68 KiB
layout | page_title | sidebar_current | description |
---|---|---|---|
docs | Configuration | docs-agent-config | The agent has various configuration options that can be specified via the command-line or via configuration files. All of the configuration options are completely optional. Defaults are specified with their descriptions. |
Configuration
The agent has various configuration options that can be specified via the command-line or via configuration files. All of the configuration options are completely optional. Defaults are specified with their descriptions.
When loading configuration, Consul loads the configuration from files
and directories in lexical order. For example, configuration file basic_config.json
will be processed before extra_config.json
. Configuration specified later
will be merged into configuration specified earlier. In most cases,
"merge" means that the later version will override the earlier. In
some cases, such as event handlers, merging appends the handlers to the
existing configuration. The exact merging behavior is specified for each
option below.
Consul also supports reloading configuration when it receives the SIGHUP signal. Not all changes are respected, but those that are are documented below in the Reloadable Configuration section. The reload command can also be used to trigger a configuration reload.
Command-line Options
The options below are all specified on the command-line.
-
-advertise
- The advertise address is used to change the address that we advertise to other nodes in the cluster. By default, the-bind
address is advertised. However, in some cases, there may be a routable address that cannot be bound. This flag enables gossiping a different address to support this. If this address is not routable, the node will be in a constant flapping state as other nodes will treat the non-routability as a failure. -
-advertise-wan
- The advertise WAN address is used to change the address that we advertise to server nodes joining through the WAN. This can also be set on client agents when used in combination with thetranslate_wan_addrs
configuration option. By default, the-advertise
address is advertised. However, in some cases all members of all datacenters cannot be on the same physical or virtual network, especially on hybrid setups mixing cloud and private datacenters. This flag enables server nodes gossiping through the public network for the WAN while using private VLANs for gossiping to each other and their client agents, and it allows client agents to be reached at this address when being accessed from a remote datacenter if the remote datacenter is configured withtranslate_wan_addrs
.
~> Notice: The hosted version of Consul Enterprise will be deprecated on March 7th, 2017. For details, see https://atlas.hashicorp.com/help/consul/alternatives
-
-atlas
- This flag enables Atlas integration. It is used to provide the Atlas infrastructure name and the SCADA connection. The format of this isusername/environment
. This enables Atlas features such as the Monitoring UI and node auto joining. -
-atlas-join
- When set, enables auto-join via Atlas. Atlas will track the most recent members to join the infrastructure named by-atlas
and automatically join them on start. For servers, the LAN and WAN pool are both joined. -
-atlas-token
- Provides the Atlas API authentication token. This can also be provided using theATLAS_TOKEN
environment variable. Required for use with Atlas. -
-atlas-endpoint
- The endpoint address used for Atlas integration. Used only if the-atlas
and-atlas-token
options are specified. This is optional, and defaults to the public Atlas endpoints. This can also be specified using theSCADA_ENDPOINT
environment variable. The CLI option takes precedence, followed by the configuration file directive, and lastly, the environment variable. -
-bootstrap
- This flag is used to control if a server is in "bootstrap" mode. It is important that no more than one server per datacenter be running in this mode. Technically, a server in bootstrap mode is allowed to self-elect as the Raft leader. It is important that only a single node is in this mode; otherwise, consistency cannot be guaranteed as multiple nodes are able to self-elect. It is not recommended to use this flag after a cluster has been bootstrapped. -
-bootstrap-expect
- This flag provides the number of expected servers in the datacenter. Either this value should not be provided or the value must agree with other servers in the cluster. When provided, Consul waits until the specified number of servers are available and then bootstraps the cluster. This allows an initial leader to be elected automatically. This cannot be used in conjunction with the legacy-bootstrap
flag. This flag implies server mode. -
-bind
- The address that should be bound to for internal cluster communications. This is an IP address that should be reachable by all other nodes in the cluster. By default, this is "0.0.0.0", meaning Consul will bind to all addresses on the local machine and will advertise the first available private IPv4 address to the rest of the cluster. If there are multiple private IPv4 addresses available, Consul will exit with an error at startup. If you specify "[::]", Consul will advertise the first available public IPv6 address. If there are multiple public IPv6 addresses available, Consul will exit with an error at startup. Consul uses both TCP and UDP and the same port for both. If you have any firewalls, be sure to allow both protocols. -
-serf-wan-bind
- The address that should be bound to for Serf WAN gossip communications. By default, the value follows the same rules as-bind
command-line flag, and if this is not specified, the-bind
option is used. This is available in Consul 0.7.1 and later. -
-serf-lan-bind
- The address that should be bound to for Serf LAN gossip communications. This is an IP address that should be reachable by all other LAN nodes in the cluster. By default, the value follows the same rules as-bind
command-line flag, and if this is not specified, the-bind
option is used. This is available in Consul 0.7.1 and later. -
-client
- The address to which Consul will bind client interfaces, including the HTTP and DNS servers. By default, this is "127.0.0.1", allowing only loopback connections. -
