CDIST-TYPE__CONSUL_AGENT(7)

📦
version 7.0.0 · 8 versions
, in fedora 43, fedora 44

💖 cdist-type__consul_agent 💖

okay bestie, welcome to cdist-type__consul_agent(7) — the manual page for managing the consul agent, section 7 of the cdist manuals. it's giving infrastructure, it's giving cluster vibes, and we're gonna get through it together. no cap. 🫶

✨ NAME ✨

cdist-type__consul_agent — manage the consul agent. that's it, that's the whole name. short, sweet, iconic. 👑

🌸 DESCRIPTION 🌸

configure and manage the consul agent. yes queen, that's the whole description. it does the thing. 💅

🎀 REQUIRED PARAMETERS 🎀

None. literally none. zero. not a single one required. we love a low-maintenance type, fr fr. ✨

🦋 OPTIONAL PARAMETERS 🦋

here's where the main character energy lives. every single one of these is optional, so pick your faves:

  • acl-datacenter — only used by servers, bestie. this designates the datacenter which is authoritative for ACL information.
  • acl-default-policy — either "allow" or "deny", and it defaults to "allow". the default policy controls the behavior of a token when there is no matching rule.
  • acl-down-policy — either "allow", "deny" or "extend-cache". and "extend-cache" is the default, periodt.
  • acl-master-token — only used for servers in the acl_datacenter. this token will be created with management-level permissions if it does not exist. it allows operators to bootstrap the ACL system with a token ID that is well-known.
  • acl-token — when provided, the agent will use this token when making requests to the Consul servers.
  • acl-ttl — used to control Time-To-Live caching of ACLs.
  • bind-addr — sets the bind address for cluster communication.
  • bootstrap-expect — sets server to expect bootstrap mode.
  • ca-file-source — path to a PEM encoded certificate authority file which will be uploaded and configure using the ca_file config option.
  • cert-file-source — path to a PEM encoded certificate file which will be uploaded and configure using the cert_file config option.
  • client-addr — sets the address to bind for client access.
  • datacenter — datacenter of the agent.
  • encrypt — provides the gossip encryption key.
  • group — the primary group for the agent.
  • json-config — path to a partial json config file without leading { and trailing }. if json-config is '-' (dash), take what was written to stdin as the file content.
  • key-file-source — path to a PEM encoded private key file which will be uploaded and configure using the key_file config option.
  • node-name — name of this node. must be unique in the cluster.
  • retry-join — address to attempt joining every retry_interval until at least one join works. can be specified multiple times. 👯
  • user — the user to run the agent as.
  • state — if the agent is 'present' or 'absent'. defaults to 'present'. currently state=absent is not working due to some dependency issues.
ok so real talk about that last one: state=absent is lowkey broken rn because of dependency issues. don't come for me, i'm just the messenger. 😭

🌈 BOOLEAN PARAMETERS 🌈

these ones are just on or off, no in-between, very decisive of them:

  • disable-remote-exec — disables support for remote execution. when set to true, the agent will ignore any incoming remote exec requests.
  • disable-update-check — disables automatic checking for security bulletins and new version releases.
  • leave-on-terminate — gracefully leave cluster on SIGTERM.
  • rejoin-after-leave — rejoin the cluster using the previous state after leaving.
  • server — used to control if an agent is in server or client mode.
  • enable-syslog — enables logging to syslog.
  • verify-incoming — enforce the use of TLS and verify a client's authenticity on incoming connections.
  • verify-outgoing — enforce the use of TLS and verify the peers authenticity on outgoing connections.
  • use-distribution-package — uses distribution package instead of upstream binary.

⭐ EXAMPLES ⭐

okay these are the part where it all comes together and honestly? obsessed. copy these exactly, they're perfect as-is:

configure as server, bootstrap and rejoin 🖥️

hostname="$(cat "$__global/explorer/hostname")"
__consul_agent \
   --datacenter dc1 \
   --node-name "${hostname%%.*}" \
   --disable-update-check \
   --server \
   --rejoin-after-leave \
   --bootstrap-expect 3 \
   --retry-join consul-01 \
   --retry-join consul-02 \
   --retry-join consul-03

configure as server, bootstrap and rejoin with ssl support 🔐 (security girlies rise up)

hostname="$(cat "$__global/explorer/hostname")"
__consul_agent \
   --datacenter dc1 \
   --node-name "${hostname%%.*}" \
   --disable-update-check \
   --server \
   --rejoin-after-leave \
   --bootstrap-expect 3 \
   --retry-join consul-01 \
   --retry-join consul-02 \
   --retry-join consul-03 \
   --ca-file-source /path/to/ca.pem \
   --cert-file-source /path/to/cert.pem \
   --key-file-source /path/to/key.pem \
   --verify-incoming \
   --verify-outgoing

configure as client and try joining existing cluster 🦋

__consul_agent \
   --datacenter dc1 \
   --node-name "${hostname%%.*}" \
   --disable-update-check \
   --retry-join consul-01 \
   --retry-join consul-02 \
   --retry-join consul-03

🔥 SEE ALSO 🔥

consul documentation at: http://www.consul.io/docs/agent/options.html.

💜 AUTHORS 💜

Steven Armstrong <steven-cdist--@--armstrong.cc> — the icon who made this. 💅

👑 COPYING 👑

Copyright (C) 2015 Steven Armstrong. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ungleich GmbH 2021

and that's the whole page bestie, you ate that. this was cdist version 7.0.0, dated Jul 31, 2022, from the CDIST-TYPE__CONSUL_AGENT(7) manual. go forth and manage that agent. slay. 💖✨🎀🦋

📦 where this page comes from