Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Consul 1.2: Service Mesh

hashicorp.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: HashiCorp Consul 1.2: Service Mesh

#31

Post by syllogism »

hellcow wrote: post #23
syllogism wrote: post #4

If you're using Consul for web services, I really recommend the Traefik web server: https://traefik.io Traefik replaces Nginx: it's the reverse proxy that maps the incoming requests to your various services, which are advertising on some arbitrary localhost port. The amazing thing is that Traefik integrates with Consul: you only need to point it to your Consul endpoint, and it can automatically publish your services!…

Traefik isn't worth the trouble. We used it in production over the course of 2 years, and it was consistently our only source of downtime due to rediculous bugs: not closing file descriptors, breaking changes, and silent failures with no log output, panic or exit even with debug logs enabled. As you mentioned, the docs are terrible. What makes that worse are the undocumented breaking changes between each release. The…

Thanks for the warnings! We don't have it bearing much load yet, so we haven't encountered those things.

Re: HashiCorp Consul 1.2: Service Mesh

#32

Post by mochtar »

gh10981 wrote: post #19
mochtar wrote: post #8

If you want to try the new Connect feature from Consul yourself, we've put up an interactive tutorial on our Instruqt learning platform, together with the nice folks at HashiCorp: https://play.instruqt.com/hashicorp/tracks/connect

:-/ Can I use this without signing up? I would bet your bounce rate is pretty high.

Sorry not yet. As we're spinning up actual infrastructure, the signup is a way for us to keep tabs on usage.

We are working on a anonymous user login though, but that's not yet available.

Re: HashiCorp Consul 1.2: Service Mesh

#33

Post by mochtar »

thepumpkin1979 wrote: post #25
mochtar wrote: post #8

If you want to try the new Connect feature from Consul yourself, we've put up an interactive tutorial on our Instruqt learning platform, together with the nice folks at HashiCorp: https://play.instruqt.com/hashicorp/tracks/connect

this instruqt thingy is pretty cool, it's actually addictive. I started with the Connect course and I'm not going for Istio: > Please wait while we setup a Kubernetes cluster with Istio preinstalled. In the meantime, browse through these notes to learn more about the sample application. damn

Thanks!

We also like apps and services that start faster better ;-)

Re: HashiCorp Consul 1.2: Service Mesh

#34

Post by sagichmal »

syllogism wrote: post #4

If you're using Consul for web services, I really recommend the Traefik web server: https://traefik.io Traefik replaces Nginx: it's the reverse proxy that maps the incoming requests to your various services, which are advertising on some arbitrary localhost port. The amazing thing is that Traefik integrates with Consul: you only need to point it to your Consul endpoint, and it can automatically publish your services!…

I strongly advise everyone to avoid Traefik. In addition to all the reasons enumerated by hellcow, the code quality is simply abysmal.

Re: HashiCorp Consul 1.2: Service Mesh

#35

Post by jorge-fundido »

vidarh wrote: post #26
syllogism wrote: post #4

If you're using Consul for web services, I really recommend the Traefik web server: https://traefik.io Traefik replaces Nginx: it's the reverse proxy that maps the incoming requests to your various services, which are advertising on some arbitrary localhost port. The amazing thing is that Traefik integrates with Consul: you only need to point it to your Consul endpoint, and it can automatically publish your services!…

With nginx, you can do dynamic binding in the free version in at least two ways: 1. If you "just" want to map a hostname, to a private IP, you can assign the hostname to a variable, and use the variable in your backend config. This works because Nginx resolves static addresses at start, but resolves names pulled from variables at runtime. 2. If you need to map ports as well, you can use a Lua or Mruby script. E.g. I…

For those interested in a lua example, from this article [1], I found & cherry-picked bits from here [2]. The key ingredients (to aid searching) are init_worker_by_lua_block & balancer_by_lua_block.

[1] https://medium.com/@sigil66/dynamic-nginx-upstreams-from-con...

