1
2
3
4
5

consul agent -dev

netstat -nltp

#可根据日志看出agent已成为server，并成为集群leader

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

consul members

#节点名称、监听地址、健康状态、集群角色、版本信息
Node     Address         Status  Type    Build  Protocol  DC   Segment
zhang22  127.0.0.1:8301  alive   server  1.0.6  2         dc1  <all>


#使用HTTP API将请求转发给server以获取一致的view of world
culr localhost:8500/v1/catalog/nodes


#DNS interface也可以查询节点，默认端口8600
dig @127.0.0.1 -p 8600 zhang22.node.consul

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#创建一个consul配置目录
mkdir /etc/consul.d


#编写服务定义配置文件
#假设有一个web服务运行在80端口，添加一个便于query的tag
echo '{"service": {"name: "web", "tag": ["rails"], "port": 80 }}' | tee /etc/consul.d/web.json


#重启agent，指定配置目录
consul agent -dev -config-dir=/etc/consul.d

1
2
3
4
5
6
7
8

#DNS name(默认) -- NAME.service.consul

#只有IP
dig @127.0.0.1 -p 8600 web.service.consul


#返回IP/Port
dig @127.0.0.1 -p 8600 web.service.consul SRV

1

dig @127.0.0.1 -p 8600 rails.web.service.consul

1
2

#前面定义了web这个service
curl http://localhost:8500/v1/catalog/service/web

1
2

#仅仅健康实例的查询
 curl 'http://localhost:8500/v1/health/service/web?passing'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

#node1
consul agent -server -bootstrap-expect=1 \
    -data-dir=/tmp/consul -node=agent-one -bind=ip1 \
    -enable-script-checks=true -config-dir=/etc/consul.d

#node2
consul agent -data-dir=/tmp/consul -node=agent-two \
    -bind=ip2 -enable-script-checks=true -config-dir=/etc/consul.d


#两个独立的node

#现在，我们有两个agent在运行中：一个server，一个client。但是他们两者并不知道对方，并仍然是一个单一节点的集群。
#查看节点
consul member

1
2
3
4
5
6
7
8
9

consul join ip
#Successfully joined cluster by contacting 1 nodes.

consul members

Node       Address              Status  Type    Build  Protocol  DC   Segment
agent-one  172.16.129.141:8301  alive   server  1.0.6  2         dc1  <all>
agent-two  172.16.129.150:8301  alive   client  1.0.6  2         dc1  <default>

1
2
3
4

#NAME.node.consul或NAME.node.DATACENTER.conosul
dig @localhost -p 8600 agent-one.node.consul
dig @127.0.0.1 -p 8600 agent-two.node.consul

1
2
3
4
5
6
7
8
9

#在基于脚本的健康检查上，它与consul进程使用同样的用户
#如果命令以非0状态码退出，则该节点会被标记为unhealthy

echo '{"check": {"name": "ping", "args": ["ping", "-c1", "baidu.com"], "interval": "30s"}}' >/etc/consul.d/ping.json

echo '{"service": {"name": "web", "tags": ["rails"], "port": 80, "check": {"args": ["curl", "localhost"], "interval": "10s"}}}' >/etc/consul.d/web.json


consul reload

1
2
3

curl http://localhost:8500/v1/health/state/critical

dig @127.0.0.1 -p 8600 web.service.consul

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#CLI
consul kv --help

consul kv put name zhang
consul kv get name
#zhang

consul kv get -detailed name

consul kv puut -flags=42 who zhang21
#所有key都支持设置一个64位的整数标志值


#列出所有kv
consul kv get -recurse


#删除
consul kv delete name


#使用 Check-And-Set 进行原子更新
consul kv put -cas -modify-index=112 NAME zhang



#导出与导入
consul kv export > xxx.json

consul kv import $xxx.json

1
2
3

consul agent -ui

#localhost:8500/ui

1
2
3
4
5
6

    "Coord": {
        "Adjustment": 0.1,
        "Error": 1.5,
        "Height": 0.02,
        "Vec": [0.34,0.68,0.003,0.01,0.05,0.1,0.34,0.06]
    }

