or service that reports passing, warning, or critical status. Unhealthy instances are filtered out of DNS and healthy-only API results, so failing services stop receiving traffic.

A check whose state is reported by the application itself, calling an HTTP endpoint to mark itself passing, warning, or critical. If the application does not report within the timeout, the check goes critical.

The registry of nodes, services, and checks that servers maintain and replicate through Raft. It is read and written through the HTTP API and is the source of truth behind DNS lookups.

A built-in DNS server on port 8600 that answers lookups such as web.service.us-east.consul, returning only instances whose checks pass. SRV records include the port, and TAG. filters by service tag.

A stored service lookup with optional failover, tag filtering, and geo-aware sorting that can be executed through the HTTP API or DNS. It lets clients resolve a stable name while Consul applies routing logic server-side.

A simple hierarchical store for arbitrary data, addressed by slash-separated keys and replicated across servers. It is accessed through HTTP or CLI commands such as consul kv put and consul kv get.

A conditional write in which the client supplies the ModifyIndex it expects to find. The write succeeds only if the stored index matches, allowing safe concurrent updates without a lock.

A server-side object bound to a node and its health checks that can hold locks on key/value pairs. If the node or checks fail, the session is invalidated and its held keys are released automatically.

A named set of rules granting read, write, or deny access to resources such as services, nodes, key/value prefixes, and operator endpoints. Policies are attached to tokens either directly or through roles.

A secret string presented on requests to identify the caller and carry its policies. Tokens are configured in the agent for CLI, DNS, and API use, and can also carry service identities for mesh workloads.

A named collection of ACL policies, plus optional service identities and node identities, that can be assigned to many tokens at once. Roles simplify granting the same permissions to a group of workloads.

The built-in token used for requests that supply no credentials. Its policies determine default access, so locking down a cluster usually means giving it no permissions beyond what unauthenticated clients genuinely need.

A symmetric key that encrypts gossip traffic between agents, installed on servers and rotated with the consul keyring commands. It protects membership data but does not encrypt RPC or service traffic.

A feature in which client agents obtain and rotate TLS certificates automatically from the servers over an authenticated channel, instead of having certificates distributed manually to every node.

An authorization rule that allows or denies connections between a source and a destination service, evaluated when the connection is established. Intentions can match on service name, and with L7 features on paths or methods.

A proxy process deployed alongside each service instance that handles inbound and outbound mesh traffic, terminating mutual TLS and enforcing intentions. Envoy is the default implementation used by Consul.

An application that integrates with the Connect API directly to establish mutually authenticated connections itself, without needing a sidecar proxy. It suits services where adding another process is undesirable.

A gateway that lets clients outside the mesh reach services inside it, listening on configured ports and forwarding traffic to mesh destinations with mutual TLS and intention checks applied.

A gateway that lets services inside the mesh reach external destinations that are not Consul services, such as a managed database, while keeping traffic policy and identity within the mesh.

A gateway that proxies service-to-service traffic between datacenters and, in some networking setups, is required for federation and for reaching services in remote datacenters.

A point-in-time archive of Consul server state including key/value data, the catalog, ACLs, and prepared queries. It is created with consul snapshot save and restored with consul snapshot restore.

A cluster-management subsystem that tracks server health, removes failed servers, promotes eligible non-voters, and coordinates rolling upgrades so the Raft quorum is not lost during maintenance.

A manual procedure for a cluster that has lost quorum: stop all servers, write a peers.json listing the surviving servers, and restart so Raft rebuilds a working configuration and elects a leader.