mirror of https://github.com/hashicorp/consul
Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>pull/20473/head
parent
43a338256e
commit
ea8464203b
|
@ -14,7 +14,7 @@ This topic provides reference information about the Consul's deployment architec
|
|||
|
||||
## Components
|
||||
|
||||
Consul starts several components and containers inside the ECS cluster. Using a combination of short-lived and long-lived containers (`mesh-init` and `health-sync` respectively) ensures that any long running containers do not have root access to Consul. Refer to [Startup sequence](#startup-sequence) for details about the order of the startup procedure:
|
||||
Consul starts several components and containers inside the ECS cluster. Using a combination of short-lived containers (`mesh-init`) and long-lived containers (`health-sync`) ensures that any long running containers do not have root access to Consul. Refer to [Startup sequence](#startup-sequence) for details about the order of the startup procedure.
|
||||
|
||||
### `mesh-init` container
|
||||
|
||||
|
@ -24,19 +24,19 @@ The `mesh-init` container is a short-lived container that performs the following
|
|||
- Communicates directly with Consul server
|
||||
- Registers proxies and services
|
||||
- Creates a bootstrap configuration file for Consul dataplane container and stores it in a shared volume
|
||||
- Invoke the `iptables` SDK to configure traffic redirection rules
|
||||
- Invokes the `iptables` SDK to configure traffic redirection rules
|
||||
|
||||
### `health-sync` container
|
||||
|
||||
The `mesh-init` container is a long-lived container that performs the following actions:
|
||||
The `health-sync` container is a long-lived container that performs the following actions:
|
||||
|
||||
- Synchronizes ECS health checks
|
||||
- Watches the Consul server for changes
|
||||
|
||||
When you stop the ECS task, it performs the following actions:
|
||||
|
||||
- Deregister service and proxy instances on receiving SIGTERM to support graceful shutdown.
|
||||
- ACL logout
|
||||
- Deregisters service and proxy instances on receiving SIGTERM to support graceful shutdown
|
||||
- Performs logout from [ACL auth method](/consul/docs/security/acl/auth-methods)
|
||||
|
||||
### `dataplane` container
|
||||
|
||||
|
@ -60,13 +60,14 @@ One ECS task in the cluster contains the controller container, which performs th
|
|||
|
||||
Deploying Consul to ECS starts the following process to build the architecture:
|
||||
|
||||
1. The `mesh-init` container starts and logs into Consul.
|
||||
1. The `mesh-init` container starts and logs in to Consul.
|
||||
1. The `mesh-init` container registers services and proxies with the Consul servers.
|
||||
1. The `mesh-init` container writes the bootstrap configuration for the Consul dataplane process and stores it in a shared volume.
|
||||
1. The `mesh-init` container configures Consul DNS and modifies traffic redirection rules.
|
||||
1. The `dataplane` container starts and configures itself using the bootstrap configuration generated by the `mesh-init` container.
|
||||
1. The `dataplane` container starts the Envoy sidecar proxy.
|
||||
1. The `health-sync` container starts listening for ECS health checks.
|
||||
1. When the ECS task indicates that the application instance is healthy, the `health-sync` container marks the service as healthy and starts allowing traffic to flow.
|
||||
1. When the ECS task indicates that the application instance is healthy, the `health-sync` container marks the service as healthy and allows traffic to flow.
|
||||
|
||||
## Consul security components
|
||||
|
||||
|
|
|
@ -11,7 +11,7 @@ For every release of Consul on ECS, the `consul-ecs` binary and `consul-ecs` Ter
|
|||
|
||||
## Supported Consul versions
|
||||
|
||||
| Consul Version | Compatible consul-ecs Version |
|
||||
| `consul` version | Compatible `consul-ecs` version |
|
||||
|----------------------- | ----------------------------- |
|
||||
| 1.18.x | 0.8.x |
|
||||
| 1.16.x 1.17.x | 0.7.x |
|
||||
|
|
|
@ -25,7 +25,7 @@ The `mesh-task` Terraform module provides input variables for commonly used fiel
|
|||
| `consul_namespace` | [`service.namespace`](#service) |
|
||||
| `consul_partition` | [`service.partition`](#service) |
|
||||
|
||||
Each of these Terraform input variables follow the Consul ECS config schema. The remaining fields of the Consul ECS configuration not listed in this table can be passed using the `consul_ecs_config` input variable.
|
||||
Each of these Terraform input variables follows the Consul ECS configuration schema. The remaining fields of the Consul ECS configuration that are not listed in this table can be passed using the `consul_ecs_config` input variable.
|
||||
|
||||
# Top-level fields
|
||||
|
||||
|
|
|
@ -23,7 +23,7 @@ Consul on ECS supports the following environments, runtimes, and capabilities:
|
|||
- **Admin partitions:** <EnterpriseAlert inline/> Enable ACLs and configure the ECS controller to use admin partitions. You must deploy one controller for each admin partition.
|
||||
- **Namespaces:** <EnterpriseAlert inline/> Enable ACLs and configure the ECS controller to use namespaces.
|
||||
- **Dataplane containers:** To manage proxies using Consul dataplane, you must use the Terraform `mesh-task` module to install Consul service mesh.
|
||||
- **Transparent proxy:** Consul on ECS 0.8.x supports transparent proxy for ECS on EC2 tasks. Transparent proxy in ECS requires the host to `NET_ADMIN` capabilities, which ECS Fargate does not currently support. You can enable transparent proxy with the `enable_transparent_proxy` parameter in the `mesh-task` Terraform module or through `ecs_config_json`. The `enable_transparent_proxy` parameter will have precedence over `ecs_config_json`.
|
||||
- **Transparent proxy:** Consul on ECS 0.8.x supports transparent proxy for ECS on EC2 tasks. Transparent proxy in ECS requires the host to have `NET_ADMIN` capabilities, which ECS Fargate does not currently support. You can enable transparent proxy with the `enable_transparent_proxy` parameter in the `mesh-task` Terraform module or through `ecs_config_json`. The `enable_transparent_proxy` parameter has precedence over `ecs_config_json`.
|
||||
|
||||
Refer to the [Consul ECS GitHub repository](https://github.com/hashicorp/terraform-aws-consul-ecs/tree/main/examples/dev-server-ec2-transparent-proxy) for examples of how to use transparent proxy with Consul on ECS.
|
||||
|
||||
|
|
Loading…
Reference in New Issue