Course Preview

HashiCorp Consul

Consul is a service networking tool from HashiCorp. It keeps a live catalog of the services running across your machines and clouds, hands out their healthy addresses through DNS or an API, and can encrypt and authorize the traffic between them as a service mesh.

itCloud native tools and technologies | OpenSkills.info

Course pathWalk it in order

Look it upDip in anytime

Go furtherLeaves this page

Don't Panic — HashiCorp Consul

Consul is a service catalog with opinions. It keeps a live, health-checked list of every service in your infrastructure and hands it out through DNS, an HTTP API, or a fleet of proxies. That is the whole product; the rest is configuration.

The problem it replaced was a spreadsheet of IP addresses. Before tools like this, "where does the payment service live" lived in someone's config file, someone's wiki page, and someone's memory, all of which disagreed and one of which was on vacation. Consul made that question a DNS lookup: web.service.consul returns the machines currently running the web service and actually healthy. The actually is doing heavy lifting, and it is enforced by health checks: probes that continuously interrogate each service. No check, no trust. A service that registered and then fell over stops being handed out within seconds.

Three ideas carry everything else.

Agents. Consul is a daemon you run everywhere. Most are clients, lightweight and one per machine, that run checks and answer local queries. A few are servers, which hold the real state and elect a leader using Raft, the same consensus algorithm Kubernetes uses for its own brain. Three servers tolerate one dying. Five tolerate two. More than that is paying latency for vanity.

The proxy fleet. Turn on the service mesh and Consul puts a small proxy, usually Envoy, beside every service. Your application talks to localhost; the proxy handles the rest, wrapping every connection in mutual TLS so services authenticate by identity rather than by network position. Intentions, the mesh's permission rules, read like sentences: web may call api, web may not call admin. Rules follow the services when they move, which IP firewalls never manage to do.

Datacenters are a latency boundary. Gossip, the protocol agents use to gossip about each other, needs round-trips under about fifty milliseconds. You cannot stretch one Consul datacenter across an ocean, and you should not try. You run several and connect them with federation or peering, which sounds like jargon but is really just "one big family" versus "pen pals with a signed introduction letter".

One thing surprises everyone: Consul is not secure by default. Freshly installed, it is a comprehensive map of your infrastructure with the access controls turned off, which is a gift to anyone on your network with curious intentions. Every serious deployment adds encryption, access tokens, and mesh rules, and the docs are refreshingly blunt about it.

What Consul will not do: run your applications, cache hot data at Redis speeds, or improve a single modern Kubernetes cluster where the ecosystem's own tools already fit. Its habitat is the mixed estate, VMs beside Kubernetes beside bare metal, where one control plane beats four half-solutions.

If you read nothing else: the Cheatsheet tab holds the ports, commands, and check types you will want on a screen during an incident. The Landscape tab shows what else lives in this neighborhood. And the Reference tab is the ordered walk into HashiCorp's own documentation, which is, credit where due, excellent.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources