Merge branch 'master' into bugfix/gh-4203-multi-tags
This commit is contained in:
John Cowen
GitHub
commit
452888e6ad
|
|
@ -1,5 +1,5 @@
|
|||
<!DOCTYPE html>
|
||||
<html class="ember-loading">
|
||||
<html class="{{content-for "root-class"}}">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
|
|
@ -24,7 +24,6 @@
|
|||
</div>
|
||||
</noscript>
|
||||
{{content-for "body"}}
|
||||
<svg width="168" height="53" xmlns="http://www.w3.org/2000/svg"><g fill="#919FA8" fill-rule="evenodd"><path d="M26.078 32.12a5.586 5.586 0 1 1 5.577-5.599 5.577 5.577 0 0 1-5.577 5.6M37.009 29.328a2.56 2.56 0 1 1 2.56-2.56 2.551 2.551 0 0 1-2.56 2.56M46.916 31.669a2.56 2.56 0 1 1 .051-.21c-.028.066-.028.13-.051.21M44.588 25.068a2.565 2.565 0 0 1-2.672-.992 2.558 2.558 0 0 1-.102-2.845 2.564 2.564 0 0 1 4.676.764c.072.328.081.667.027 1a2.463 2.463 0 0 1-1.925 2.073M53.932 31.402a2.547 2.547 0 0 1-2.95 2.076 2.559 2.559 0 0 1-2.064-2.965 2.547 2.547 0 0 1 2.948-2.077 2.57 2.57 0 0 1 2.128 2.716.664.664 0 0 0-.05.228M51.857 25.103a2.56 2.56 0 1 1 2.108-2.945c.034.218.043.439.027.658a2.547 2.547 0 0 1-2.135 2.287M49.954 40.113a2.56 2.56 0 1 1 .314-1.037c-.02.366-.128.721-.314 1.037M48.974 16.893a2.56 2.56 0 1 1 .97-3.487c.264.446.375.965.317 1.479a2.56 2.56 0 0 1-1.287 2.008"/><path d="M26.526 52.603c-14.393 0-26.06-11.567-26.06-25.836C.466 12.498 12.133.931 26.526.931a25.936 25.936 0 0 1 15.836 5.307l-3.167 4.117A20.962 20.962 0 0 0 17.304 8.23C10.194 11.713 5.7 18.9 5.714 26.763c-.014 7.862 4.48 15.05 11.59 18.534a20.962 20.962 0 0 0 21.89-2.127l3.168 4.123a25.981 25.981 0 0 1-15.836 5.31zM61 30.15V17.948c0-4.962 2.845-7.85 9.495-7.85 2.484 0 5.048.326 7.252.895l-.561 4.433c-2.164-.406-4.688-.691-6.53-.691-3.486 0-4.608 1.22-4.608 4.108v10.412c0 2.888 1.122 4.108 4.607 4.108 1.843 0 4.367-.284 6.53-.691l.562 4.433c-2.204.57-4.768.895-7.252.895C63.845 38 61 35.112 61 30.15zm36.808.04c0 4.068-1.802 7.81-8.493 7.81-6.69 0-8.494-3.742-8.494-7.81v-5.002c0-4.067 1.803-7.81 8.494-7.81 6.69 0 8.493 3.743 8.493 7.81v5.003zm-4.887-5.165c0-2.237-1.002-3.416-3.606-3.416s-3.606 1.18-3.606 3.416v5.328c0 2.237 1.002 3.417 3.606 3.417s3.606-1.18 3.606-3.417v-5.328zm25.79 12.568h-4.887V23.764c0-1.057-.44-1.586-1.563-1.586-1.201 0-3.325.732-5.088 1.668v13.747h-4.887V17.785h3.726l.48 1.668c2.444-1.22 5.53-2.074 7.813-2.074 3.245 0 4.407 2.318 4.407 5.857v14.357zm18.26-5.775c0 3.823-1.162 6.182-7.052 6.182-2.083 0-4.927-.488-6.73-1.139l.68-3.782c1.643.488 3.807.854 5.81.854 2.164 0 2.484-.488 2.484-1.993 0-1.22-.24-1.83-3.405-2.603-4.768-1.18-5.329-2.4-5.329-6.223 0-3.986 1.723-5.735 7.292-5.735 1.803 0 4.166.244 5.85.691l-.482 3.945c-1.482-.284-3.846-.569-5.368-.569-2.124 0-2.484.488-2.484 1.708 0 1.587.12 1.709 2.764 2.4 5.449 1.464 5.97 2.196 5.97 6.264zm4.357-14.033h4.887v13.83c0 1.057.441 1.586 1.563 1.586 1.202 0 3.325-.733 5.088-1.668V17.785h4.888v19.808h-3.726l-.481-1.667c-2.444 1.22-5.529 2.074-7.812 2.074-3.246 0-4.407-2.318-4.407-5.857V17.785zM168 37.593h-4.888V9.691L168 9v28.593z"/></g></svg>
|
||||
