Consul Enterprise

You can use this Helm chart to deploy Consul Enterprise by following a few extra steps.

Find the license file that you received in your welcome email. It should have a .hclic extension. You will use the contents of this file to create a Kubernetes secret before installing the Helm chart.

Note: This guide assumes you are storing your license as a Kubernetes Secret. If you would like to store the enterprise license in Vault, please reference Storing the Enterprise License in Vault.

You can use the following commands to create the secret with name consul-ent-license and key key:

  1. secret=$(cat 1931d1f4-bdfd-6881-f3f5-19349374841f.hclic)
  2. kubectl create secret generic consul-ent-license --from-literal="key=${secret}"
  1. secret=$(cat 1931d1f4-bdfd-6881-f3f5-19349374841f.hclic)
  2. kubectl create secret generic consul-ent-license --from-literal="key=${secret}"

Note: If you cannot find your .hclic file, please contact your sales team or Technical Account Manager.

In your config.yaml, change the value of global.image to one of the enterprise release tags.

  1. global:
  2.   image: 'hashicorp/consul-enterprise:1.10.0-ent'

Consul Enterprise - 图1

config.yaml

  1. global:
  2.   image: 'hashicorp/consul-enterprise:1.10.0-ent'

Add the name and key of the secret you just created to server.enterpriseLicense, if using Consul version 1.10+.

  1. global:
  2.   image: 'hashicorp/consul-enterprise:1.10.0-ent'
  3.   enterpriseLicense:
  4.     secretName: 'consul-ent-license'
  5.     secretKey: 'key'

Consul Enterprise - 图2

config.yaml

  1. global:
  2.   image: 'hashicorp/consul-enterprise:1.10.0-ent'
  3.   enterpriseLicense:
  4.     secretName: 'consul-ent-license'
  5.     secretKey: 'key'

If the version of Consul is < 1.10, use the following config with the name and key of the secret you just created. (These values are required on top of your normal configuration.)

Note: The value of server.enterpriseLicense.enableLicenseAutoload must be set to false.

  1. global:
  2.   image: 'hashicorp/consul-enterprise:1.8.3-ent'
  3.   enterpriseLicense:
  4.     secretName: 'consul-ent-license'
  5.     secretKey: 'key'
  6.     enableLicenseAutoload: false

Consul Enterprise - 图3

config.yaml

  1. global:
  2.   image: 'hashicorp/consul-enterprise:1.8.3-ent'
  3.   enterpriseLicense:
  4.     secretName: 'consul-ent-license'
  5.     secretKey: 'key'
  6.     enableLicenseAutoload: false

Now run helm install:

  1. $ helm install --wait hashicorp hashicorp/consul --values config.yaml
  1. $ helm install --wait hashicorp hashicorp/consul --values config.yaml

Once the cluster is up, you can verify the nodes are running Consul Enterprise by using the consul license get command.

First, forward your local port 8500 to the Consul servers so you can run consul commands locally against the Consul servers in Kubernetes:

  1. $ kubectl port-forward service/hashicorp-consul-server 8500:8500
  1. $ kubectl port-forward service/hashicorp-consul-server 8500:8500

In a separate tab, run the consul license get command (if using ACLs see below):

  1. $ consul license get
  2. License is valid
  3. License ID: 1931d1f4-bdfd-6881-f3f5-19349374841f
  4. Customer ID: b2025a4a-8fdd-f268-95ce-1704723b9996
  5. Expires At: 2020-03-09 03:59:59.999 +0000 UTC
  6. Datacenter: *
  7. Package: premium
  8. Licensed Features:
  9.         Automated Backups
  10.         Automated Upgrades
  11.         Enhanced Read Scalability
  12.         Network Segments
  13.         Redundancy Zone
  14.         Advanced Network Federation
  15. $ consul members
  16. Node                                       Address           Status  Type    Build      Protocol  DC   Segment
  17. hashicorp-consul-server-0                  10.60.0.187:8301  alive   server  1.10.0+ent  2         dc1  <all>
  18. hashicorp-consul-server-1                  10.60.1.229:8301  alive   server  1.10.0+ent  2         dc1  <all>
  19. hashicorp-consul-server-2                  10.60.2.197:8301  alive   server  1.10.0+ent  2         dc1  <all>
  1. $ consul license get
  2. License is valid
  3. License ID: 1931d1f4-bdfd-6881-f3f5-19349374841f
  4. Customer ID: b2025a4a-8fdd-f268-95ce-1704723b9996
  5. Expires At: 2020-03-09 03:59:59.999 +0000 UTC
  6. Datacenter: *
  7. Package: premium
  8. Licensed Features:
  9.         Automated Backups
  10.         Automated Upgrades
  11.         Enhanced Read Scalability
  12.         Network Segments
  13.         Redundancy Zone
  14.         Advanced Network Federation
  15. $ consul members
  16. Node                                       Address           Status  Type    Build      Protocol  DC   Segment
  17. hashicorp-consul-server-0                  10.60.0.187:8301  alive   server  1.10.0+ent  2         dc1  <all>
  18. hashicorp-consul-server-1                  10.60.1.229:8301  alive   server  1.10.0+ent  2         dc1  <all>
  19. hashicorp-consul-server-2                  10.60.2.197:8301  alive   server  1.10.0+ent  2         dc1  <all>

If you get an error:

  1. Error getting license: invalid character 'r' looking for beginning of value
  1. Error getting license: invalid character 'r' looking for beginning of value

Then you have likely enabled ACLs. You need to specify your ACL token when running the license get command. First, assign the ACL token to the CONSUL_HTTP_TOKEN environment variable:

  1. $ export CONSUL_HTTP_TOKEN=$(kubectl get secrets/hashicorp-consul-bootstrap-acl-token --template='{{.data.token | base64decode }}')
  1. $ export CONSUL_HTTP_TOKEN=$(kubectl get secrets/hashicorp-consul-bootstrap-acl-token --template='{{.data.token | base64decode }}')

Now the token will be used when running Consul commands:

  1. $ consul license get
  2. License is valid
  3. License ID: 1931d1f4-bdfd-6881-f3f5-19349374841f
  4. Customer ID: b2025a4a-8fdd-f268-95ce-1704723b9996
  5. Expires At: 2020-03-09 03:59:59.999 +0000 UTC
  6. Datacenter: *
  7. Package: premium
  8. Licensed Features:
  9.         Automated Backups
  10.         Automated Upgrades
  11.         Enhanced Read Scalability
  12.         Network Segments
  13.         Redundancy Zone
  14.         Advanced Network Federation
  1. $ consul license get
  2. License is valid
  3. License ID: 1931d1f4-bdfd-6881-f3f5-19349374841f
  4. Customer ID: b2025a4a-8fdd-f268-95ce-1704723b9996
  5. Expires At: 2020-03-09 03:59:59.999 +0000 UTC
  6. Datacenter: *
  7. Package: premium
  8. Licensed Features:
  9.         Automated Backups
  10.         Automated Upgrades
  11.         Enhanced Read Scalability
  12.         Network Segments
  13.         Redundancy Zone
  14.         Advanced Network Federation