Hello, I have a federated consul cluster, primary cluster on VM and secondary cluster on k8s. I have installed my custom CA and verified that the services on primary cluster are able to communicate using the envoy proxy upstream and downstream configurations. I now use the same consul CA cert and…

Hi @ashwinkupatkar thanks for filing this issue. Could you give helm 0.31.0 a try on a test environment? We put in a fix to that release which fixed an issue with certs when using auto-encrypt. If that doesn’t fix it we should probably open up a ticket on github?

Hi @kschoche , I upgraded to consul helm chart version 0.31.1 but still the issue persists. Please find attached events from the deployment consul-events.txt (11.3 KB) The client pod gets the below log in output: 2021-04-27T20:31:08.911Z [ERROR] agent.auto_config: AutoEncrypt.Sign RPC failed: ad…

@kschoche can you provide me any reason for the issue based on above input ?

Hi @ashwinkupatkar - It’s a bit difficult to tell based on those logs alone, would you be able to also show your VM server configurations? And also could you confirm that you’d followed the steps here for federation? Federation Between VMs and Kubernetes | Consul by HashiCorp ? Thanks!

Hi @kschoche , Yes, I followed the steps mentioned in Federation Between VMs and Kubernetes | Consul by HashiCorp If you go through the document, you will find that enableAutoEncrypt is disabled in the doc. So, if I also disable Auto Encrypt then everything works like a charm and Federation betwee…

Hi @ashwinkupatkar can you post the logs for those pods which are stuck? thanks!

I cannot get the logs for those pods as they are in the init stage and if I try to view the logs it says pod initializing.

Hi @kschoche , Could you reproduce the issue ? Thanks

I am soo surprised to see that the issue resolved by itself. I did not do any changes in the config. I just enabled auto-encrypt on both primary and secondary cluster so that I can reproduce the issue today … but the setup just worked like a charm. I am Baffled.

Unable to use auto-encrypt feature in secondary consul cluster

Consul

ashwinkupatkar April 27, 2021, 4:59pm 3

Thanks @kschoche … will check on it.

Topic		Replies	Views
Confused about auto_encrypt Consul	1	740	November 15, 2019
Consul - unable to create cluster Consul	3	657	September 28, 2022
Non-server agent unable to join secondary datacenter with "CA root is nil" error Consul	1	1009	February 6, 2020
Connect with auto-encrypt results in "no PEM-encoded data found" Consul	0	830	November 3, 2020
Consul services and auto-encrypt : unknown authority Consul	0	433	September 23, 2020

Unable to use auto-encrypt feature in secondary consul cluster

Related topics