I’m encountering an issue with setting up the service mesh. Currently, I have two nodes that can see each other:
Node Address Status Type Build Protocol DC Partition Segment
node1 176.25.218.126:8301 alive server 1.19.0 2 dc1 default <all>
node2 25.265.25.45:8301 alive server 1.19.0 2 dc1 default <all>
On one node, I’ve configured a simple setup:
{
"service": {
"name": "web",
"tags": [
"front"
],
"port": 80,
"check": {
"args": ["curl", "localhost"],
"interval": "10s"
},
"connect": {
"sidecar_service": {
"proxy": {
"upstreams": [{
"destination_name": "db",
"local_bind_port": 33306
}]
}
}
}
}
}
However, I’m getting the following error:
Jul 03 17:50:58 loki consul[3127038]: 2024-07-03T17:50:58.354+0300 [ERROR] agent.proxycfg: Failed to handle update from watch: kind=connect-proxy proxy=web-sidecar-proxy service_id=web-sidecar-proxy id=peering-trust-bundles error="error filling agent cache: failed to list all discovery chains referring to \"web\": failed to fetch discovery chain for \"web\": no cluster ca config setup"
Jul 03 17:50:58 loki consul[3127038]: agent.proxycfg: Failed to handle update from watch: kind=connect-proxy proxy=web-sidecar-proxy service_id=web-sidecar-proxy id=peering-trust-bundles error="error filling agent cache: failed to list all discovery chains referring to \"web\": failed to fetch discovery chain for \"web\": no cluster ca config setup"
Jul 03 17:50:58 loki consul[3127038]: 2024-07-03T17:50:58.357+0300 [ERROR] agent.proxycfg: Failed to handle update from watch: kind=connect-proxy proxy=web-sidecar-proxy service_id=web-sidecar-proxy id=discovery-chain:db error="error filling agent cache: no cluster ca config setup"
Jul 03 17:50:58 loki consul[3127038]: agent.proxycfg: Failed to handle update from watch: kind=connect-proxy proxy=web-sidecar-proxy service_id=web-sidecar-proxy id=discovery-chain:db error="error filling agent cache: no cluster ca config setup"
It seems that it cannot find the certificate in the CA. I followed the documentation to create the certificate at Certificate Authority - Built-in Service Mesh CA | Consul | HashiCorp Developer, and it appears to have been set up correctly:
curl localhost:8500/v1/connect/ca/configuration
{"Provider":"consul","Config":{"IntermediateCertTTL":"8760h","LeafCertTTL":"72h","PrivateKey":"-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCX5GxDjpUAx72r\nJ65tWcFuP4xX2HOVy9YgvnGWm+MnWtKMIIkUUrD68HvZ3kZAr2XEu0Lfzoup5lAz\nEucufcDM2I9piE/SRDnsPHZV9dcBemzBGm0JxESwbG7gERWJX0g/EK5b0Jj2GPmy\nqkjq6Csn6aE3e8m/YfoDaQ9A9/+4Qwyqv27QywK0iDhgJFDG+XGnCLTzmzusbVnx\nThSj1u9/IKNpC1rn34nCe6xVxoaFfMhErktcvqBYpOkzL/dLK8ivLQWY2oHgljwP\ncERKyR0BtzYdkGY8h63WxqY0Y0fMqVw3a+Sre0prHrWmBgTfqtSFtWZ9xSTnuWTE\nFeNtIzxDAgMBAAECggEABSziR3b/OrSTkNZcShuJzLDbnk6guZTlad4zTpdnKPse\nO2oMYaXjo9k3zxeUuzV+uTJMOAX4mkRfrS3StLHSNOiYEldzqM1sT9FLkug6eDFs\nrTOyTWfjk0NOj9HlMvYNJyDxX+1+mLwHHgBRVbetaMG8HYDZQe0bsKwOuf75NpT8\n0XT9Y8uOCso+ZQQwdb4Sollrrle2DJYJVjD6NaN9u49k9Ntq1/wY2rXNlOkUppDu\n5XdqYxIDRuHjqf3E2rB2moIsK4YtblwVf2FFu4FMMNGK1uO2uNdUWHc5SaDADxLo\nXXkp01Pq7+/9HyyDYwdmjfDBFD4rN70ynwi6QtoTEQKBgQC9JtEoCYgJusuV+/zT\nmyHPKCCtI/z+7ti8fe7AP69nBWh357MlJQdQNhYMTENOO4Y/QLdPqxq2fH2GdZ+x\n6PROye9qhKjar+vqL4KQLaqjl7KTCitQ3nixaTgpY864IuXCofwEQNo+SN2JfP66\nunJQzBQPGen8H2Bm5xWU6gJxiwKBgQDNkqCQv5Y5BaCGgL+RIIvP2KqT7t73WMx0\nnH5aKt3jnI5+tTxFa9Yt/dGzceCXI9WUUcWz/FeirZbfJJQvxy6AFug7nX9jB62p\nLiRgOElFd5OjJBHIJf3h9/syxZH11MJnNht240OVCQqYXZPHY5yIKDnuJbDNiVxG\naAY7/PTHKQKBgGYnSpo225N1oHG2D4swowfAAjW/0+jSkZbq5EBLpK0czJjFN4j+\nAH8fVrT5kvfzScNrbhTGsbyQazJs3/wzdY3/nR+H2bGRhPWLBxZas2d6i+TBfzdD\njycxTjV8Q65Kmo+M8BBT/gnZTFvud5vdCdP9A3BMbIPPZj7s2kj8QKmVAoGAZIha\nga9QFd7MnDqGdMDH3wOEmAfvfmMsybJmkE36aX98qDaVnRWZjrBcRzdfsEpT/s7m\nspireuENsV7AIYV1Fisds1nYnGN66AuqumuMWa6awuO21nzN5h5R+IhqUyCTWco6\nMDAAMvhS+CR7Sr1KJcQWYIKKLloIiF4C/n88bdECgYBSAvgX4PwQwZkTTe8rULTS\nK9sE4xjy7ydoLHAKgJVTmv3dzKqMIZy3cvPPACPmXd3r2jtDP0tq7JghfvViASj0\nqX+evZUk8Mp6twhLK9DwwiDGGLPyrXEWXMuH5bmBIBZfzbAwlS9AL43OK2t9P04f\np7w6uOvAhuT3zteROFUv3g==\n-----END PRIVATE KEY-----","RootCert":"-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUOB/1COFxAnnxD7mtuozimC44FdkwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDA3MDMxMzM2NTdaFw0zNDA3\nMDExMzM2NTdaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQCX5GxDjpUAx72rJ65tWcFuP4xX2HOVy9YgvnGWm+Mn\nWtKMIIkUUrD68HvZ3kZAr2XEu0Lfzoup5lAzEucufcDM2I9piE/SRDnsPHZV9dcB\nemzBGm0JxESwbG7gERWJX0g/EK5b0Jj2GPmyqkjq6Csn6aE3e8m/YfoDaQ9A9/+4\nQwyqv27QywK0iDhgJFDG+XGnCLTzmzusbVnxThSj1u9/IKNpC1rn34nCe6xVxoaF\nfMhErktcvqBYpOkzL/dLK8ivLQWY2oHgljwPcERKyR0BtzYdkGY8h63WxqY0Y0fM\nqVw3a+Sre0prHrWmBgTfqtSFtWZ9xSTnuWTEFeNtIzxDAgMBAAGjUzBRMB0GA1Ud\nDgQWBBT/MkU2JN+U1GGHJASQYe2GvhlKfjAfBgNVHSMEGDAWgBT/MkU2JN+U1GGH\nJASQYe2GvhlKfjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBM\nlHKZ5EdN1d6b3s8y55ouub5NxkWSdFqyMRDLjizTB/kTVPC+X3hT/XACA1CZY/vV\nj4o2A6YjqdREXzdqJf9PMFb5jYKm1Jl0fM3/k0MlBAbbcTsRDsvRN+QvuDVFYZ/9\nEg93yTQWC+Ne2Ot4GtDmNTnuvl8SBkCb75ktHkyiE07116P44b2oPZ+o823HfFOk\n/wlie6jjHmtpR+Pb8vtAznE/QJDLGH+GzwGE11uSAc1nBnaVtIT2OLa1AYp7TlS5\nEfM0wbpgQHPZZcr1X+WvbZwIpZ7lixZ2HSq2eY+bT9XnDmUDeXQje9IZgcH6CW4L\n8jiUwiSf11Asj02CsvmY\n-----END CERTIFICATE-----"},"State":null,"ForceWithoutCrossSigning":false,"CreateIndex":5,"ModifyIndex":83
Yet, I keep encountering the same error:
024-07-03T17:50:58.357+0300 [ERROR] agent.proxycfg: Failed to handle update from watch: kind=connect-proxy proxy=web-sidecar-proxy service_id=web-sidecar-proxy id=discovery-chain:db error="error filling agent cache: no cluster ca config setup"
Could you please help me understand why it’s unable to fetch the certificate?