<script src="{{rootURL}}assets/vendor.js"></script>
|
||||
<script src="{{rootURL}}assets/consul-ui.js"></script>
|
||||
|
||||
|
|
|
|||
|
|
@ -4,6 +4,9 @@ import { hash } from 'rsvp';
|
|||
import { get } from '@ember/object';
|
||||
import { next } from '@ember/runloop';
|
||||
const $html = document.documentElement;
|
||||
const removeLoading = function() {
|
||||
return $html.classList.remove('ember-loading');
|
||||
};
|
||||
export default Route.extend({
|
||||
init: function() {
|
||||
this._super(...arguments);
|
||||
|
|
@ -24,7 +27,7 @@ export default Route.extend({
|
|||
const controller = this.controllerFor('application');
|
||||
controller.setProperties(model);
|
||||
transition.promise.finally(function() {
|
||||
$html.classList.remove('ember-loading');
|
||||
removeLoading();
|
||||
controller.setProperties({
|
||||
loading: false,
|
||||
dc: model.dc,
|
||||
|
|
@ -51,11 +54,13 @@ export default Route.extend({
|
|||
dc: error.status.toString().indexOf('5') !== 0 ? get(this, 'repo').getActive() : null,
|
||||
})
|
||||
.then(model => {
|
||||
removeLoading();
|
||||
next(() => {
|
||||
this.controllerFor('error').setProperties(model);
|
||||
});
|
||||
})
|
||||
.catch(e => {
|
||||
removeLoading();
|
||||
next(() => {
|
||||
this.controllerFor('error').setProperties({ error: error });
|
||||
});
|
||||
|
|
|
|||
|
|
@ -90,7 +90,7 @@
|
|||
}
|
||||
%healthchecked-resource li a {
|
||||
padding: 3px 15px;
|
||||
padding-top: 4px;
|
||||
padding-top: 5px;
|
||||
padding-left: 39px;
|
||||
height: 31px;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
body {
|
||||
background-color: $white;
|
||||
}
|
||||
fieldset {
|
||||
border: 0;
|
||||
width: 100%;
|
||||
|
|
|
|||
6
ui-v2/lib/.eslintrc.js
Normal file
6
ui-v2/lib/.eslintrc.js
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
module.exports = {
|
||||
env: {
|
||||
node: true,
|
||||
browser: false,
|
||||
},
|
||||
};
|
||||
17
ui-v2/lib/startup/index.js
Normal file
17
ui-v2/lib/startup/index.js
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
/* eslint-env node */
|
||||
'use strict';
|
||||
|
||||
module.exports = {
|
||||
name: 'startup',
|
||||
isDevelopingAddon: function() {
|
||||
return true;
|
||||
},
|
||||
contentFor: function(type, config) {
|
||||
switch (type) {
|
||||
case 'body':
|
||||
return `<svg width="168" height="53" xmlns="http://www.w3.org/2000/svg"><g fill="#919FA8" fill-rule="evenodd"><path d="M26.078 32.12a5.586 5.586 0 1 1 5.577-5.599 5.577 5.577 0 0 1-5.577 5.6M37.009 29.328a2.56 2.56 0 1 1 2.56-2.56 2.551 2.551 0 0 1-2.56 2.56M46.916 31.669a2.56 2.56 0 1 1 .051-.21c-.028.066-.028.13-.051.21M44.588 25.068a2.565 2.565 0 0 1-2.672-.992 2.558 2.558 0 0 1-.102-2.845 2.564 2.564 0 0 1 4.676.764c.072.328.081.667.027 1a2.463 2.463 0 0 1-1.925 2.073M53.932 31.402a2.547 2.547 0 0 1-2.95 2.076 2.559 2.559 0 0 1-2.064-2.965 2.547 2.547 0 0 1 2.948-2.077 2.57 2.57 0 0 1 2.128 2.716.664.664 0 0 0-.05.228M51.857 25.103a2.56 2.56 0 1 1 2.108-2.945c.034.218.043.439.027.658a2.547 2.547 0 0 1-2.135 2.287M49.954 