-config-file
- A configuration file to load. For more information on the format of this file, read the Configuration Files section. This option can be specified multiple times to load multiple configuration files. If it is specified multiple times, configuration files loaded later will merge with configuration files loaded earlier. During a config merge, single-value keys (string, int, bool) will simply have their values replaced while list types will be appended together. -
-config-dir
- A directory of configuration files to load. Consul will load all files in this directory with the suffix ".json". The load order is alphabetical, and the the same merge routine is used as with theconfig-file
option above. This option can be specified multiple times to load multiple directories. Sub-directories of the config directory are not loaded. For more information on the format of the configuration files, see the Configuration Files section. -
-data-dir
- This flag provides a data directory for the agent to store state. This is required for all agents. The directory should be durable across reboots. This is especially critical for agents that are running in server mode as they must be able to persist cluster state. Additionally, the directory must support the use of filesystem locking, meaning some types of mounted folders (e.g. VirtualBox shared folders) may not be suitable. -
-dev
- Enable development server mode. This is useful for quickly starting a Consul agent with all persistence options turned off, enabling an in-memory server which can be used for rapid prototyping or developing against the API. This mode is not intended for production use as it does not write any data to disk. -
-datacenter
- This flag controls the datacenter in which the agent is running. If not provided, it defaults to "dc1". Consul has first-class support for multiple datacenters, but it relies on proper configuration. Nodes in the same datacenter should be on a single LAN. -
-dns-port
- the DNS port to listen on. This overrides the default port 8600. This is available in Consul 0.7 and later. -
-domain
- By default, Consul responds to DNS queries in the "consul." domain. This flag can be used to change that domain. All queries in this domain are assumed to be handled by Consul and will not be recursively resolved. -
-encrypt
- Specifies the secret key to use for encryption of Consul network traffic. This key must be 16-bytes that are Base64-encoded. The easiest way to create an encryption key is to useconsul keygen
. All nodes within a cluster must share the same encryption key to communicate. The provided key is automatically persisted to the data directory and loaded automatically whenever the agent is restarted. This means that to encrypt Consul's gossip protocol, this option only needs to be provided once on each agent's initial startup sequence. If it is provided after Consul has been initialized with an encryption key, then the provided key is ignored and a warning will be displayed. -
-http-port
- the HTTP API port to listen on. This overrides the default port 8500. This option is very useful when deploying Consul to an environment which communicates the HTTP port through the environment e.g. PaaS like CloudFoundry, allowing you to set the port directly via a Procfile. -
-join
- Address of another agent to join upon starting up. This can be specified multiple times to specify multiple agents to join. If Consul is unable to join with any of the specified addresses, agent startup will fail. By default, the agent won't join any nodes when it starts up. -
-retry-join
- Similar to-join
but allows retrying a join if the first attempt fails. The list should contain IPv4 addresses with optional Serf LAN port number also specified or bracketed IPv6 addresses with optional port number — for example:[::1]:8301
. This is useful for cases where we know the address will become available eventually. -
-retry-join-ec2-tag-key
- The Amazon EC2 instance tag key to filter on. When used with-retry-join-ec2-tag-value
, Consul will attempt to join EC2 instances with the given tag key and value on startup.
For AWS authentication the following methods are supported, in order:- Static credentials (from the config file)
- Environment variables (
AWS_ACCESS_KEY_ID
andAWS_SECRET_ACCESS_KEY
) - Shared credentials file (
~/.aws/credentials
or the path specified byAWS_SHARED_CREDENTIALS_FILE
) - ECS task role metadata (container-specific).
- EC2 instance role metadata.
The only required IAM permission is
ec2:DescribeInstances
, and it is recommended you make a dedicated key used only for auto-joining. -
-retry-join-ec2-tag-value
- The Amazon EC2 instance tag value to filter on. -
-retry-join-ec2-region
- (Optional) The Amazon EC2 region to use. If not specified, Consul will use the local instance's EC2 metadata endpoint to discover the region. -
-retry-join-gce-tag-value
- A Google Compute Engine instance tag to filter on. Much like the-retry-join-ec2-*
options, this gives Consul the option of doing server discovery on Google Compute Engine by searching the tags assigned to any particular instance. -
-retry-join-gce-project-name
- The project to search in for the tag supplied by-retry-join-gce-tag-value
. If this is run from within a GCE instance, the default is the project the instance is located in. -
-retry-join-gce-zone-pattern
- A regular expression that indicates the zones the tag should be searched in. For example, whileus-west1-a
would only search inus-west1-a
,us-west1-.*
would search inus-west1-a
andus-west1-b
. The default is to search globally. -
-retry-join-gce-credentials-file
- The path to the JSON credentials file of the GCE Service Account that will be used to search for instances. Note that this can also reside in the following locations:- A path supplied by the
GOOGLE_APPLICATION_CREDENTIALS
environment variable - The
%APPDATA%/gcloud/application_default_credentials.json
file (Windows) or$HOME/.config/gcloud/application_default_credentials.json
(Linux and other systems) - If none of these exist and discovery is being run from a GCE instance, the instance's configured service account will be used.
