HashiCorp Developer AI Private beta now available Sign up today
Consul
Associate prep

Learning path - Consul Associate (003)

  • 15min
  • |
  • Consul

The Consul Associate certification is for cloud engineers who specialize in security, development, networking, or operations and know the basic concepts, skills, and use cases associated with HashiCorp Consul.

Candidates will be best prepared for this exam if they have professional experience using Consul in production, but performing the exam objectives in a personal demo environment may also be sufficient. This person understands what enterprise features exist and what can and cannot be done using the community edition offering.

Visit the HashiCorp Security Automation Certification page for information on the exam and to sign up.

Understand the pillars of service networking

Consul is a service networking solution that lets you automate network configurations, discover services, and enable secure connectivity across any cloud or runtime. Review the following resources to start learning about the benefits of service networking automation, and the advantages of Consul specifically.

These resources cover the pillars of service networking and the purpose of Consul (Objective #1).

Study tips

  • Identify the benefits of service discovery
  • Understand that Consul acts as a DNS server for services registered with it
  • Identify the benefits of a service mesh
  • Explain how Consul service mesh enables service to service security within the datacenter
  • Understand the concept of an upstream in the service mesh
  • Differentiate between the gateways that provide connectivity into, out of, and between Consul service meshes
  • Understand how Consul provides network infrastructure automation with consul-terraform-sync

Consul architecture

Consul is a distributed, highly available system. It is important to understand the architecture of Consul in regards to high availability, performance, and communication. It is also important to understand basic Consul operational tasks. Your awareness of Consul Enterprise operations is tested as well. Do the following tasks to ensure that you have a good understanding of Consul's operation in production.

These resources cover Consul architecture fundamentals (Objective #2).

Study tips

  • Understand that the number of servers affects quorum, network speed, and high availability
  • Explain the process of leader election among servers, including the communication protocol that supports the process
  • Differentiate between Consul agent roles and the different responsibilities that come with them
  • Differentiate between Consul control plane and Consul data plane components, including the differences between client agents for VMs and dataplanes for Kubernetes and ECS
  • Understand that Consul can run on multiple platforms, including VMs, Kubernetes, and HCP

Consul datacenter deployment

Deploying a Consul datacenter requires an understanding of Consul's processes and user workflows. You will be tested on common options and configurations for deploying a Consul datacenter. Perform the following tasks to ensure that you have an understanding of how to deploy a Consul datacenter in production.

These resources cover the elements of a Consul cluster deployment (Objective #3).

Study tips

  • Understand the process to deploy Consul on VMs and Kubernetes
  • Understand that the Consul service should run as a daemon
  • Be aware of the different ways to configure Consul, such as configuration files, the CLI, and the HTTP API, including required parameters for the configuration methods
  • Understand the benefits of each cluster joining method and their use cases

Service discovery and service registration

Service discovery is one of the core Consul use cases. You will need to know about service registration, interaction, health checks, and prepared queries. Perform the following tasks to ensure that you have a good understanding of the service discovery use case as well as its basic functionality.

These resources cover the service discovery use-case for Consul (Objective #4).

Study tips

  • Recognize basic service definition parameters
  • Understand how services and health checks can be registered with Consul clients
  • Be aware that service definitions in the configuration directory require reloading the Consul agent for new files and updates to take effect
  • Summarize the function of the Consul catalog and how it enables service discovery using the DNS or HTTP interfaces
  • Understand how Consul DNS load balances healthy services
  • Know the different options for failover offered by prepared queries

Service mesh

Service mesh is one of the core Consul use cases. You will need to know about service-to-service networking, intentions, and zero trust security. Perform the following tasks to ensure that you have a good understanding of the service mesh use case as well as its basic functionality.

These resources cover the service mesh use-case for Consul (Objective #5).

Study tips

  • Be able to understand the different components of a Consul service mesh and how they interact with each other
  • Understand the principles of intentions, how to use them to simplify traffic permissions, and ways to manage them
  • Understand that Consul contributes to the zero trust security model by securing service-to-service communication
  • Understand that each service will need a proxy registration to be part of the mesh and that the operator must start the proxy with the Consul CLI
  • Be able to identify upstream and local services in an example proxy configuration
  • Use the Consul CLI to start a built-in proxy
  • Identify that Consul has L4 and L7 traffic management capabilities

Secure agent communication

Secure agent communication in Consul defends against eavesdropping, tampering, and spoofing. You will be tested on your knowledge of Consul's security model, encryption capabilities, and recommended practices. Perform the following tasks to ensure that you have a good understanding of secure agent communication protocols and practices.