40.113a2.56 2.56 0 1 1 .314-1.037c-.02.366-.128.721-.314 1.037M48.974 16.893a2.56 2.56 0 1 1 .97-3.487c.264.446.375.965.317 1.479a2.56 2.56 0 0 1-1.287 2.008"/><path d="M26.526 52.603c-14.393 0-26.06-11.567-26.06-25.836C.466 12.498 12.133.931 26.526.931a25.936 25.936 0 0 1 15.836 5.307l-3.167 4.117A20.962 20.962 0 0 0 17.304 8.23C10.194 11.713 5.7 18.9 5.714 26.763c-.014 7.862 4.48 15.05 11.59 18.534a20.962 20.962 0 0 0 21.89-2.127l3.168 4.123a25.981 25.981 0 0 1-15.836 5.31zM61 30.15V17.948c0-4.962 2.845-7.85 9.495-7.85 2.484 0 5.048.326 7.252.895l-.561 4.433c-2.164-.406-4.688-.691-6.53-.691-3.486 0-4.608 1.22-4.608 4.108v10.412c0 2.888 1.122 4.108 4.607 4.108 1.843 0 4.367-.284 6.53-.691l.562 4.433c-2.204.57-4.768.895-7.252.895C63.845 38 61 35.112 61 30.15zm36.808.04c0 4.068-1.802 7.81-8.493 7.81-6.69 0-8.494-3.742-8.494-7.81v-5.002c0-4.067 1.803-7.81 8.494-7.81 6.69 0 8.493 3.743 8.493 7.81v5.003zm-4.887-5.165c0-2.237-1.002-3.416-3.606-3.416s-3.606 1.18-3.606 3.416v5.328c0 2.237 1.002 3.417 3.606 3.417s3.606-1.18 3.606-3.417v-5.328zm25.79 12.568h-4.887V23.764c0-1.057-.44-1.586-1.563-1.586-1.201 0-3.325.732-5.088 1.668v13.747h-4.887V17.785h3.726l.48 1.668c2.444-1.22 5.53-2.074 7.813-2.074 3.245 0 4.407 2.318 4.407 5.857v14.357zm18.26-5.775c0 3.823-1.162 6.182-7.052 6.182-2.083 0-4.927-.488-6.73-1.139l.68-3.782c1.643.488 3.807.854 5.81.854 2.164 0 2.484-.488 2.484-1.993 0-1.22-.24-1.83-3.405-2.603-4.768-1.18-5.329-2.4-5.329-6.223 0-3.986 1.723-5.735 7.292-5.735 1.803 0 4.166.244 5.85.691l-.482 3.945c-1.482-.284-3.846-.569-5.368-.569-2.124 0-2.484.488-2.484 1.708 0 1.587.12 1.709 2.764 2.4 5.449 1.464 5.97 2.196 5.97 6.264zm4.357-14.033h4.887v13.83c0 1.057.441 1.586 1.563 1.586 1.202 0 3.325-.733 5.088-1.668V17.785h4.888v19.808h-3.726l-.481-1.667c-2.444 1.22-5.529 2.074-7.812 2.074-3.246 0-4.407-2.318-4.407-5.857V17.785zM168 37.593h-4.888V9.691L168 9v28.593z"/></g></svg>`;
|
||||
case 'root-class':
|
||||
return 'ember-loading';
|
||||
}
|
||||
},
|
||||
};
|
||||
6
ui-v2/lib/startup/package.json
Normal file
6
ui-v2/lib/startup/package.json
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"name": "startup",
|
||||
"keywords": [
|
||||
"ember-addon"
|
||||
]
|
||||
}
|
||||
|
|
@ -14,10 +14,10 @@
|
|||
"lint:js": "eslint -c .eslintrc.js --fix ./*.js ./.*.js app config lib server tests",
|
||||
"format:js": "prettier --write \"{app,config,lib,server,tests}/**/*.js\" ./*.js ./.*.js",
|
||||
"start": "ember serve",
|
||||
"test": "ember test",
|
||||
"test:view": "ember test --server",
|
||||
"precommit": "lint-staged",
|
||||
"postinstall": "rsync -aq ./node_modules/@hashicorp/consul-api-double/ ./public/consul-api-double/"
|
||||
"test:sync": "rsync -aq ./node_modules/@hashicorp/consul-api-double/ ./public/consul-api-double/",
|
||||
"test": "yarn run test:sync;ember test",
|
||||
"test:view": "yarn run test:sync;ember test --server",
|
||||
"precommit": "lint-staged"
|
||||
},
|
||||
"lint-staged": {
|
||||
"{app,config,lib,server,tests}/**/*.js": [
|
||||
|
|
@ -89,5 +89,10 @@
|