- A path supplied by the
-
-retry-interval
- Time to wait between join attempts. Defaults to 30s. -
-retry-max
- The maximum number of-join
attempts to be made before exiting with return code 1. By default, this is set to 0 which is interpreted as infinite retries. -
-join-wan
- Address of another wan agent to join upon starting up. This can be specified multiple times to specify multiple WAN agents to join. If Consul is unable to join with any of the specified addresses, agent startup will fail. By default, the agent won't-join-wan
any nodes when it starts up. -
-retry-join-wan
- Similar toretry-join
but allows retrying a wan join if the first attempt fails. This is useful for cases where we know the address will become available eventually. -
-retry-interval-wan
- Time to wait between-join-wan
attempts. Defaults to 30s. -
-retry-max-wan
- The maximum number of-join-wan
attempts to be made before exiting with return code 1. By default, this is set to 0 which is interpreted as infinite retries. -
-log-level
- The level of logging to show after the Consul agent has started. This defaults to "info". The available log levels are "trace", "debug", "info", "warn", and "err". You can always connect to an agent viaconsul monitor
and use any log level. Also, the log level can be changed during a config reload. -
-node
- The name of this node in the cluster. This must be unique within the cluster. By default this is the hostname of the machine. -
-node-id
- Available in Consul 0.7.3 and later, this is a unique identifier for this node across all time, even if the name of the node or address changes. This must be in the form of a hex string, 36 characters long, such asadf4238a-882b-9ddc-4a9d-5b6758e4159e
. If this isn't supplied, which is the most common case, then the agent will generate an identifier at startup and persist it in the data directory so that it will remain the same across agent restarts. This is currently only exposed via /v1/agent/self, /v1/catalog, and /v1/health endpoints, but future versions of Consul will use this to better manage cluster changes, especially for Consul servers. -
-node-meta
- Available in Consul 0.7.3 and later, this specifies an arbitrary metadata key/value pair to associate with the node, of the formkey:value
. This can be specified multiple times. Node metadata pairs have the following restrictions:- A maximum of 64 key/value pairs can be registered per node.
- Metadata keys must be between 1 and 128 characters (inclusive) in length
- Metadata keys must contain only alphanumeric,
-
, and_
characters. - Metadata keys must not begin with the
consul-
prefix; that is reserved for internal use by Consul. - Metadata values must be between 0 and 512 (inclusive) characters in length.
-
-pid-file
- This flag provides the file path for the agent to store its PID. This is useful for sending signals (for example,SIGINT
to close the agent orSIGHUP
to update check definite -
-protocol
- The Consul protocol version to use. This defaults to the latest version. This should be set only when upgrading. You can view the protocol versions supported by Consul by runningconsul -v
. -
-raft-protocol
- This controls the internal version of the Raft consensus protocol used for server communications. This defaults to 2 but must be set to 3 in order to gain access to Autopilot features, with the exception ofcleanup_dead_servers
. -
-recursor
- Specifies the address of an upstream DNS server. This option may be provided multiple times, and is functionally equivalent to therecursors
configuration option. -
-rejoin
- When provided, Consul will ignore a previous leave and attempt to rejoin the cluster when starting. By default, Consul treats leave as a permanent intent and does not attempt to join the cluster again when starting. This flag allows the previous state to be used to rejoin the cluster. -
-server
- This flag is used to control if an agent is in server or client mode. When provided, an agent will act as a Consul server. Each Consul cluster must have at least one server and ideally no more than 5 per datacenter. All servers participate in the Raft consensus algorithm to ensure that transactions occur in a consistent, linearizable manner. Transactions modify cluster state, which is maintained on all server nodes to ensure availability in the case of node failure. Server nodes also participate in a WAN gossip pool with server nodes in other datacenters. Servers act as gateways to other datacenters and forward traffic as appropriate. -
-non-voting-server
- (Enterprise-only) This flag is used to make the server not participate in the Raft quorum, and have it only receive the data replication stream. This can be used to add read scalability to a cluster in cases where a high volume of reads to servers are needed. -
-syslog
- This flag enables logging to syslog. This is only supported on Linux and OSX. It will result in an error if provided on Windows. -
-ui
- Enables the built-in web UI server and the required HTTP routes. This eliminates the need to maintain the Consul web UI files separately from the binary. -
-ui-dir
- This flag provides the directory containing the Web UI resources for Consul. This will automatically enable the Web UI. The directory must be readable to the agent. Starting with Consul version 0.7.0 and later, the Web UI assets are included in the binary so this flag is no longer necessary; specifying only the-ui
flag is enough to enable the Web UI.
Configuration Files
In addition to the command-line options, configuration can be put into files. This may be easier in certain situations, for example when Consul is being configured using a configuration management system.
The configuration files are JSON formatted, making them easily readable and editable by both humans and computers. The configuration is formatted as a single JSON object with configuration within it.
Configuration files are used for more than just setting up the agent, they are also used to provide check and service definitions. These are used to announce the availability of system servers to the rest of the cluster. They are documented separately under check configuration and service configuration respectively. The service and check definitions support being updated during a reload.
Example Configuration File
{
"datacenter": "east-aws",
"data_dir": "/opt/consul",
"log_level": "INFO",
"node_name": "foobar",
"server": true,
"watches": [
{
"type": "checks",
"handler": "/usr/bin/health-check-handler.sh"
}
],
"telemetry": {
"statsite_address": "127.0.0.1:2180"
}
}
Example Configuration File, with TLS
{
"datacenter": "east-aws",
"data_dir": "/opt/consul",
"log_level": "INFO",
"node_name": "foobar",
"server": true,
"addresses": {
"https": "0.0.0.0"
},
"ports": {
"https": 8080
},
"key_file": "/etc/pki/tls/private/my.key",
"cert_file": "/etc/pki/tls/certs/my.crt",
"ca_file": "/etc/pki/tls/certs/ca-bundle.crt"
}
See, especially, the use of the ports
setting:
"ports": {
"https": 8080
}
Consul will not enable TLS for the HTTP API unless the https
port has been assigned a port number > 0
.
