Consul Associate study guide
Consul Associate · Work through your exam, one topic at a time.
HashiCorp Certified: Consul Associate (003) is a professional credential that validates your ability to deploy, configure, and operate Consul as a service networking platform. It is aimed at platform engineers, site reliability engineers, DevOps practitioners, and cloud infrastructure specialists who already work with distributed systems and want to demonstrate practical command of Consul rather than passive familiarity with its documentation. The Consul Associate study guide has 7 sections and about 2,381 words.
01Consul Architecture and Core Concepts
Consul is one binary that runs as an agent in either client or server mode, and every node in a datacenter runs an agent. Client agents are the data-plane edge: they hold local service registrations, run health checks, expose the HTTP (8500), DNS (8600) and gRPC (8502) interfaces for that node, and forward all reads and writes to servers over RPC.
323 words, about 2 min02Deploying a Consul Datacenter
A server config sets server = true , a unique node name , a persistent data dir , and bootstrap expect = 3 (or 5). bootstrap expect tells the first servers how many peers to wait for before electing a leader; it is a cluster-formation hint, not a security setting, and it must be the same on every server.
332 words, about 2 min03Service Registration, Health Checks, and Service Discovery
Services are declared in JSON/HCL service definition files in the config directory, via the HTTP API, or with consul services register . Each service has a name , an optional id (defaults to the name, and must be unique per node), address , port , tags , meta , and one or more check blocks.
336 words, about 2 min04Key/Value Store
The KV store is a hierarchical map of string keys to byte values, held in Raft on servers. Keys are flat strings that merely look like paths ( config/app/db.json ); there are no real directories, but prefix queries ( ?recurse ) let you read a subtree.
332 words, about 2 min05Security: ACLs, Gossip Encryption, and TLS
Consul security is three separable mechanisms and questions love to blur them. Gossip encryption (AES-256, generated with consul keygen ) protects Serf traffic on 8301/8302 and must be identical on every agent in a datacenter; rotate with consul keyring .
346 words, about 2 min06Service Mesh (Consul Connect)
Connect gives every service an identity (its service name plus a SPIFFE-style certificate) and a sidecar proxy - Envoy, launched with consul connect envoy -sidecar-for <service-id and registered via a connect { sidecar service {} } block. Traffic flows application → local sidecar → remote sidecar → application; mTLS is automatic and certificates rotate without operator effort.
346 words, about 2 min07Operations and Maintenance
consul snapshot save backup.snap captures the Raft state - catalog, KV, ACLs, intentions, config entries - from a server. Restore with consul snapshot restore backup.snap pointed at a server's HTTP API.
366 words, about 2 min