|||
},
|
||||
"engines": {
|
||||
"node": "^4.5 || 6.* || >= 7.*"
|
||||
},
|
||||
"ember-addon": {
|
||||
"paths": [
|
||||
"lib/startup"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
18
ui-v2/tests/acceptance/startup.feature
Normal file
18
ui-v2/tests/acceptance/startup.feature
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
@setupApplicationTest
|
||||
Feature: startup
|
||||
In order to give users an indication as early as possible that they are at the right place
|
||||
As a user
|
||||
I should be able to see a startup logo
|
||||
@ignore
|
||||
Scenario: When loading the index.html file into a browser
|
||||
Given 1 datacenter model with the value "dc-1"
|
||||
Then the url should be ''
|
||||
Then "html" has the "ember-loading" class
|
||||
When I visit the services page for yaml
|
||||
---
|
||||
dc: dc-1
|
||||
---
|
||||
Then the url should be /dc-1/services
|
||||
Then "html" doesn't have the "ember-loading" class
|
||||
|
||||
|
||||
10
ui-v2/tests/acceptance/steps/startup-steps.js
Normal file
10
ui-v2/tests/acceptance/steps/startup-steps.js
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
import steps from './steps';
|
||||
|
||||
// step definitions that are shared between features should be moved to the
|
||||
// tests/acceptance/steps/steps.js file
|
||||
|
||||
export default function(assert) {
|
||||
return steps(assert).then('I should find a file', function() {
|
||||
assert.ok(true, this.step);
|
||||
});
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<html class="{{content-for "root-class"}}">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
|
|
|
|||
|
|
@ -179,7 +179,11 @@ export default function(assert) {
|
|||
assert.equal(request.url, url, `Expected the request url to be ${url}, was ${request.url}`);
|
||||
})
|
||||
.then('the url should be $url', function(url) {
|
||||
const current = currentURL();
|
||||
// TODO: nice! $url should be wrapped in ""
|
||||
if (url === "''") {
|
||||
url = '';
|
||||
}
|
||||
const current = currentURL() || '';
|
||||
assert.equal(current, url, `Expected the url to be ${url} was ${current}`);
|
||||
})
|
||||
.then(['I see $num $model', 'I see $num $model model', 'I see $num $model models'], function(
|
||||
|
|
@ -279,6 +283,15 @@ export default function(assert) {
|
|||
`Expected to see "${text}" in "${selector}"`
|
||||
);
|
||||
})
|
||||
// TODO: Think of better language
|
||||
// TODO: These should be mergeable
|
||||
.then(['"$selector" has the "$class" class'], function(selector, cls) {
|
||||
// because `find` doesn't work, guessing its sandboxed to ember's container
|
||||
assert.ok(document.querySelector(selector).classList.contains(cls));
|
||||
})
|
||||
.then(['"$selector" doesn\'t have the "$class" class'], function(selector, cls) {
|
||||
assert.ok(!document.querySelector(selector).classList.contains(cls));
|
||||
})
|
||||
.then('ok', function() {
|
||||
assert.ok(true);
|
||||
})
|
||||
|
|
|
|||
|
|
@ -78,10 +78,8 @@ Consul supports using TLS to verify the authenticity of servers and clients. To