Configuration Key Reference
-
acl_datacenter
- Only used by servers. This designates the datacenter which is authoritative for ACL information. It must be provided to enable ACLs. All servers and datacenters must agree on the ACL datacenter. Setting it on the servers is all you need for enforcement, but for the APIs to forward properly from the clients, it must be set on them too. Future changes may move enforcement to the edges, so it's best to just setacl_datacenter
on all nodes. -
acl_default_policy
- Either "allow" or "deny"; defaults to "allow". The default policy controls the behavior of a token when there is no matching rule. In "allow" mode, ACLs are a blacklist: any operation not specifically prohibited is allowed. In "deny" mode, ACLs are a whitelist: any operation not specifically allowed is blocked. -
acl_down_policy
- Either "allow", "deny" or "extend-cache"; "extend-cache" is the default. In the case that the policy for a token cannot be read from theacl_datacenter
or leader node, the down policy is applied. In "allow" mode, all actions are permitted, "deny" restricts all operations, and "extend-cache" allows any cached ACLs to be used, ignoring their TTL values. If a non-cached ACL is used, "extend-cache" acts like "deny". -
acl_agent_master_token
- Used to access agent endpoints that require agent read or write privileges even if Consul servers aren't present to validate any tokens. This should only be used by operators during outages, regular ACL tokens should normally be used by applications. This was added in Consul 0.7.2 and is only used whenacl_enforce_version_8
is set to true. -
acl_agent_token
- Used for clients and servers to perform internal operations to the service catalog. If this isn't specified, then theacl_token
will be used. This was added in Consul 0.7.2.
This token must at least have write access to the node name it will register as in order to set any of the node-level information in the catalog such as metadata, or the node's tagged addresses. -
acl_enforce_version_8
- Used for clients and servers to determine if enforcement should occur for new ACL policies being previewed before Consul 0.8. Added in Consul 0.7.2, this will default to false in versions of Consul prior to 0.8, and will default to true in Consul 0.8 and later. This helps ease the transition to the new ACL features by allowing policies to be in place before enforcement begins. Please see the ACL internals guide for more details. -
acl_master_token
- Only used for servers in theacl_datacenter
. This token will be created with management-level permissions if it does not exist. It allows operators to bootstrap the ACL system with a token ID that is well-known.
Theacl_master_token
is only installed when a server acquires cluster leadership. If you would like to install or change theacl_master_token
, set the new value foracl_master_token
in the configuration for all servers. Once this is done, restart the current leader to force a leader election. If theacl_master_token
is not supplied, then the servers do not create a master token. When you provide a value, it can be any string value. Using a UUID would ensure that it looks the same as the other tokens, but isn't strictly necessary. -
acl_replication_token
- Only used for servers outside theacl_datacenter
running Consul 0.7 or later. When provided, this will enable ACL replication using this token to retrieve and replicate the ACLs to the non-authoritative local datacenter.
If there's a partition or other outage affecting the authoritative datacenter, and theacl_down_policy
is set to "extend-cache", tokens not in the cache can be resolved during the outage using the replicated set of ACLs. Please see the ACL replication section of the internals guide for more details. -
acl_token
- When provided, the agent will use this token when making requests to the Consul servers. Clients can override this token on a per-request basis by providing the "?token" query parameter. When not provided, the empty token, which maps to the 'anonymous' ACL policy, is used. -
acl_ttl
- Used to control Time-To-Live caching of ACLs. By default, this is 30 seconds. This setting has a major performance impact: reducing it will cause more frequent refreshes while increasing it reduces the number of caches. However, because the caches are not actively invalidated, ACL policy may be stale up to the TTL value. -
addresses
- This is a nested object that allows setting bind addresses.
http
supports binding to a Unix domain socket. A socket can be specified in the formunix:///path/to/socket
. A new domain socket will be created at the given path. If the specified file path already exists, Consul will attempt to clear the file and create the domain socket in its place. The permissions of the socket file are tunable via theunix_sockets
config construct.
When running Consul agent commands against Unix socket interfaces, use the-http-addr
argument to specify the path to the socket. You can also place the desired values in theCONSUL_HTTP_ADDR
environment variable.
For TCP addresses, the variable values should be an IP address with the port. For example:10.0.0.1:8500
and not10.0.0.1
. However, ports are set separately in theports
structure when defining them in a configuration file.
The following keys are valid:dns
- The DNS server. Defaults toclient_addr
http
- The HTTP API. Defaults toclient_addr
https
- The HTTPS API. Defaults toclient_addr
-
advertise_addr
Equivalent to the-advertise
command-line flag. -
serf_wan_bind
Equivalent to the-serf-wan-bind
command-line flag. -
serf_lan_bind
Equivalent to the-serf-lan-bind
command-line flag. -
advertise_addrs
Allows to set the advertised addresses for SerfLan, SerfWan and RPC together with the port. This gives you more control than-advertise
or-advertise-wan
while it serves the same purpose. These settings might override-advertise
or-advertise-wan
This is a nested setting that allows the following keys:serf_lan
- The SerfLan address. Accepts values in the form of "host:port" like "10.23.31.101:8301".serf_wan
- The SerfWan address. Accepts values in the form of "host:port" like "10.23.31.101:8302".rpc
- The server RPC address. Accepts values in the form of "host:port" like "10.23.31.101:8300".