1
2
3
4
5
6
7
8
9

#直接指定配置项运行
consul agent -options


#将配置项写入文件，指定配置目录运行
mkdir /etc/consul.d
vim /etc/consul.d/consul.json

consul agent -config-dir=/etc/consul.d

1
2
3
4
5
6
7
8

#node lookup
<node>.node[.datacenter].<domain>

node1.node.dc1.consul
node1.node.consul

dig @127.0.0.1 -p 8600 node1.node.consul

1
2
3
4
5
6

[tag.]<service>.service[.datacenter].<domain>

redis.service.consul
postgresql.service.dc2.consul

dig @127.0.0.1 -p 8600 redis.service.consul SRV

1
2
3

_<service>._<protocol>[.service][.datacenter][.domain]

dig @127.0.0.1 -p 8600 _rabbitmq._amqp.service.consul SRV

1

<query or name>.query[.datacenter].<domain>

1

<service>.connect.<domain>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

#开始栗子
vim /etc/consul.d/single.json


{
"bind_addr": "192.168.1.11",
"bootstrap": true,
"client_addr": "0.0.0.0",
"datacenter": "zhang",
"data_dir": "/var/lib/consul",
"log_level": "WARN",
"node_name": "zhang21",
"server": true,
"enable_syslog": true,
"ui": true
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

#集群配置
vim /etc/consul.d/cluster.json


{
	"bind_addr": "xxx",
	"bootstrap_expect": 2,
	"client_addr": "0.0.0.0",
	"datacenter": "zhang",
	"data_dir": "/var/lib/consul",
	"encrypt": "a1b8vAA2==@xyz",
	"log_level": "WARN",
	"node_name": "zhang21",
	"node_id": "zhang21",
	"server": true,
	"enable_syslog": true,
	"ui": true,
	"retry_interval": 20s,
	"retry_join": [
		"consul.domain.internal",
		"10.0.1.2:8301",
		"[::1]:8301"
	]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

vim /etc/consul.d/redis.json


{
    "service": {
        "name": "redis",
        "id": "redis01",
        "tags": [
            "master"
        ],
        "address": "127.0.0.1",
        "port": 6379,
        "meta": {
            "meta": "service definition for redis"
        },
        "enable_tag_override": false,

        "check": {
            "id": "redisTCP",
            "name": "redis service check",
            "tcp": "localhost:6379",
            "interval": "10s",
            "timeout": "1s"
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

{
  "services": [
    {
      "id": "red0",
      "name": "redis",
      "tags": [
        "primary"
      ],
      "address": "",
      "port": 6000,
      "checks": [
        {
          "args": ["/bin/check_redis", "-p", "6000"],
          "interval": "5s",
          "ttl": "20s"
        }
      ]
    },
    {
      "id": "red1",
      "name": "redis",
      "tags": [
        "delayed",
        "secondary"
      ],
      "address": "",
      "port": 7000,
      "checks": [
        {
          "args": ["/bin/check_redis", "-p", "7000"],
          "interval": "30s",
          "ttl": "60s"
        }
      ]
    },
    ...
  ]
}

1
2
3
4
5
6
7
8
9

{
  "check": {
    "id": "mem-util",
    "name": "Memory utilization",
    "args": ["/usr/local/bin/check_mem.py", "-limit", "256MB"],
    "interval": "10s",
    "timeout": "1s"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "check": {
    "id": "api",
    "name": "HTTP API on port 5000",
    "http": "https://localhost:5000/health",
    "tls_skip_verify": false,
    "method": "POST",
    "header": {"x-foo":["bar", "baz"]},
    "interval": "10s",
    "timeout": "1s"
  }
}

1
2
3
4
5
6
7
8
9

{
  "check": {
    "id": "ssh",
    "name": "SSH TCP on port 22",
    "tcp": "localhost:22",
    "interval": "10s",
    "timeout": "1s"
  }
}