|
|||
Consul requires that all clients and servers have key pairs that are generated by a single
|
||||
Certificate Authority. This can be a private CA, used only internally. The
|
||||
CA then signs keys for each of the agents, as in
|
||||
[this tutorial on generating both a CA and signing keys](http://russellsimpkins.blogspot.com/2015/10/consul-adding-tls-using-self-signed.html)
|
||||
using OpenSSL.
|
||||
|
||||
-> **Note:** Client certificates must have [Extended Key Usage](https://www.openssl.org/docs/manmaster/man5/x509v3_config.html#Extended-Key-Usage) enabled for client and server authentication.
|
||||
[this tutorial on generating both a CA and signing keys](/docs/guides/creating-certificates.html)
|
||||
using [cfssl][cfssl].
|
||||
|
||||
TLS can be used to verify the authenticity of the servers or verify the authenticity of clients.
|
||||
These modes are controlled by the [`verify_outgoing`](/docs/agent/options.html#verify_outgoing),
|
||||
|
|
@ -133,3 +131,5 @@ if applicable) to `true`.
|
|||
5. Perform another rolling restart of each agent in the cluster.
|
||||
|
||||
At this point, full TLS encryption for RPC communication should be enabled.
|
||||
|
||||
[cfssl]: https://cfssl.org/
|
||||
|
|
|
|||
198
website/source/docs/guides/creating-certificates.html.md
Normal file
198
website/source/docs/guides/creating-certificates.html.md
Normal file
|
|
@ -0,0 +1,198 @@
|
|||
---
|
||||
layout: "docs"
|
||||
page_title: "Creating Certificates"
|
||||
sidebar_current: "docs-guides-creating-certificates"
|
||||
description: |-
|
||||
Learn how to create certificates for Consul.
|
||||
---
|
||||
|
||||
# Creating Certificates
|
||||
|
||||
Correctly configuring TLS can be a complex process, especially given the wide
|
||||
range of deployment methodologies. This guide will provide you with a
|
||||
production ready TLS configuration.
|
||||
|
||||
~> Note that while Consul's TLS configuration will be production ready, key
|
||||
management and rotation is a complex subject not covered by this guide.
|
||||
[Vault][vault] is the suggested solution for key generation and management.
|
||||
|
||||
The first step to configuring TLS for Consul is generating certificates. In
|
||||
order to prevent unauthorized cluster access, Consul requires all certificates
|
||||
be signed by the same Certificate Authority (CA). This should be a _private_ CA
|
||||
and not a public one like [Let's Encrypt][letsencrypt] as any certificate
|
||||
signed by this CA will be allowed to communicate with the cluster.
|
||||
|
||||
~> Consul certificates may be signed by intermediate CAs as long as the root CA
|
||||
is the same. Append all intermediate CAs to the `cert_file`.
|
||||
|
||||
|
||||
## Reference Material
|
||||
|
||||
- [Encryption](/docs/agent/encryption.html)
|
||||
|
||||
## Estimated Time to Complete
|
||||
|
||||
20 minutes
|
||||
|
||||
## Prerequisites
|
||||
|
||||
This guide assumes you have [cfssl][cfssl] installed (be sure to install
|
||||
cfssljson as well).