-
advertise_addr_wan
Equivalent to the-advertise-wan
command-line flag. -
atlas_acl_token
When provided, any requests made by Atlas will use this ACL token unless explicitly overridden. When not provided theacl_token
is used. This can be set to 'anonymous' to reduce permission below that ofacl_token
. -
atlas_infrastructure
Equivalent to the-atlas
command-line flag. -
atlas_join
Equivalent to the-atlas-join
command-line flag. -
atlas_token
Equivalent to the-atlas-token
command-line flag. -
atlas_endpoint
Equivalent to the-atlas-endpoint
command-line flag. -
atlas_endpoint
Equivalent to the-atlas-endpoint
command-line flag. -
autopilot
Added in Consul 0.8, this object allows a number of sub-keys to be set which can configure operator-friendly settings for Consul servers. For more information about Autopilot, see the Autopilot Guide.
The following sub-keys are available:-
cleanup_dead_servers
- This controls the automatic removal of dead server nodes periodically and whenever a new server is added to the cluster. Defaults totrue
. -
last_contact_threshold
- Controls the maximum amount of time a server can go without contact from the leader before being considered unhealthy. Must be a duration value such as10s
. Defaults to200ms
. -
max_trailing_threshold
- Controls the maximum number of log entries that a server can trail the leader by before being considered unhealthy. Defaults to 250. -
server_stabilization_time
- Controls the minimum amount of time a server must be stable in the 'healthy' state before being added to the cluster. Only takes effect if all servers are running Raft protocol version 3 or higher. Must be a duration value such as30s
. Defaults to10s
. -
redundancy_zone_tag
- (Enterprise-only) This controls the-node-meta
key to use when Autopilot is separating servers into zones for redundancy. Only one server in each zone can be a voting member at one time. If left blank (the default), this feature will be disabled. -
disable_upgrade_migration
- (Enterprise-only) If set totrue
, this setting will disable Autopilot's upgrade migration strategy in Consul Enterprise of waiting until enough newer-versioned servers have been added to the cluster before promoting any of them to voters. Defaults tofalse
.
-
-
bootstrap
Equivalent to the-bootstrap
command-line flag. -
bootstrap_expect
Equivalent to the-bootstrap-expect
command-line flag. -
bind_addr
Equivalent to the-bind
command-line flag. -
ca_file
This provides a file path to a PEM-encoded certificate authority. The certificate authority is used to check the authenticity of client and server connections with the appropriateverify_incoming
orverify_outgoing
flags. -
cert_file
This provides a file path to a PEM-encoded certificate. The certificate is provided to clients or servers to verify the agent's authenticity. It must be provided along withkey_file
. -
check_update_interval
This interval controls how often check output from checks in a steady state is synchronized with the server. By default, this is set to 5 minutes ("5m"). Many checks which are in a steady state produce slightly different output per run (timestamps, etc) which cause constant writes. This configuration allows deferring the sync of check output for a given interval to reduce write pressure. If a check ever changes state, the new state and associated output is synchronized immediately. To disable this behavior, set the value to "0s". -
client_addr
Equivalent to the-client
command-line flag. -
datacenter
Equivalent to the-datacenter
command-line flag. -
data_dir
Equivalent to the-data-dir
command-line flag. -
disable_anonymous_signature
Disables providing an anonymous signature for de-duplication with the update check. Seedisable_update_check
. -
disable_remote_exec
Disables support for remote execution. When set to true, the agent will ignore any incoming remote exec requests. -
disable_update_check
Disables automatic checking for security bulletins and new version releases. -
dns_config
This object allows a number of sub-keys to be set which can tune how DNS queries are serviced. See this guide on DNS caching for more detail.
The following sub-keys are available:-
allow_stale
- Enables a stale query for DNS information. This allows any Consul server, rather than only the leader, to service the request. The advantage of this is you get linear read scalability with Consul servers. In versions of Consul prior to 0.7, this defaulted to false, meaning all requests are serviced by the leader, providing stronger consistency but less throughput and higher latency. In Consul 0.7 and later, this defaults to true for better utilization of available servers. -
max_stale
- Whenallow_stale
is specified, this is used to limit how stale results are allowed to be. If a Consul server is behind the leader by more thanmax_stale
, the query will be re-evaluated on the leader to get more up-to-date results. Prior to Consul 0.7.1 this defaulted to 5 seconds; in Consul 0.7.1 and later this defaults to 10 years ("87600h") which effectively allows DNS queries to be answered by any server, no matter how stale. In practice, servers are usually only milliseconds behind the leader, so this lets Consul continue serving requests in long outage scenarios where no leader can be elected. -
node_ttl
- By default, this is "0s", so all node lookups are served with a 0 TTL value. DNS caching for node lookups can be enabled by setting this value. This should be specified with the "s" suffix for second or "m" for minute. -
service_ttl
- This is a sub-object which allows for setting a TTL on service lookups with a per-service policy. The "*" wildcard service can be used when there is no specific policy available for a service. By default, all services are served with a 0 TTL value. DNS caching for service lookups can be enabled by setting this value. -
enable_truncate
- If set to true, a UDP DNS query that would return more than 3 records, or more than would fit into a valid UDP response, will set the truncated flag, indicating to clients that they should re-query using TCP to get the full set of records. -
only_passing
- If set to true, any nodes whose health checks are warning or critical will be excluded from DNS results. If false, the default, only nodes whose healthchecks are failing as critical will be excluded. For service lookups, the health checks of the node itself, as well as the service-specific checks are considered. For example, if a node has a health check that is critical then all services on that node will be excluded because they are also considered critical. -
recursor_timeout
- Timeout used by Consul when recursively querying an upstream DNS server. Seerecursors
for more details. Default is 2s. This is available in Consul 0.7 and later. -
disable_compression
- If set to true, DNS responses will not be compressed. Compression was added and enabled by default in Consul 0.7. -
udp_answer_limit
- Limit the number of resource records contained in the answer section of a UDP-based DNS response. When answering a question, Consul will use the complete list of matching hosts, shuffle the list randomly, and then limit the number of answers toudp_answer_limit
(default3
). In environments where RFC 3484 Section 6 Rule 9 is implemented and enforced (i.e. DNS answers are always sorted and therefore never random), clients may need to set this value to1
to preserve the expected randomized distribution behavior (note: RFC 3484 has been obsoleted by RFC 6724 and as a result it should be increasingly uncommon to need to change this value with modern resolvers).