1
2
3
4
5
6
7
8

{
  "check": {
    "id": "web-app",
    "name": "Web App Status",
    "notes": "Web app does a curl internally every 10 seconds",
    "ttl": "30s"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

{
"check": {
    "id": "mem-util",
    "name": "Memory utilization",
    "docker_container_id": "f972c95ebf0e",
    "shell": "/bin/bash",
    "args": ["/usr/local/bin/check_mem.py"],
    "interval": "10s"
  }
}

1
2
3
4
5
6
7
8
9

{
"check": {
    "id": "mem-util",
    "name": "Service health status",
    "grpc": "127.0.0.1:12345",
    "grpc_use_tls": true,
    "interval": "10s"
  }
}

1
2
3
4
5
6
7
8

{
  "check": {
    "id": "mem",
    "args": ["/bin/check_mem", "-limit", "256MB"],
    "interval": "10s",
    "status": "passing"
  }
}

1
2
3
4
5
6
7
8

{
  "check": {
    "id": "web-app",
    "name": "Web App Status",
    "service_id": "web-app",
    "ttl": "30s"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

{
  "checks": [
    {
      "id": "chk1",
      "name": "mem",
      "args": ["/bin/check_mem", "-limit", "256MB"],
      "interval": "5s"
    },
    {
      "id": "chk2",
      "name": "/health",
      "http": "http://localhost:5000/health",
      "interval": "15s"
    },
    {
      "id": "chk3",
      "name": "cpu",
      "script": "/bin/check_cpu",
      "interval": "10s"
    },
    ...
  ]
}

1
2
3
4
5
6
7
8
9

consul keygen
FDGDpW55oCYJlh555Es1gA==


vim /etc/consul.d/cluster.json

{
    "encrypt": "FDGDpW55oCYJlh555Es1gA==",
}

1
2
3

#USR1 10
kill -10 ${consul-pid}

1
2
3
4
5
6
7
8

{
  "type": "key",
  "key": "foo/bar/baz",
  "handler_type": "script",
  "args": ["/usr/bin/my-service-handler.sh", "-redis"]
}

#在consul v1.0以后，args数组被添加，以便可在没有shell的情况下运行处理程序

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "type": "key",
  "key": "foo/bar/baz",
  "handler_type": "http",
  "http_handler_config": {
    "path":"https://localhost:8000/watch",
    "method": "POST",
    "header": {"x-foo":["bar", "baz"]},
    "timeout": "10s",
    "tls_skip_verify": false
  }
}

1
2
3

consul watch -type service -service redis

consul watch -type checks -service redis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

#key
{
  "type": "key",
  "key": "foo/bar/baz",
  "args": ["/usr/bin/my-service-handler.sh", "-redis"]
}
#or
consul watch -type=key -key=foo/bar/baz /usr/bin/my-key-handler.sh



#keyprefix
{
  "type": "keyprefix",
  "prefix": "foo/",
  "args": ["/usr/bin/my-service-handler.sh", "-redis"]
}
#or
consul watch -type=keyprefix -prefix=foo/ /usr/bin/my-prefix-handler.sh



#services
{
  "redis": []
}




#nodes
[
  {
    "Node": "node1",
	"Address": "192.168.1.11"
  },
  {
    "Node": "node2",
	"Address": "xxx"
  }
]



#service
{
  "type": "service",
  "service": "redis",
  "args": ["/usr/bin/my-service-handler.sh", "-redis"]
}



#check
[
  {
    "Node": "foobar",
    "CheckID": "service:redis",
    "Name": "Service 'redis' check",
    "Status": "passing",
    "Notes": "",
    "Output": "",
    "ServiceID": "redis",
    "ServiceName": "redis"
  }
]



#event
{
  "type": "event",
  "name": "web-deploy",
  "args": ["/usr/bin/my-service-handler.sh", "-web-deploy"]
}
#or
consul watch -type=event -name=web-deploy /usr/bin/my-deploy-handler.sh -web-deploy