|
||||
|
||||
## Steps
|
||||
|
||||
### Step 1: Create Certificate Authority
|
||||
|
||||
There are a variety of tools for managing your own CA, [like the PKI secret
|
||||
backend in Vault][vault-pki], but for the sake of simplicity this guide will
|
||||
use [cfssl][cfssl]. You can generate a private CA certificate and key with
|
||||
[cfssl][cfssl]:
|
||||
|
||||
```shell
|
||||
# Generate a default CSR
|
||||
$ cfssl print-defaults csr > ca-csr.json
|
||||
```
|
||||
Change the `key` field to use RSA with a size of 2048
|
||||
|
||||
```json
|
||||
{
|
||||
"CN": "example.net",
|
||||
"hosts": [
|
||||
"example.net",
|
||||
"www.example.net"
|
||||
],
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "US",
|
||||
"ST": "CA",
|
||||
"L": "San Francisco"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
```shell
|
||||
# Generate the CA's private key and certificate
|
||||
$ cfssl gencert -initca ca-csr.json | cfssljson -bare consul-ca
|
||||
```
|
||||
|
||||
The CA key (`consul-ca-key.pem`) will be used to sign certificates for Consul
|
||||
nodes and must be kept private. The CA certificate (`consul-ca.pem`) contains
|
||||
the public key necessary to validate Consul certificates and therefore must be
|
||||
distributed to every node that requires access.
|
||||
|
||||
### Step 2: Generate and Sign Node Certificates
|
||||
|
||||
Once you have a CA certificate and key you can generate and sign the
|
||||
certificates Consul will use directly. TLS certificates commonly use the
|
||||
fully-qualified domain name of the system being identified as the certificate's
|
||||
Common Name (CN). However, hosts (and therefore hostnames and IPs) are often
|
||||
ephemeral in Consul clusters. Not only would signing a new certificate per
|
||||
Consul node be difficult, but using a hostname provides no security or
|
||||
functional benefits to Consul. To fulfill the desired security properties
|
||||
(above) Consul certificates are signed with their region and role such as:
|
||||
|
||||
* `client.node.global.consul` for a client node in the `global` region
|
||||
* `server.node.us-west.consul` for a server node in the `us-west` region
|
||||
|
||||
To create certificates for the client and server in the cluster with
|
||||
[cfssl][cfssl], create the following configuration file as `cfssl.json` to increase the default certificate expiration time:
|
||||
|
||||
```json
|
||||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "87600h",
|
||||
"usages": [
|
||||
"signing",
|
||||
"key encipherment",
|
||||
"server auth",
|
||||
"client auth"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
```shell
|
||||
# Generate a certificate for the Consul server
|
||||
$ echo '{"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=consul-ca.pem -ca-key=consul-ca-key.pem -config=cfssl.json \
|
||||
-hostname="server.node.global.consul,localhost,127.0.0.1" - | cfssljson -bare server
|
||||
|
||||
# Generate a certificate for the Consul client
|
||||
$ echo '{"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=consul-ca.pem -ca-key=consul-ca-key.pem -config=cfssl.json \
|
||||
-hostname="client.node.global.consul,localhost,127.0.0.1" - | cfssljson -bare client
|
||||
|
||||
# Generate a certificate for the CLI
|
||||
$ echo '{"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=consul-ca.pem -ca-key=consul-ca-key.pem -profile=client \
|
||||
- | cfssljson -bare cli
|
||||
```
|
||||
|
||||
Using `localhost` and `127.0.0.1` as subject alternate names (SANs) allows
|
||||
tools like `curl` to be able to communicate with Consul's HTTP API when run on
|
||||
the same host. Other SANs may be added including a DNS resolvable hostname to
|
||||
allow remote HTTP requests from third party tools.
|
||||
|
||||
You should now have the following files:
|
||||
|
||||
* `cfssl.json` - cfssl configuration.