-
-
domain
Equivalent to the-domain
command-line flag. -
enable_debug
When set, enables some additional debugging features. Currently, this is only used to set the runtime profiling HTTP endpoints. -
enable_syslog
Equivalent to the-syslog
command-line flag. -
encrypt
Equivalent to the-encrypt
command-line flag. -
key_file
This provides a the file path to a PEM-encoded private key. The key is used with the certificate to verify the agent's authenticity. This must be provided along withcert_file
. -
http_api_response_headers
This object allows adding headers to the HTTP API responses. For example, the following config can be used to enable CORS on the HTTP API endpoints:{ "http_api_response_headers": { "Access-Control-Allow-Origin": "*" } }
-
leave_on_terminate
If enabled, when the agent receives a TERM signal, it will send aLeave
message to the rest of the cluster and gracefully leave. The default behavior for this feature varies based on whether or not the agent is running as a client or a server (prior to Consul 0.7 the default value was unconditionally set tofalse
). On agents in client-mode, this defaults totrue
and for agents in server-mode, this defaults tofalse
. -
log_level
Equivalent to the-log-level
command-line flag. -
node_id
Equivalent to the-node-id
command-line flag. -
node_name
Equivalent to the-node
command-line flag. -
node_meta
Available in Consul 0.7.3 and later, This object allows associating arbitrary metadata key/value pairs with the local node, which can then be used for filtering results from certain catalog endpoints. See the-node-meta
command-line flag for more information.{ "node_meta": { "instance_type": "t2.medium" } }
-
performance
Available in Consul 0.7 and later, this is a nested object that allows tuning the performance of different subsystems in Consul. See the Server Performance guide for more details. The following parameters are available:raft_multiplier
- An integer multiplier used by Consul servers to scale key Raft timing parameters. Omitting this value or setting it to 0 uses default timing described below. Lower values are used to tighten timing and increase sensitivity while higher values relax timings and reduce sensitivity. Tuning this affects the time it takes Consul to detect leader failures and to perform leader elections, at the expense of requiring more network and CPU resources for better performance.
By default, Consul will use a lower-performance timing that's suitable for minimal Consul servers, currently equivalent to setting this to a value of 5 (this default may be changed in future versions of Consul, depending if the target minimum server profile changes). Setting this to a value of 1 will configure Raft to its highest-performance mode, equivalent to the default timing of Consul prior to 0.7, and is recommended for production Consul servers. See the note on last contact timing for more details on tuning this parameter. The maximum allowed value is 10.
-
ports
This is a nested object that allows setting the bind ports for the following keys: -
protocol
Equivalent to the-protocol
command-line flag. -
raft_protocol
Equivalent to the-raft-protocol
command-line flag. -
reap
This controls Consul's automatic reaping of child processes, which is useful if Consul is running as PID 1 in a Docker container. If this isn't specified, then Consul will automatically reap child processes if it detects it is running as PID 1. If this is set to true or false, then it controls reaping regardless of Consul's PID (forces reaping on or off, respectively). This option was removed in Consul 0.7.1. For later versions of Consul, you will need to reap processes using a wrapper, please see the Consul Docker image entry point script for an example. -
reconnect_timeout
This controls how long it takes for a failed node to be completely removed from the cluster. This defaults to 72 hours and it is recommended that this is set to at least double the maximum expected recoverable outage time for a node or network partition. WARNING: Setting this time too low could cause Consul servers to be removed from quorum during an extended node failure or partition, which could complicate recovery of the cluster. The value is a time with a unit suffix, which can be "s", "m", "h" for seconds, minutes, or hours. The value must be >= 8 hours. -
reconnect_timeout_wan
This is the WAN equivalent of thereconnect_timeout
parameter, which controls how long it takes for a failed server to be completely removed from the WAN pool. This also defaults to 72 hours, and must be >= 8 hours. -
recursor
Provides a single recursor address. This has been deprecated, and the value is appended to therecursors
list for backwards compatibility. -
recursors
This flag provides addresses of upstream DNS servers that are used to recursively resolve queries if they are not inside the service domain for Consul. For example, a node can use Consul directly as a DNS server, and if the record is outside of the "consul." domain, the query will be resolved upstream. -
rejoin_after_leave
Equivalent to the-rejoin
command-line flag. -
retry_join
Equivalent to the-retry-join
command-line flag. Takes a list of addresses to attempt joining everyretry_interval
until at least one join works. The list should contain IPv4 addresses with optional Serf LAN port number also specified or bracketed IPv6 addresses with optional port number — for example:[::1]:8301
. -
retry_join_ec2
- This is a nested object that allows the setting of EC2-related-retry-join
options.