These resources cover secure network traffic communication with Consul (Objective #6).

Study tips

  • Understand the communication channels between Consul nodes, the communication channels between Consul and external nodes, and associated risks as well as their countermeasures
  • Recognize that the servers should all have unique certificates
  • Identify that Consul has a built-in certificate authority and that all certificates need to be signed by the same CA
  • Understand that all agents need to be configured to be secure
  • Identify the key generation Consul CLI command
  • Understand that gossip encryption is a network traffic security feature of Consul
  • Know how to configure agents with gossip encryption and that all agents in the datacenter must share the same key
  • Identify the data that can be accessed with the encryption key
  • Understand that keys need to be rotated

Access Control Lists (ACLs) and service security

Consul's Access Control List (ACL) system is an important security feature which can be used to control access to data and APIs. You will be tested on policies, tokens, and ACL operations involving the CLI and HTTP API. Perform the following tasks to ensure that you have a good understanding of the ACL system and its operations.

These resources cover secure service communication with access control lists (ACLs) in Consul (Objective #7).

Study tips

  • Know how to set up and configure a basic ACL system including rules, policies, and tokens
  • Practice performing Consul operations using tokens with the CLI and API
  • Know how to set CONSUL_HTTP_TOKEN as an environment variable so that the CLI has the correct permissions to perform Consul operations
  • Identify that all agents must use ACLs to ensure secure service-to-service communication
  • Understand that agent ACL tokens are not persisted by default unless the Consul agent configuration option acl.enable_token_persistence is set to true
  • Be able to perform CLI and API requests using a token
  • Understand how to create a token with multiple policies
  • Understand that ACL token management for Consul components can be automated with Consul on Kubernetes

Secure and connect service mesh applications at scale

Consul enables scalable service networking solutions for dealing with networking challenges across multiple datacenters, services, and platforms while ensuring global visibility and control. Perform the following tasks to ensure that you have a good understanding of how Consul secures and connects service mesh applications at scale.

These resources cover the basics of securing and connecting service mesh applications at scale with Consul (Objective #8).

Study tips

  • Differentiate between the gateways that provide connectivity into, out of, and between Consul service meshes
  • Understand the similarities and differences between WAN federation and cluster peering
  • Understand that federation enables communication between multiple Consul datacenters
  • Understand that federation is possible between Consul datacenters of any type (Kubernetes, VM, HCP)
  • Understand that services can communicate between Kubernetes and VM Consul clusters by using mesh gateways

Monitor Consul

Consul observability features provide monitoring capabilities at the data plane level for your service mesh applications and at the control plane level for your Consul cluster. These features enhance your service mesh capabilities with enriched metrics and logs so you can improve performance and debug your distributed services with precision. Performs the following tasks to ensure that you have a good understanding of how Consul provides monitoring for your service mesh data plane and control plane.

These resources cover Consul observability features (Objective #9).

Study tips

  • Understand the scope of observability for the Consul data plane and Consul control plane
  • Identify the source of metrics and logs for the Consul data plane and Consul control plane
  • Understand how Consul contributes to observability capabilities by monitoring individual service health
  • Recognize how Consul server metrics and logs provide insight into the health and performance of Consul clusters
  • Understand the benefit of audit logs
  • Understand that Consul can stream data for ingestion into existing monitoring systems such as Grafana

Operate and maintain Consul

Consul has several features that ensure the health, performance, and security of Consul clusters. These include server management, disaster recovery, network communication security, and troubleshooting practices. Do the following tasks to ensure that you have a good understanding of Consul's operational and maintenance capabilities.

These resources cover Consul operation, maintenance, backup, and restore capabilities (Objective #10).

Study tips

  • Understand the process for adding new servers to an existing Consul cluster
  • Understand the process for upgrading Consul
  • Be familiar with the maintenance activities required to ensure Consul communication security
  • Understand the components of Consul state and data stored inside the agents at a high level
  • Be aware of the sensitive data stored in a backup
  • Identify the best practices and operations involved with consul snapshot
  • Recall that Enterprise backups can be automated and scheduled
  • Be aware of the various Consul troubleshooting options and the functionality that each provides

Next steps

For a reference of the specific study materials that cover a particular exam objective, refer to the content list. Check out the sample questions to review the exam question format.

Sign up for the exam here!

Collection Overview

Associate prep

 Next

Associate exam content list