|
||||
* `consul-ca.csr` - CA signing request.
|
||||
* `consul-ca-key.pem` - CA private key. Keep safe!
|
||||
* `consul-ca.pem` - CA public certificate.
|
||||
* `cli.csr` - Consul CLI certificate signing request.
|
||||
* `cli-key.pem` - Consul CLI private key.
|
||||
* `cli.pem` - Consul CLI certificate.
|
||||
* `client.csr` - Consul client node certificate signing request for the `global` region.
|
||||
* `client-key.pem` - Consul client node private key for the `global` region.
|
||||
* `client.pem` - Consul client node public certificate for the `global` region.
|
||||
* `server.csr` - Consul server node certificate signing request for the `global` region.
|
||||
* `server-key.pem` - Consul server node private key for the `global` region.
|
||||
* `server.pem` - Consul server node public certificate for the `global` region.
|
||||
|
||||
Each Consul node should have the appropriate key (`-key.pem`) and certificate
|
||||
(`.pem`) file for its region and role. In addition each node needs the CA's
|
||||
public certificate (`consul-ca.pem`).
|
||||
|
||||
Please note you will need the keys for the CLI if you choose to disable
|
||||
HTTP (in which case running the command `consul members` will return an error).
|
||||
This is because the Consul CLI defaults to communicating via HTTP instead of
|
||||
HTTPS. We can configure the local Consul client to connect using TLS and specify
|
||||
our custom keys and certificates using the command line:
|
||||
|
||||
```shell
|
||||
$ consul members -ca-file=consul-ca.pem -client-cert=cli.pem -client-key=cli-key.pem -http-addr="https://localhost:9090"
|
||||
```
|
||||
(The command is assuming HTTPS is configured to use port 9090. To see how
|
||||
you can change this, visit the [Configuration](/docs/agent/options.html) page)
|
||||
|
||||
This process can be cumbersome to type each time, so the Consul CLI also
|
||||
searches environment variables for default values. Set the following
|
||||
environment variables in your shell:
|
||||
|
||||
```shell
|
||||
$ export CONSUL_HTTP_ADDR=https://localhost:9090
|
||||
$ export CONSUL_CACERT=consul-ca.pem
|
||||
$ export CONSUL_CLIENT_CERT=cli.pem
|
||||
$ export CONSUL_CLIENT_KEY=cli-key.pem
|
||||
```
|
||||
|
||||
* `CONSUL_HTTP_ADDR` is the URL of the Consul agent and sets the default for
|
||||
`-http-addr`.
|
||||
* `CONSUL_CACERT` is the location of your CA certificate and sets the default
|
||||
for `-ca-file`.
|
||||
* `CONSUL_CLIENT_CERT` is the location of your CLI certificate and sets the
|
||||
default for `-client-cert`.
|
||||
* `CONSUL_CLIENT_KEY` is the location of your CLI key and sets the default for
|
||||
`-client-key`.
|
||||
|
||||
After these environment variables are correctly configured, the CLI will
|
||||
respond as expected.
|
||||
|
||||
[cfssl]: https://cfssl.org/
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[vault]: https://www.vaultproject.io/
|
||||
[vault-pki]: https://www.vaultproject.io/docs/secrets/pki/index.html
|
||||
|
|
@ -236,6 +236,10 @@
|
|||
<li<%= sidebar_current("docs-guides-consul-containers") %>>
|
||||
<a href="/docs/guides/consul-containers.html">Consul with Containers</a>
|
||||
</li>
|
||||
<li<%= sidebar_current("docs-guides-creating-certificates") %>>
|
||||
<a href="/docs/guides/creating-certificates.html">Creating
|
||||
Certificates</a>
|
||||
</li>
|
||||
<li<%= sidebar_current("docs-guides-dns-cache") %>>
|
||||
<a href="/docs/guides/dns-cache.html">DNS Caching</a>
|
||||
</li>
|
||||
|
|
|
|||
Loading…
Reference in a new issue