The following keys are valid:region
- The AWS region. Equivalent to the-retry-join-ec2-region
command-line flag.tag_key
- The EC2 instance tag key to filter on. Equivalent to the
-retry-join-ec2-tag-key
command-line flag.tag_value
- The EC2 instance tag value to filter on. Equivalent to the
-retry-join-ec2-tag-value
command-line flag.access_key_id
- The AWS access key ID to use for authentication.secret_access_key
- The AWS secret access key to use for authentication.
-
retry_join_gce
- This is a nested object that allows the setting of GCE-related-retry-join
options.
The following keys are valid:project_name
- The GCE project name. Equivalent to the
-retry-join-gce-project-name
command-line flag.zone_pattern
- The regular expression indicating the zones to search in. Equivalent to the
-retry-join-gce-zone-pattern
command-line flag.tag_value
- The GCE instance tag value to filter on. Equivalent to the
-retry-join-gce-tag-value
command-line flag.credentials_file
- The path to the GCE service account credentials file. Equivalent to the
-retry-join-gce-credentials-file
command-line flag.
-
retry_interval
Equivalent to the-retry-interval
command-line flag. -
retry_join_wan
Equivalent to the-retry-join-wan
command-line flag. Takes a list of addresses to attempt joining to WAN everyretry_interval_wan
until at least one join works. -
retry_interval_wan
Equivalent to the-retry-interval-wan
command-line flag. -
server
Equivalent to the-server
command-line flag. -
server_name
When provided, this overrides thenode_name
for the TLS certificate. It can be used to ensure that the certificate name matches the hostname we declare. -
session_ttl_min
The minimum allowed session TTL. This ensures sessions are not created with TTL's shorter than the specified limit. It is recommended to keep this limit at or above the default to encourage clients to send infrequent heartbeats. Defaults to 10s. -
skip_leave_on_interrupt
This is similar toleave_on_terminate
but only affects interrupt handling. When Consul receives an interrupt signal (such as hitting Control-C in a terminal), Consul will gracefully leave the cluster. Setting this totrue
disables that behavior. The default behavior for this feature varies based on whether or not the agent is running as a client or a server (prior to Consul 0.7 the default value was unconditionally set tofalse
). On agents in client-mode, this defaults tofalse
and for agents in server-mode, this defaults totrue
(i.e. Ctrl-C on a server will keep the server in the cluster and therefore quorum, and Ctrl-C on a client will gracefully leave). -
start_join
An array of strings specifying addresses of nodes to-join
upon startup. -
start_join_wan
An array of strings specifying addresses of WAN nodes to-join-wan
upon startup. -
telemetry
This is a nested object that configures where Consul sends its runtime telemetry, and contains the following keys:-
statsd_address
This provides the address of a statsd instance in the formathost:port
. If provided, Consul will send various telemetry information to that instance for aggregation. This can be used to capture runtime information. This sends UDP packets only and can be used with statsd or statsite. -
statsite_address
This provides the address of a statsite instance in the formathost:port
. If provided, Consul will stream various telemetry information to that instance for aggregation. This can be used to capture runtime information. This streams via TCP and can only be used with statsite. -
statsite_prefix
The prefix used while writing all telemetry data to statsite. By default, this is set to "consul". -
dogstatsd_addr
This provides the address of a DogStatsD instance in the formathost:port
. DogStatsD is a protocol-compatible flavor of statsd, with the added ability to decorate metrics with tags and event information. If provided, Consul will send various telemetry information to that instance for aggregation. This can be used to capture runtime information. -
dogstatsd_tags
This provides a list of global tags that will be added to all telemetry packets sent to DogStatsD. It is a list of strings, where each string looks like "my_tag_name:my_tag_value". -
disable_hostname
This controls whether or not to prepend runtime telemetry with the machine's hostname, defaults to false. -
circonus_api_token
A valid API Token used to create/manage check. If provided, metric management is enabled. -
circonus_api_app
A valid app name associated with the API token. By default, this is set to "consul". -
circonus_api_url
The base URL to use for contacting the Circonus API. By default, this is set to "https://api.circonus.com/v2". -
circonus_submission_interval
The interval at which metrics are submitted to Circonus. By default, this is set to "10s" (ten seconds). -
circonus_submission_url
Thecheck.config.submission_url
field, of a Check API object, from a previously created HTTPTRAP check. -
circonus_check_id
The Check ID (not check bundle) from a previously created HTTPTRAP check. The numeric portion of thecheck._cid
field in the Check API object. -
circonus_check_force_metric_activation
Force activation of metrics which already exist and are not currently active. If check management is enabled, the default behavior is to add new metrics as they are encoutered. If the metric already exists in the check, it will not be activated. This setting overrides that behavior. By default, this is set to false. -
circonus_check_instance_id
Uniquely identifies the metrics coming from this instance. It can be used to maintain metric continuity with transient or ephemeral instances as they move around within an infrastructure. By default, this is set to hostname:application name (e.g. "host123:consul"). -
circonus_check_search_tag
A special tag which, when coupled with the instance id, helps to narrow down the search results when neither a Submission URL or Check ID is provided. By default, this is set to service:application name (e.g. "service:consul"). -
<a name="telemetry-circonus_check_display_name"
circonus_check_display_name
Specifies a name to give a check when it is created. This name is displayed in the Circonus UI Checks list. Available in Consul 0.7.2 and later. -
<a name="telemetry-circonus_check_tags"
circonus_check_tags
Comma separated list of additional tags to add to a check when it is created. Available in Consul 0.7.2 and later. -
circonus_broker_id
The ID of a specific Circonus Broker to use when creating a new check. The numeric portion ofbroker._cid
field in a Broker API object. If metric management is enabled and neither a Submission URL nor Check ID is provided, an attempt will be made to search for an existing check using Instance ID and Search Tag. If one is not found, a new HTTPTRAP check will be created. By default, this is not used and a random Enterprise Broker is selected, or the default Circonus Public Broker. -
circonus_broker_select_tag
A special tag which will be used to select a Circonus Broker when a Broker ID is not provided. The best use of this is to as a hint for which broker should be used based on where this particular instance is running (e.g. a specific geo location or datacenter, dc:sfo). By default, this is left blank and not used.
