7 ms·

HashiCorp Consul 1.2: Service Mesh

148 points by onnimonni 8y ago

kamura 8y ago
Could someone care to elaborate what are the main differences between Consul and Istio? What would be the primary reasons to choose one service mesh over the other?
- anubhavmishra 8y ago
  Here is a section on the HashiCorp Consul website dedicated to it. https://www.consul.io/intro/vs/istio.html https://www.consul.io/intro/vs/istio.html I hope it helps
- cube2222 8y ago
  Consul is not a service mesh. At its core it's a distributed key-value store which is commonly used for service discovery, configuration management and healthchecks.
  - lifty 8y ago
    Consul just became a service mesh. It’s in the release notes.
- jrs95 8y ago
  Well, I don't know how mature the service mesh aspects of Consul will be now, but the rest of it is a very mature product that provides a distributed K/V store like etcd and also provides service discovery via either REST or DNS.
syllogism 8y ago
If you're using Consul for web services, I really recommend the Traefik web server: https://traefik.io https://traefik.io Traefik replaces Nginx: it's the reverse proxy that maps the incoming requests to your various services, which are advertising on some arbitrary localhost port. The amazing thing is that Traefik integrates with Consul: you only need to point it to your Consul endpoint, and it can automatically publish your services! You can also do other dynamic configuration of Traefik, e.g. by publishing a service via a REST API, via Kubernetes, etc. I've struggled for years to get Nginx configured correctly, and it's been frustrating to have no alternative. In Nginx, dynamic binding is a premium feature. In the free version, you have to rewrite the config and restart the service. That's not fun if you expect services to come and go as part of your natural life-cycle. Traefik's still pretty young. Notably, the docs are shit. But the application is well-designed, and it compiles as a single self-contained binary (as it's written in Go).
- matthewmacleod 8y ago
  In the free version, you have to rewrite the config and restart the service. That's not fun if you expect services to come and go as part of your natural life-cycle If that's happening super-frequently I could see the problem, but in practice I'd expect you to use `consul-template` and issue a `reload` to nginx to make it reload configurations with no downtime. This is the solution I've used and it works pretty well.
  - tacticus 8y ago
    Old workers stay around until all the connections for them or their grace period has expired. So i hope you're not too close to the resource limit to handle many generations of workers sticking around. also if you have many services behind a single port with path based routing and do a deploy the connection will stick around on the old workers until everything dies. It's super fun with haproxy :(
    - oblio 8y ago
      Kind of bad, but what's the alternative? Cut everyone off on reload?
      - tacticus 8y ago
        Have a better proxy that doesn't need to create a new generation of workers for config changes. Like traefik or envoy or nginx when you pay for it or use the lua shit to do backend discovery (haproxy also has lua shit iirc)
        pas 8y ago
        Could you elaborate on what's wrong with using lua with ningx, especially as used by kong?
        timdumol 8y ago
mochtar 8y ago
If you want to try the new Connect feature from Consul yourself, we've put up an interactive tutorial on our Instruqt learning platform, together with the nice folks at HashiCorp: https://play.instruqt.com/hashicorp/tracks/connect https://play.instruqt.com/hashicorp/tracks/connect
- gh10981 8y ago
  :-/ Can I use this without signing up? I would bet your bounce rate is pretty high.
  - mochtar 8y ago
    Sorry not yet. As we're spinning up actual infrastructure, the signup is a way for us to keep tabs on usage. We are working on a anonymous user login though, but that's not yet available.
- thepumpkin1979 8y ago
  this instruqt thingy is pretty cool, it's actually addictive. I started with the Connect course and I'm not going for Istio: > Please wait while we setup a Kubernetes cluster with Istio preinstalled. In the meantime, browse through these notes to learn more about the sample application. damn
  - mochtar 8y ago
    Thanks! We also like apps and services that start faster better ;-)
    - thepumpkin1979 8y ago
      Oh what I meant to say is, it's a real kubernetes cluster, it's a good thing.
- Dowwie 8y ago
  I found the tutorial steps unclear and got stuck at setting up the postgres test
chuhnk 8y ago
I've been using Consul as part of micro (https://github.com/micro/micro https://github.com/micro/micro) for 3 years now. It's a great mechanism for service discovery. This additional feature is going to be seamlessly integrated. They've done a fantastic job of pushing forward Consul as a whole.
- deleted 8y ago
  [deleted]
Already__Taken 8y ago
sidebar: I'm quite fond of hcl[0] I hope it worms its way through more systems as a config format option [0]: https://github.com/hashicorp/hcl https://github.com/hashicorp/hcl
- paultyng 8y ago
  a new iteration of HCL is being worked on currently to improve on the rough edges, it combines HCL and HIL: https://github.com/hashicorp/hcl2 https://github.com/hashicorp/hcl2
- alecthomas 8y ago
  Agreed, it's a great format. I wish it would kill YAML.
  - vesak 8y ago
    I wish Hashicorp will seriously maim many of the other devops solutions. Their stuff has grew on me slowly, but I'm appreciating the hell out of their focused tools. Smells like Unix spirit.
esseti 8y ago
If I use Kubernetes, this service is superfluous, right? Instead, it's useful if you use Docker containers in other fashion since services should communicate with each other.
- paultyng 8y ago
  I think the answer is yes and no depending on your needs. I don't have a lot of experience with the Kubernetes NetworkPolicy which does support selector based allow/block of communication between pods, but I believe it does not encrypt the traffic itself (although you could always do so on top of the network layer). It also is constrained to only controlling communications within Kubernetes and requires an actual controller to implement the networking. Consul Connect does use a sidecar proxy for intra cluster communication, but in addition to just the authorization it also does a mutual TLS and can allow that secure communication to endpoints outside the cluster. It now occupies a space very similar to Istio: https://www.consul.io/intro/vs/istio.html https://www.consul.io/intro/vs/istio.html Disclaimer: I work for HC but not on Consul
- vesak 8y ago
  Docker is not required in any way with Consul Connect.
jrs95 8y ago
Damn, this is nice. If this had been around a few months ago I don't think I'd be using Kubernetes right now.

