I85PREP
⌘ K
Consul Associate study materials
Consul Associate study resources

Consul Associate study plan

Consul Associate · Give each week a clear focus.

8 weeks · About 7 hours per week

Week 1

Consul Architecture and Core Concepts

  • Diagram the full path of a service lookup, labeling where the client agent, server, catalog, and DNS layer each participate

  • Distinguish the gossip (Serf) layer from the Raft consensus layer by listing which data each carries and which one stores the catalog

  • Calculate failure tolerance for 1-, 3-, and 5-server clusters and state the quorum size for each

  • Memorize the default ports 8300, 8301, 8302, 8500, 8501, 8502, 8600 and mark each as TCP, UDP, or both

  • Explain how a datacenter maps to a single Consul cluster and how WAN gossip federates multiple datacenters

Your checkpoint

A one-page hand-drawn architecture diagram plus a 20-question self-quiz you write and score at 16/20 or better

Week 2

Consul Architecture and Core Concepts & Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

  • Write agent configuration files for 3 servers and 2 clients specifying bind_addr, advertise_addr, data_dir, and retry_join

  • Bootstrap a 3-server cluster with bootstrap_expect and confirm a single leader using consul operator raft list-peers

  • Join clients with retry_join and demonstrate automatic rejoin by restarting a client agent and observing it return to consul members

  • Verify LAN and WAN gossip membership separately using consul members and consul members -wan

  • Inspect cluster state with consul info and identify the leader, protocol versions, and serf health of each node

Your checkpoint

A running 3-server plus 2-client datacenter from config files checked into a repo, with the consul members output captured as proof

Week 3

Service Registration, Health Checks, and Service Discovery (catalog, DNS interface, prepared queries)

  • Register the same service three ways: agent config file, HTTP API PUT to /v1/agent/service/register, and the consul services register CLI, then confirm all appear in the catalog

  • Define and test HTTP, TCP, TTL, and script health checks and observe a service transition from passing to critical in the UI and in /v1/health/service/

  • Issue DNS queries for name.service.consul, tagged services, and SRV records, and state which record type returns port and priority data

  • Enable and use the DNS interface settings for a custom domain and confirm resolution from a client node

  • Deregister a service and verify it disappears from both the catalog and DNS answers

Your checkpoint

A lab notes file documenting each registration method and check type with the exact commands and observed output

Week 4

Service Registration, Health Checks, and Service Discovery (catalog, DNS interface, prepared queries)

  • Create a prepared query that fails over to a secondary datacenter or service subset and resolve it via the query.consul DNS namespace

  • Use the near=_agent parameter and compare result ordering with and without it

  • Consume the catalog endpoints (/v1/catalog/services, /v1/catalog/service/, /v1/health/checks/) and explain the difference between catalog and health responses

  • Implement a blocking query using the X-Consul-Index header and demonstrate that it returns only on change

  • Compare service discovery via DNS versus the HTTP API and list two cases where each is preferable

Your checkpoint

A script that registers two services, queries them through a prepared query and a blocking API call, and prints results - runnable end to end

Week 5

Security: ACLs, Gossip Encryption, and TLS

  • Bootstrap the ACL system and create policies, roles, and tokens for node, service, and operator personas

  • Apply a default-deny policy and prove that an unprivileged token is rejected while the bootstrap token succeeds

  • Generate a gossip encryption key with consul keygen and enable it across all agents, verifying an unencrypted node cannot join

  • Enable TLS for HTTP and server RPC including verify_server_hostname, and diagnose at least two common certificate errors

  • Map each ACL token in your cluster to its intended use in a written token matrix

Your checkpoint

A cluster secured with ACLs, gossip encryption, and TLS, plus a token matrix and captured evidence of one allowed and one denied request

Week 6

Service Mesh (Consul Connect: intentions, sidecar proxies, gateways)

  • Register two services with sidecar proxies and confirm each proxy is healthy in the catalog

  • Set the default intention to deny and demonstrate that traffic between the services is blocked, then allow it with an explicit source-to-destination intention

  • Verify mTLS is in use by inspecting proxy configuration and checking certificate details on the listener

  • Distinguish connect-native services from sidecar-proxy services and name one tradeoff of each

  • Describe when a mesh gateway is required versus a terminating gateway, and sketch the traffic path for each

Your checkpoint

A working two-service mesh under default-deny with logs or curl output showing both the blocked and permitted requests

Week 7

Key/Value Store & Operations and Maintenance (snapshots/restore, upgrades, monitoring, Autopilot)

  • Perform KV put, get, delete, and recurse operations via CLI and HTTP and explain how the KV path maps to ACL policies

  • Use check-and-set with the ModifyIndex to safely update a key and show that a stale index write is rejected

  • Take a snapshot with consul snapshot save, restore it into a fresh cluster, and confirm the catalog and KV data match

  • Outline and follow a rolling upgrade order across servers and clients, including the check that Raft protocol versions are compatible before upgrading

  • Configure Autopilot settings and identify the health, leader, and Raft metrics you would alert on

Your checkpoint

A restore drill write-up with before/after key counts and service counts, plus a written one-page upgrade runbook

Week 8

Consul Architecture and Core Concepts & Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap) & Service Registration, Health Checks, and Service Discovery (catalog, DNS interface, prepared queries) & Key/Value Store & Security: ACLs, Gossip Encryption, and TLS & Service Mesh (Consul Connect: intentions, sidecar proxies, gateways) & Operations and Maintenance (snapshots/restore, upgrades, monitoring, Autopilot)

  • Re-run every prior lab from scratch without notes and log each step that required a lookup

  • Take a timed 60-question practice exam and score each domain separately

  • Rebuild the two lowest-scoring domains into flashcards or a cheat sheet from your own words

  • Redo one broken-cluster troubleshooting drill: kill the leader during writes and confirm recovery and client behavior

Your checkpoint

A scored practice exam with a per-domain breakdown and a personal weak-spot sheet covering no more than two domains

Milestones

Week 2: A 3-server, 2-client datacenter is running from version-controlled configs and you can name the Raft leader and explain why a 3-server cluster survives one failure

Week 4: You can register a service three different ways, resolve it over DNS, and return it through a prepared query and a blocking API call without consulting documentation

Week 6: Two services communicate through sidecar proxies under a default-deny intention set, and you can point to the exact evidence that traffic was blocked before the allow rule existed

Week 8: Practice exam score of 80% or higher overall with no single domain below 70%, and a restore drill completed successfully