1
2
3
4
5
6

agent "<node name of agent>" {
  policy = "write"
}
node "" {
  policy = "read"
}

1
2
3
4
5
6
7
8
9

node "node1" {
  policy = "write"
}
service "" {
  policy = "read"
}
key "_rexec" {
  policy = "write"
}

1
2
3
4
5
6
7

{
  "acl_datacenter": "dc1",
  "acl_master_token": "123abc!@#,
  "acl_default_policy": "deny",
  "acl_down_policy": "deny",
  "acl_down_policy": "extend-cache"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

curl --request PUT --header "X-Consul-Token: 123abc!@#" --data \
'{
   "Name": "Agent Token",
   "Type": "client",
   "Rules": "node \"\" { policy = \"write\"} service \"\" { policy = \"read\" }"
}' http://127.0.0.1:8500/v1/acl/create



返回的值便是新创建的token
{"ID": "xxxxxxxxxxxxxx"}

1
2
3
4
5
6
7
8

{
  "acl_datacenter": "dc1",
  "acl_master_token": "123abc!@#,
  "acl_default_policy": "deny",
  "acl_down_policy": "deny",
  "acl_down_policy": "extend-cache",
  "acl_agent_token": "xxxxxxxxxxxxxxxx"
}

1
2
3
4

curl --request PUT --header "X-Consul-Token: 123abc!@#" --data \
'{
   "Token": "xxxxxxxxxxxxx"
}' http://127.0.0.1:8500/v1/agent/token/acl_agent_token

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

{
  "acl_datacenter": "dc1",
  "acl_down_policy": "extend-cache",
  "acl_agent_token": "前面的acl_agent_token"
}



#或使用API
curl \
    --request PUT \
    --header "X-Consul-Token: abc123!@#" \
    --data \
'{
  "Token": "xxxxxxxxxxxx"
}' http://127.0.0.1:8500/v1/agent/token/acl_agent_token

1

CONSUL_HTTP_TOKEN=xxxxxxxx consul members

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

curl \
    --request PUT \
    --header "X-Consul-Token: 123abc!@#" \
    --data \
'{
  "ID": "anonymous",
  "Type": "client",
  "Rules": "node \"\" { policy = \"read\" }"
}' http://127.0.0.1:8500/v1/acl/update

1
2
3
4
5
6
7
8
9

curl \
    --request PUT \
    --header "X-Consul-Token: 123abc!@#" \
    --data \
'{
  "ID": "anonymous",
  "Type": "client",
  "Rules": "node \"\" { policy = \"read\" } service \"consul\" { policy = \"read\" }"
}' http://127.0.0.1:8500/v1/acl/update

1
2
3
4
5
6
7
8
9

curl \
    --request PUT \
    --header "X-Consul-Token: 123abc!@#" \
    --data \
'{
  "Name": "UI Token",
  "Type": "client",
  "Rules": "key \"\" { policy = \"write\" } node \"\" { policy = \"read\" } service \"\" { policy = \"read\" }"
}' http://127.0.0.1:8500/v1/acl/create

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# These control access to the key/value store.
key "" {
  policy = "read"
}
key "foo/" {
  policy = "write"
}
key "foo/private/" {
  policy = "deny"
}

# This controls access to cluster-wide Consul operator information.
operator = "read"

1
2
3
4
5
6
7
8
9

agent "" {
  policy = "read"
}
agent "foo" {
  policy = "write"
}
agent "bar" {
  policy = "deny"
}

1
2
3
4
5
6

event "" {
  policy = "read"
}
event "deploy" {
  policy = "write"
}

1
2
3
4
5
6
7
8
9

key "" {
  policy = "read"
}
key "foo" {
  policy = "write"
}
key "bar" {
  policy = "deny"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

key "" {
 policy = "deny"
}

key "bar" {
 policy = "list"
}

key "baz" {
 policy = "read"
}

1

keyring = "write"

1
2
3
4
5
6
7
8
9

node "" {
  policy = "read"
}
node "app" {
  policy = "write"
}
node "admin" {
  policy = "deny"
}