148 points by onnimonni 8y ago

Could someone care to elaborate what are the main differences between Consul and Istio? What would be the primary reasons to choose one service mesh over the other?

anubhavmishra 8y ago
Here is a section on the HashiCorp Consul website dedicated to it. https://www.consul.io/intro/vs/istio.html https://www.consul.io/intro/vs/istio.html I hope it helps
cube2222 8y ago
Consul is not a service mesh. At its core it's a distributed key-value store which is commonly used for service discovery, configuration management and healthchecks.
- lifty 8y ago
  Consul just became a service mesh. It’s in the release notes.
jrs95 8y ago
Well, I don't know how mature the service mesh aspects of Consul will be now, but the rest of it is a very mature product that provides a distributed K/V store like etcd and also provides service discovery via either REST or DNS.

syllogism 8y ago

If you're using Consul for web services, I really recommend the Traefik web server: https://traefik.io https://traefik.io Traefik replaces Nginx: it's the reverse proxy that maps the incoming requests to your various services, which are advertising on some arbitrary localhost port. The amazing thing is that Traefik integrates with Consul: you only need to point it to your Consul endpoint, and it can automatically publish your services! You can also do other dynamic configuration of Traefik, e.g. by publishing a service via a REST API, via Kubernetes, etc. I've struggled for years to get Nginx configured correctly, and it's been frustrating to have no alternative. In Nginx, dynamic binding is a premium feature. In the free version, you have to rewrite the config and restart the service. That's not fun if you expect services to come and go as part of your natural life-cycle. Traefik's still pretty young. Notably, the docs are shit. But the application is well-designed, and it compiles as a single self-contained binary (as it's written in Go).

matthewmacleod 8y ago
In the free version, you have to rewrite the config and restart the service. That's not fun if you expect services to come and go as part of your natural life-cycle If that's happening super-frequently I could see the problem, but in practice I'd expect you to use `consul-template` and issue a `reload` to nginx to make it reload configurations with no downtime. This is the solution I've used and it works pretty well.
- tacticus 8y ago
  Old workers stay around until all the connections for them or their grace period has expired. So i hope you're not too close to the resource limit to handle many generations of workers sticking around. also if you have many services behind a single port with path based routing and do a deploy the connection will stick around on the old workers until everything dies. It's super fun with haproxy :(
  - oblio 8y ago
    Kind of bad, but what's the alternative? Cut everyone off on reload?
    - tacticus 8y ago
      Have a better proxy that doesn't need to create a new generation of workers for config changes. Like traefik or envoy or nginx when you pay for it or use the lua shit to do backend discovery (haproxy also has lua shit iirc)
      - pas 8y ago
        Could you elaborate on what's wrong with using lua with ningx, especially as used by kong?
        timdumol 8y ago

mochtar 8y ago

If you want to try the new Connect feature from Consul yourself, we've put up an interactive tutorial on our Instruqt learning platform, together with the nice folks at HashiCorp: https://play.instruqt.com/hashicorp/tracks/connect https://play.instruqt.com/hashicorp/tracks/connect

gh10981 8y ago
:-/ Can I use this without signing up? I would bet your bounce rate is pretty high.
- mochtar 8y ago
  Sorry not yet. As we're spinning up actual infrastructure, the signup is a way for us to keep tabs on usage. We are working on a anonymous user login though, but that's not yet available.
thepumpkin1979 8y ago
this instruqt thingy is pretty cool, it's actually addictive. I started with the Connect course and I'm not going for Istio: > Please wait while we setup a Kubernetes cluster with Istio preinstalled. In the meantime, browse through these notes to learn more about the sample application. damn
- mochtar 8y ago
  Thanks! We also like apps and services that start faster better ;-)
  - thepumpkin1979 8y ago
    Oh what I meant to say is, it's a real kubernetes cluster, it's a good thing.
Dowwie 8y ago
I found the tutorial steps unclear and got stuck at setting up the postgres test

chuhnk 8y ago

I've been using Consul as part of micro (https://github.com/micro/micro https://github.com/micro/micro) for 3 years now. It's a great mechanism for service discovery. This additional feature is going to be seamlessly integrated. They've done a fantastic job of pushing forward Consul as a whole.

deleted 8y ago
[deleted]

Already__Taken 8y ago

sidebar: I'm quite fond of hcl[0] I hope it worms its way through more systems as a config format option [0]: https://github.com/hashicorp/hcl https://github.com/hashicorp/hcl

paultyng 8y ago
a new iteration of HCL is being worked on currently to improve on the rough edges, it combines HCL and HIL: https://github.com/hashicorp/hcl2 https://github.com/hashicorp/hcl2
alecthomas 8y ago
Agreed, it's a great format. I wish it would kill YAML.
- vesak 8y ago
  I wish Hashicorp will seriously maim many of the other devops solutions. Their stuff has grew on me slowly, but I'm appreciating the hell out of their focused tools. Smells like Unix spirit.

esseti 8y ago

If I use Kubernetes, this service is superfluous, right? Instead, it's useful if you use Docker containers in other fashion since services should communicate with each other.

paultyng 8y ago
I think the answer is yes and no depending on your needs. I don't have a lot of experience with the Kubernetes NetworkPolicy which does support selector based allow/block of communication between pods, but I believe it does not encrypt the traffic itself (although you could always do so on top of the network layer). It also is constrained to only controlling communications within Kubernetes and requires an actual controller to implement the networking. Consul Connect does use a sidecar proxy for intra cluster communication, but in addition to just the authorization it also does a mutual TLS and can allow that secure communication to endpoints outside the cluster. It now occupies a space very similar to Istio: https://www.consul.io/intro/vs/istio.html https://www.consul.io/intro/vs/istio.html Disclaimer: I work for HC but not on Consul
vesak 8y ago
Docker is not required in any way with Consul Connect.

jrs95 8y ago

Damn, this is nice. If this had been around a few months ago I don't think I'd be using Kubernetes right now.