[2] https://github.com/sigil66/nginx-consul-cookbook

Re: HashiCorp Consul 1.2: Service Mesh

#36

Post by paultyng »

Already__Taken wrote: post #14

sidebar: I'm quite fond of hcl[0] I hope it worms its way through more systems as a config format option [0]: https://github.com/hashicorp/hcl

a new iteration of HCL is being worked on currently to improve on the rough edges, it combines HCL and HIL: https://github.com/hashicorp/hcl2

Re: HashiCorp Consul 1.2: Service Mesh

#37

Post by paultyng »

esseti wrote: post #15

If I use Kubernetes, this service is superfluous, right? Instead, it's useful if you use Docker containers in other fashion since services should communicate with each other.

I think the answer is yes and no depending on your needs. I don't have a lot of experience with the Kubernetes NetworkPolicy which does support selector based allow/block of communication between pods, but I believe it does not encrypt the traffic itself (although you could always do so on top of the network layer). It also is constrained to only controlling communications within Kubernetes and requires an actual controller to implement the networking. Consul Connect does use a sidecar proxy for intra cluster communication, but in addition to just the authorization it also does a mutual TLS and can allow that secure communication to endpoints outside the cluster. It now occupies a space very similar to Istio: https://www.consul.io/intro/vs/istio.html

Disclaimer: I work for HC but not on Consul

Re: HashiCorp Consul 1.2: Service Mesh

#38

Post by 1_player »

hellcow wrote: post #23
syllogism wrote: post #4

If you're using Consul for web services, I really recommend the Traefik web server: https://traefik.io Traefik replaces Nginx: it's the reverse proxy that maps the incoming requests to your various services, which are advertising on some arbitrary localhost port. The amazing thing is that Traefik integrates with Consul: you only need to point it to your Consul endpoint, and it can automatically publish your services!…

Traefik isn't worth the trouble. We used it in production over the course of 2 years, and it was consistently our only source of downtime due to rediculous bugs: not closing file descriptors, breaking changes, and silent failures with no log output, panic or exit even with debug logs enabled. As you mentioned, the docs are terrible. What makes that worse are the undocumented breaking changes between each release. The…

Any suggestion? I'm stuck on this problem right now at work, don't like Traefik at all for the same reason as you, liked Docker Flow Proxy but it's not configurable enough and, similarly to Traefik, the documentation is quite bad if you need to do something a little more complicated (like, IP access control!).

Fabio might be a good alternative, but we don't need Consul right now, so I don't want to have to manage yet another puzzle piece.

Should I go with nginx?

Re: HashiCorp Consul 1.2: Service Mesh

#39

Post by borplk »

1_player wrote: post #38
hellcow wrote: post #23

Earlier quoted context omitted.

Traefik isn't worth the trouble. We used it in production over the course of 2 years, and it was consistently our only source of downtime due to rediculous bugs: not closing file descriptors, breaking changes, and silent failures with no log output, panic or exit even with debug logs enabled. As you mentioned, the docs are terrible. What makes that worse are the undocumented breaking changes between each release. The…

Any suggestion? I'm stuck on this problem right now at work, don't like Traefik at all for the same reason as you, liked Docker Flow Proxy but it's not configurable enough and, similarly to Traefik, the documentation is quite bad if you need to do something a little more complicated (like, IP access control!). Fabio might be a good alternative, but we don't need Consul right now, so I don't want to have to manage yet…

Checkout envoyproxy.io

Re: HashiCorp Consul 1.2: Service Mesh

#40

Post by poooogles »

dewey wrote: post #16
poooogles wrote: post #10

Earlier quoted context omitted.

>This is the solution I've used and it works pretty well. Just make sure consul-template never writes bad config as that will stop everything reloading. That's bit me a couple of times.

Can't you just run a nginx -t to run the config test and see if it passes before you reload?

nginx does that already. The problem is it'll stop you being able to reload configuration on other bits of config. Once there's a config error nothing can reload.

Limited blast radius don't really apply when it comes to nginx config errors (which given its origins is understandable). One error in one bit of config and it all stops.

Post reply on HN