1

operator = "read"

1
2
3
4
5
6

query "" {
  policy = "read"
}
query "foo" {
  policy = "write"
}

1
2

#On NodeB
consul join NodeA

1

servece/<service name>/leader

1
2
3

curl -X PUT '{ "Name": "dbservice" }' http://localhost:8500/v1/session/create

这回返回一个JSON对象的session ID

1
2
3
4
5

curl -X PUT -d <body> http://localhost:8500/v1/kv/<key>?acquire=<session>

如果返回true，则已获得锁定，并且本地节点时领导者
如果返回false，则某个其它节点已获取锁定

1

curl -X PUT http://localhost:8500/v1/kv/<key>?release=<session>

1

curl  http://localhost:8500/v1/kv/<key>

1

curl http://localhost:8500/v1/session/info/xxxxxxxxxxx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

wget https://releases.hashicorp.com/consul-template/0.19.5/consul-template_0.19.5_linux_amd64.tgz

tar -xzvf ./consul-template_0.19.5_linux_amd64.tgz
mv ./consul-template /bin/


#or
mv consul-template /usr/local/bin
vim /etc/profile
export PATH=$PATH:/usr/local/bin


consul-template --version
consul-template v0.19.5 (57b6c71)

1
2

consul-template -h

1
2
3
4

consul-template \
    -template "/tmp/nginx.ctmpl:/var/nginx/nginx.conf:nginx -s reload" \
    -template "/tmp/redis.ctmpl:/var/redis/redis.conf:service redis restart" \
    -template "/tmp/haproxy.ctmpl:/var/haproxy/haproxy.conf"

1

consul-template -consul-addr="consul1:8500" -consul-addr="consul2:8500"

1
2
3
4
5

mkdir /etc/consul-template

vim consul-template.hcl

consul-template -config='/etc/consul-template/consul-template.hcl'

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354

# This denotes the start of the configuration section for Consul. All values
# contained in this section pertain to Consul.
consul {
  # This block specifies the basic authentication information to pass with the
  # request. For more information on authentication, please see the Consul
  # documentation.
  auth {
    enabled  = true
    username = "test"
    password = "test"
  }

  # This is the address of the Consul agent. By default, this is
  # 127.0.0.1:8500, which is the default bind and port for a local Consul
  # agent. It is not recommended that you communicate directly with a Consul
  # server, and instead communicate with the local Consul agent. There are many
  # reasons for this, most importantly the Consul agent is able to multiplex
  # connections to the Consul server and reduce the number of open HTTP
  # connections. Additionally, it provides a "well-known" IP address for which
  # clients can connect.
  address = "127.0.0.1:8500"

  # This is the ACL token to use when connecting to Consul. If you did not
  # enable ACLs on your Consul cluster, you do not need to set this option.
  #
  # This option is also available via the environment variable CONSUL_TOKEN.
  token = "abcd1234"

  # This controls the retry behavior when an error is returned from Consul.
  # Consul Template is highly fault tolerant, meaning it does not exit in the
  # face of failure. Instead, it uses exponential back-off and retry functions
  # to wait for the cluster to become available, as is customary in distributed
  # systems.
  retry {
    # This enabled retries. Retries are enabled by default, so this is
    # redundant.
    enabled = true

    # This specifies the number of attempts to make before giving up. Each
    # attempt adds the exponential backoff sleep time. Setting this to
    # zero will implement an unlimited number of retries.
    attempts = 12

    # This is the base amount of time to sleep between retry attempts. Each
    # retry sleeps for an exponent of 2 longer than this base. For 5 retries,
    # the sleep times would be: 250ms, 500ms, 1s, 2s, then 4s.
    backoff = "250ms"

    # This is the maximum amount of time to sleep between retry attempts.
    # When max_backoff is set to zero, there is no upper limit to the
    # exponential sleep between retry attempts.
    # If max_backoff is set to 10s and backoff is set to 1s, sleep times
    # would be: 1s, 2s, 4s, 8s, 10s, 10s, ...
    max_backoff = "1m"
  }

