consul integration: core service mesh

[noahehall]

C

• enable & configure consul connect
  • this is ticket is constrainted to consul + service mesh (connect)
  • @see consul integration: core service discovery #22

T

• consul node names should match service names; should fix client retry_join having to ip
• refactor existing service discovery logic

---

• setup envoy
  • ubuntu multi app container
  • alpine multi app container
• fix & verify service health checks
  • haproxy
  • vault
• consul envoy + vault
• consul envoy + haproxy
  • - big bold letters: Sidecar service registrations are only a shorthand for registering multiple services. Consul will not start up or manage the actual proxy processes for you.
    • bootstrap.sh update to start consul + envoy on ubuntu and alpine
• refactor & agent config review 1
• verify and setup intentions: haproxy > vault UI
• add consul-template to multi app containers
  • haproxy
  • vault: actually dont think its needed here, but whatev

A

• @see funk my way through envoy install on vault image; see if func-e has a better solution #26
• https://github.com/haproxytech/haproxy/tree/master/blog/integration_with_consul
• https://developer.hashicorp.com/consul/docs/connect/config-entries/proxy-defaults
• https://developer.hashicorp.com/consul/docs/connect/config-entries/service-defaults
• https://developer.hashicorp.com/consul/docs/connect/config-entries
• https://developer.hashicorp.com/consul/api-docs/agent
• https://developer.hashicorp.com/consul/docs/agent/config/cli-flags
• https://developer.hashicorp.com/consul/docs/agent/config/config-files
• https://developer.hashicorp.com/consul/docs/architecture/consensus
• https://developer.hashicorp.com/consul/docs/connect/configuration
• https://developer.hashicorp.com/consul/docs/connect/nomad
• https://developer.hashicorp.com/consul/docs/discovery/checks
• https://developer.hashicorp.com/consul/docs/discovery/dns
• https://developer.hashicorp.com/consul/docs/discovery/services
• https://developer.hashicorp.com/consul/downloads
• https://developer.hashicorp.com/consul/tutorials/datacenter-operations/gossip-encryption-rotate
• https://developer.hashicorp.com/consul/tutorials/datacenter-operations/recovery-outage
• https://developer.hashicorp.com/consul/tutorials/day-0/docker-container-agents
• https://developer.hashicorp.com/consul/tutorials/developer-mesh/service-mesh-production-checklist
• https://developer.hashicorp.com/consul/tutorials/docker
• https://developer.hashicorp.com/consul/tutorials/docker/docker-compose-datacenter
• https://developer.hashicorp.com/consul/tutorials/get-started-vms/virtual-machine-gs-service-mesh
• https://developer.hashicorp.com/consul/tutorials/load-balancing/load-balancing-haproxy
• https://developer.hashicorp.com/consul/tutorials/security/tls-encryption-secure?in=consul%2Fsecurity
• https://developer.hashicorp.com/consul/tutorials/vault-secure/vault-pki-consul-connect-ca?in=consul%2Fvault-secure
• https://developer.hashicorp.com/consul/tutorials/vault-secure/vault-pki-consul-secure-tls?in=consul%2Fvault-secure
• https://developer.hashicorp.com/nomad/docs/integrations/consul-integration
• https://developer.hashicorp.com/nomad/docs/job-specification/service
• https://github.com/hashicorp-education/learn-consul-get-started-vms
• https://github.com/hashicorp/consul-template
• https://github.com/hashicorp/consul/blob/main/Dockerfile
• https://www.haproxy.com/blog/consul-service-discovery-for-haproxy/
• https://www.haproxy.com/blog/haproxy-and-consul-with-dns-for-service-discovery/
• https://developer.hashicorp.com/consul/tutorials/developer-mesh/service-mesh-with-envoy-proxy?utm_source=docs
• https://developer.hashicorp.com/consul/tutorials/developer-mesh/service-mesh-ingress-gateways

---

issue 1: proxy > vault: connection refused
@see hashicorp/nomad#8343

root@1571b2184198:/usr/local/etc/haproxy# consul members
Node        Address            Status  Type    Build   Protocol  DC       Partition  Segment
consul      192.168.96.4:8301  alive   server  1.14.3  2         us-east  default    <all>
core-proxy  192.168.96.3:8301  alive   client  1.14.3  2         us-east  default    <default>
core-vault  192.168.96.2:8301  alive   client  1.14.3  2         us-east  default    <default>

vault: x.x.x.2 
OK 200
  curl https://dev.nirv.ai:8200/v1/sys/health
  curl -k https://core-vault:8200/v1/sys/health
  curl -k https://192.168.96.2:8200/v1/sys/health
  curl -k https://127.0.0.1:8200/v1/sys/health
  


proxy: x.x.x.3 
OK 200
  curl -k https://core-vault:8200/v1/sys/health
  curl -k https://192.168.96.2:8200/v1/sys/health <<<< w00p w00p
  ^ we need to set the server to whatever the sidecar proxy is
  ^ the sidecar will handle balancing requests between X number of service nodes

# w00p w00p
backend lb-vault
    balance roundrobin
    server-template consul-dns 1 "core-vault.service.search:${VAULT_PORT_CUNT}" check ssl verify none maxconn ${PROXY_MAXCONN_PRIV} weight 150 resolvers consul resolve-prefer ipv4 resolve-opts

---

issue 2: Config validation failed: Multiple private IPv4 addresses found. Please configure one with 'bind' and/or 'advertise'.
@see hashicorp/consul#3897

# think u need to set the advertise_addr