Consul Ops Pro flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Consul server vs client

Servers form the Raft quorum and maintain cluster state; clients forward RPCs to servers and run local health checks. Clients are stateless and scale horizontally.

Raft quorum size

A cluster of N servers requires (N/2)+1 for quorum. A 3-server cluster tolerates 1 failure; a 5-server cluster tolerates 2 failures.

Gossip encryption key

A 32-byte base64-encoded symmetric key shared by all agents in a datacenter, configured via the encrypt setting. It secures Serf communication.

Bootstrap expect

The -bootstrap-expect flag on servers delays leader election until the specified number of servers join, preventing split-brain during initial cluster formation.

Autopilot

A Consul feature that monitors server health, stabilizes the Raft cluster after disruptions, and can automatically remove failed servers when cleanup_dead_servers is enabled.

Snapshot save and restore

Commands consul snapshot save and consul snapshot restore capture and restore KV, ACLs, intentions, and service catalog, but not the Raft configuration.

Service health check types

Consul supports script, HTTP, TCP, TTL, Docker, and gRPC checks. A service is healthy only if all its checks pass; DNS returns only passing instances.

Connect sidecar proxy

A sidecar proxy registered alongside a service to handle inbound and outbound connections for the service mesh, typically Envoy, configured by Consul.

Intention precedence

Intentions are evaluated in order: exact match, then prefix match, then wildcard. Deny intentions override allow intentions.

TTL health check

A check that remains healthy only if the service periodically updates it via the API or CLI; if the TTL expires, the check becomes critical.

KV CAS operation

Check-And-Set allows atomic updates by specifying the ModifyIndex; the write succeeds only if the current index matches, enabling safe concurrent modifications.

ACL bootstrap token

The initial management token generated by consul acl bootstrap, granting unrestricted access. It should be stored securely and used only for initial setup.

ACL policy rules

Policies contain rules granting read, write, or deny on resources like service, node, key, query, intention, and operator. Policies are attached to tokens.

Session-based KV lock

A distributed lock using a session with TTL and health checks; acquire with consul kv put -acquire=<session>, release with -release or on session expiration.

TLS verify_server_hostname

A setting that forces clients to verify the server certificate's hostname against server.<datacenter>.<domain>, preventing man-in-the-middle attacks.

Gossip key rotation

Use consul keyring -install to add a new key, -use to make it primary, and -remove to delete the old key, ensuring all agents are updated.

Consul CA certificate

The certificate authority that signs server and client certificates for TLS and Connect; distribute the CA cert to all agents for verification.

Prometheus metrics endpoint

Consul exposes metrics at /v1/agent/metrics in Prometheus format when telemetry.prometheus_retention_time is set; scrape this endpoint for monitoring.

Consul watch

A CLI command that monitors changes to services, KV, health checks, or events and outputs updates, useful for integration with monitoring and automation.

Raft leader lastContact

A metric indicating the time since the leader last contacted a follower; values over 200ms suggest network issues or leader contention.

Quorum loss recovery

If quorum is lost, stop all servers, restart one with -bootstrap-expect 1 and -bootstrap to form a new cluster, then rejoin the others.

Remove Raft peer

Use consul operator raft remove-peer -id <node-id> to remove a failed server from the Raft configuration without graceful leave.

Consul debug bundle

The consul debug command collects logs, metrics, and configuration into an archive for troubleshooting and support analysis.

Terraform Consul provider

An infrastructure-as-code tool that manages Consul services, KV entries, ACLs, and intentions declaratively using Terraform configurations.

Consul namespaces

An enterprise feature that isolates services and KV within a shared cluster, allowing multiple teams to operate independently with scoped ACLs.

Admin partitions

An enterprise feature that provides larger-scale isolation by grouping multiple datacenters under a single management plane with separate Raft groups.

Vault secrets engine

A Vault integration that dynamically generates Consul ACL tokens, reducing manual token management and improving security.

Consul Helm chart

The official chart for deploying Consul on Kubernetes, configuring servers, clients, and the Connect injector via values.yaml.

WAN gossip pool

A gossip pool that spans datacenters, used for cross-datacenter membership and event propagation, separate from the LAN gossip pool.

Server graceful leave

The consul leave command on a server transfers leadership if needed and shuts down the server gracefully, allowing safe removal from the cluster.

Service mesh intention default

When ACLs are enabled, intentions are deny by default; explicit allow intentions are required for services to communicate through the mesh.

ACL token types

Management tokens have global access; client tokens are limited by policies; anonymous tokens apply when no token is provided and should have minimal permissions.