  # This block configures the SSL options for connecting to the Consul server.
  ssl {
    # This enables SSL. Specifying any option for SSL will also enable it.
    enabled = true

    # This enables SSL peer verification. The default value is "true", which
    # will check the global CA chain to make sure the given certificates are
    # valid. If you are using a self-signed certificate that you have not added
    # to the CA chain, you may want to disable SSL verification. However, please
    # understand this is a potential security vulnerability.
    verify = false

    # This is the path to the certificate to use to authenticate. If just a
    # certificate is provided, it is assumed to contain both the certificate and
    # the key to convert to an X509 certificate. If both the certificate and
    # key are specified, Consul Template will automatically combine them into an
    # X509 certificate for you.
    cert = "/path/to/client/cert"
    key  = "/path/to/client/key"

    # This is the path to the certificate authority to use as a CA. This is
    # useful for self-signed certificates or for organizations using their own
    # internal certificate authority.
    ca_cert = "/path/to/ca"

    # This is the path to a directory of PEM-encoded CA cert files. If both
    # `ca_cert` and `ca_path` is specified, `ca_cert` is preferred.
    ca_path = "path/to/certs/"

    # This sets the SNI server name to use for validation.
    server_name = "my-server.com"
  }
}

# This is the signal to listen for to trigger a reload event. The default
# value is shown below. Setting this value to the empty string will cause CT
# to not listen for any reload signals.
reload_signal = "SIGHUP"

# This is the signal to listen for to trigger a graceful stop. The default
# value is shown below. Setting this value to the empty string will cause CT
# to not listen for any graceful stop signals.
kill_signal = "SIGINT"

# This is the maximum interval to allow "stale" data. By default, only the
# Consul leader will respond to queries; any requests to a follower will
# forward to the leader. In large clusters with many requests, this is not as
# scalable, so this option allows any follower to respond to a query, so long
# as the last-replicated data is within these bounds. Higher values result in
# less cluster load, but are more likely to have outdated data.
max_stale = "10m"

# This is the log level. If you find a bug in Consul Template, please enable
# debug logs so we can help identify the issue. This is also available as a
# command line flag.
log_level = "warn"

# This is the path to store a PID file which will contain the process ID of the
# Consul Template process. This is useful if you plan to send custom signals
# to the process.
pid_file = "/path/to/pid"

# This is the quiescence timers; it defines the minimum and maximum amount of
# time to wait for the cluster to reach a consistent state before rendering a
# template. This is useful to enable in systems that have a lot of flapping,
# because it will reduce the the number of times a template is rendered.
wait {
  min = "5s"
  max = "10s"
}

# This denotes the start of the configuration section for Vault. All values
# contained in this section pertain to Vault.
vault {
  # This is the address of the Vault leader. The protocol (http(s)) portion
  # of the address is required.
  address = "https://vault.service.consul:8200"

  # This is the grace period between lease renewal of periodic secrets and secret
  # re-acquisition. When renewing a secret, if the remaining lease is less than or
  # equal to the configured grace, Consul Template will request a new credential.
  # This prevents Vault from revoking the credential at expiration and Consul
  # Template having a stale credential.
  #
  # Note: If you set this to a value that is higher than your default TTL or
  # max TTL, Consul Template will always read a new secret!
  #
  # This should also be less than or around 1/3 of your TTL for a predictable
  # behaviour. See https://github.com/hashicorp/vault/issues/3414
  grace = "5m"

  # This is the token to use when communicating with the Vault server.
  # Like other tools that integrate with Vault, Consul Template makes the
  # assumption that you provide it with a Vault token; it does not have the
  # incorporated logic to generate tokens via Vault's auth methods.
  #
  # This value can also be specified via the environment variable VAULT_TOKEN.
  token = "abcd1234"

  # This tells Consul Template that the provided token is actually a wrapped
  # token that should be unwrapped using Vault's cubbyhole response wrapping
  # before being used. Please see Vault's cubbyhole response wrapping
  # documentation for more information.
  unwrap_token = true