-
-
statsd_addr
Deprecated, see the telemetry structure -
statsite_addr
Deprecated, see the telemetry structure -
statsite_prefix
Deprecated, see the telemetry structure -
dogstatsd_addr
Deprecated, see the telemetry structure -
dogstatsd_tags
Deprecated, see the telemetry structure -
syslog_facility
Whenenable_syslog
is provided, this controls to which facility messages are sent. By default,LOCAL0
will be used. -
tls_min_version
Added in Consul 0.7.4, this specifies the minimum supported version of TLS. Accepted values are "tls10", "tls11" or "tls12". This defaults to "tls10". WARNING: TLS 1.1 and lower are generally considered less secure; avoid using these if possible. This will be changed to default to "tls12" in Consul 0.8.0. -
<a name="translate_wan_addrs"
translate_wan_addrs
If set to true, Consul will prefer a node's configured WAN address when servicing DNS and HTTP requests for a node in a remote datacenter. This allows the node to be reached within its own datacenter using its local address, and reached from other datacenters using its WAN address, which is useful in hybrid setups with mixed networks. This is disabled by default.
Starting in Consul 0.7 and later, node addresses in responses to HTTP requests will also prefer a node's configured WAN address when querying for a node in a remote datacenter. AnX-Consul-Translate-Addresses
header will be present on all responses when translation is enabled to help clients know that the addresses may be translated. TheTaggedAddresses
field in responses also have alan
address for clients that need knowledge of that address, regardless of translation.
The following endpoints translate addresses: -
ui_dir
- Equivalent to the-ui-dir
command-line flag. This configuration key is not required as of Consul version 0.7.0 and later. -
unix_sockets
- This allows tuning the ownership and permissions of the Unix domain socket files created by Consul. Domain sockets are only used if the HTTP address is configured with theunix://
prefix.
It is important to note that this option may have different effects on different operating systems. Linux generally observes socket file permissions while many BSD variants ignore permissions on the socket file itself. It is important to test this feature on your specific distribution. This feature is currently not functional on Windows hosts.
The following options are valid within this construct and apply globally to all sockets created by Consul:user
- The name or ID of the user who will own the socket file.group
- The group ID ownership of the socket file. This option currently only supports numeric IDs.mode
- The permission bits to set on the file.
-
verify_incoming
- If set to true, Consul requires that all incoming connections make use of TLS and that the client provides a certificate signed by the Certificate Authority from theca_file
. By default, this is false, and Consul will not enforce the use of TLS or verify a client's authenticity. This applies to both server RPC and to the HTTPS API. To enable the HTTPS API, you must define an HTTPS port via theports
configuration. By default, HTTPS is disabled. -
verify_outgoing
- If set to true, Consul requires that all outgoing connections make use of TLS and that the server provides a certificate that is signed by the Certificate Authority from theca_file
. By default, this is false, and Consul will not make use of TLS for outgoing connections. This applies to clients and servers as both will make outgoing connections. -
verify_server_hostname
- If set to true, Consul verifies for all outgoing connections that the TLS certificate presented by the servers matches "server.<datacenter>.<domain>" hostname. This impliesverify_outgoing
. By default, this is false, and Consul does not verify the hostname of the certificate, only that it is signed by a trusted CA. This setting is important to prevent a compromised client from being restarted as a server, and thus being able to perform a MITM attack or to be added as a Raft peer. This is new in 0.5.1. -
watches
- Watches is a list of watch specifications which allow an external process to be automatically invoked when a particular data view is updated. See the watch documentation for more detail. Watches can be modified when the configuration is reloaded.
Ports Used
Consul requires up to 5 different ports to work properly, some on TCP, UDP, or both protocols. Below we document the requirements for each port.
-
Server RPC (Default 8300). This is used by servers to handle incoming requests from other agents. TCP only.
-
Serf LAN (Default 8301). This is used to handle gossip in the LAN. Required by all agents. TCP and UDP.
-
Serf WAN (Default 8302). This is used by servers to gossip over the WAN to other servers. TCP and UDP.
-
HTTP API (Default 8500). This is used by clients to talk to the HTTP API. TCP only.
-
DNS Interface (Default 8600). Used to resolve DNS queries. TCP and UDP.
Consul will also make an outgoing connection to HashiCorp's servers for
Atlas-related features and to check for the availability of newer versions
of Consul. This will be a TLS-secured TCP connection to scada.hashicorp.com:7223
.
Reloadable Configuration
Reloading configuration does not reload all configuration items. The items which are reloaded include:
- Log level
- Checks
- Services
- Watches
- HTTP Client Address
- Atlas Token
- Atlas Infrastructure
- Atlas Endpoint