  # This option tells Consul Template to automatically renew the Vault token
  # given. If you are unfamiliar with Vault's architecture, Vault requires
  # tokens be renewed at some regular interval or they will be revoked. Consul
  # Template will automatically renew the token at half the lease duration of
  # the token. The default value is true, but this option can be disabled if
  # you want to renew the Vault token using an out-of-band process.
  #
  # Note that secrets specified in a template (using {{secret}} for example)
  # are always renewed, even if this option is set to false. This option only
  # applies to the top-level Vault token itself.
  renew_token = true

  # This section details the retry options for connecting to Vault. Please see
  # the retry options in the Consul section for more information (they are the
  # same).
  retry {
    # ...
  }

  # This section details the SSL options for connecting to the Vault server.
  # Please see the SSL options in the Consul section for more information (they
  # are the same).
  ssl {
    # ...
  }
}

# This block defines the configuration for connecting to a syslog server for
# logging.
syslog {
  # This enables syslog logging. Specifying any other option also enables
  # syslog logging.
  enabled = true

  # This is the name of the syslog facility to log to.
  facility = "LOCAL5"
}

# This block defines the configuration for de-duplication mode. Please see the
# de-duplication mode documentation later in the README for more information
# on how de-duplication mode operates.
deduplicate {
  # This enables de-duplication mode. Specifying any other options also enables
  # de-duplication mode.
  enabled = true

  # This is the prefix to the path in Consul's KV store where de-duplication
  # templates will be pre-rendered and stored.
  prefix = "consul-template/dedup/"
}

# This block defines the configuration for exec mode. Please see the exec mode
# documentation at the bottom of this README for more information on how exec
# mode operates and the caveats of this mode.
exec {
  # This is the command to exec as a child process. There can be only one
  # command per Consul Template process.
  command = "/usr/bin/app"

  # This is a random splay to wait before killing the command. The default
  # value is 0 (no wait), but large clusters should consider setting a splay
  # value to prevent all child processes from reloading at the same time when
  # data changes occur. When this value is set to non-zero, Consul Template
  # will wait a random period of time up to the splay value before reloading
  # or killing the child process. This can be used to prevent the thundering
  # herd problem on applications that do not gracefully reload.
  splay = "5s"

  env {
    # This specifies if the child process should not inherit the parent
    # process's environment. By default, the child will have full access to the
    # environment variables of the parent. Setting this to true will send only
    # the values specified in `custom_env` to the child process.
    pristine = false

    # This specifies additional custom environment variables in the form shown
    # below to inject into the child's runtime environment. If a custom
    # environment variable shares its name with a system environment variable,
    # the custom environment variable takes precedence. Even if pristine,
    # whitelist, or blacklist is specified, all values in this option
    # are given to the child process.
    custom = ["PATH=$PATH:/etc/myapp/bin"]

    # This specifies a list of environment variables to exclusively include in
    # the list of environment variables exposed to the child process. If
    # specified, only those environment variables matching the given patterns
    # are exposed to the child process. These strings are matched using Go's
    # glob function, so wildcards are permitted.
    whitelist = ["CONSUL_*"]

    # This specifies a list of environment variables to exclusively prohibit in
    # the list of environment variables exposed to the child process. If
    # specified, any environment variables matching the given patterns will not
    # be exposed to the child process, even if they are whitelisted. The values
    # in this option take precedence over the values in the whitelist.
    # These strings are matched using Go's glob function, so wildcards are
    # permitted.
    blacklist = ["VAULT_*"]
  }

  # This defines the signal that will be sent to the child process when a
  # change occurs in a watched template. The signal will only be sent after the
  # process is started, and the process will only be started after all
  # dependent templates have been rendered at least once. The default value is
  # nil, which tells Consul Template to stop the child process and spawn a new
  # one instead of sending it a signal. This is useful for legacy applications
  # or applications that cannot properly reload their configuration without a
  # full reload.
  reload_signal = ""

  # This defines the signal sent to the child process when Consul Template is
  # gracefully shutting down. The application should begin a graceful cleanup.
  # If the application does not terminate before the `kill_timeout`, it will
  # be terminated (effectively "kill -9"). The default value is "SIGTERM".
  kill_signal = "SIGINT"

  # This defines the amount of time to wait for the child process to gracefully
  # terminate when Consul Template exits. After this specified time, the child
  # process will be force-killed (effectively "kill -9"). The default value is
  # "30s".
  kill_timeout = "2s"
}

# This block defines the configuration for a template. Unlike other blocks,
# this block may be specified multiple times to configure multiple templates.
# It is also possible to configure templates via the CLI directly.
template {
  # This is the source file on disk to use as the input template. This is often
  # called the "Consul Template template". This option is required if not using
  # the `contents` option.
  source = "/path/on/disk/to/template.ctmpl"

  # This is the destination path on disk where the source template will render.
  # If the parent directories do not exist, Consul Template will attempt to
  # create them, unless create_dest_dirs is false.
  destination = "/path/on/disk/where/template/will/render.txt"

  # This options tells Consul Template to create the parent directories of the
  # destination path if they do not exist. The default value is true.
  create_dest_dirs = true

  # This option allows embedding the contents of a template in the configuration
  # file rather then supplying the `source` path to the template file. This is
  # useful for short templates. This option is mutually exclusive with the
  # `source` option.
  contents = "{{ keyOrDefault \"service/redis/maxconns@east-aws\" \"5\" }}"

  # This is the optional command to run when the template is rendered. The
  # command will only run if the resulting template changes. The command must
  # return within 30s (configurable), and it must have a successful exit code.
  # Consul Template is not a replacement for a process monitor or init system.
  command = "restart service foo"

  # This is the maximum amount of time to wait for the optional command to
  # return. Default is 30s.
  command_timeout = "60s"

  # Exit with an error when accessing a struct or map field/key that does not
  # exist. The default behavior will print "<no value>" when accessing a field
  # that does not exist. It is highly recommended you set this to "true" when
  # retrieving secrets from Vault.
  error_on_missing_key = false

  # This is the permission to render the file. If this option is left
  # unspecified, Consul Template will attempt to match the permissions of the
  # file that already exists at the destination path. If no file exists at that
  # path, the permissions are 0644.
  perms = 0600

  # This option backs up the previously rendered template at the destination
  # path before writing a new one. It keeps exactly one backup. This option is
  # useful for preventing accidental changes to the data without having a
  # rollback strategy.
  backup = true

  # These are the delimiters to use in the template. The default is "{{" and
  # "}}", but for some templates, it may be easier to use a different delimiter
  # that does not conflict with the output file itself.
  left_delimiter  = "{{"
  right_delimiter = "}}"

  # This is the `minimum(:maximum)` to wait before rendering a new template to
  # disk and triggering a command, separated by a colon (`:`). If the optional
  # maximum value is omitted, it is assumed to be 4x the required minimum value.
  # This is a numeric time with a unit suffix ("5s"). There is no default value.
  # The wait value for a template takes precedence over any globally-configured
  # wait.
  wait {
    min = "2s"
    max = "10s"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

vim /etc/consul-template/consul.hcl


max_stale = '10m'
wait = {
  min = '1s'
  max = '3s'
}

template {
  source = '/etc/consul-template/ctmpl/a.ctmpl'
  destination = '/etc/nginx/conf.d/upstream-a.conf'
  command = 'systemctl reload nginx'
  perms = 0644
}




#
vim /etc/consul-template/ctmpl/a.ctmpl


upstream upstream-a {
  {{range service 'a'}}
  server {{.Address}}:{{.Port}};
  {{else}}
  server 127.0.0.1:12345;
  {{end}}
}



#nginx
vim /etc/nginx/conf.d/upstream-a.conf


upstream upstream-a {

  server 192.168.1.11:12345;

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

{{ datacenters }}


#栗子
{{ range datacenters }}
{{ . }}{{ end }}

#效果
dc1
dc2