I operate Vault and Consul services in two network zones separated by a firewall.
There is a Consul and Vault cluster in A Zone and a number of Consul Agents.
There are a small number of Consul Agents in B Zone.
The Consul Agent in B Zone is communicating with the Consul cluster in A Zone through the firewall.
In this situation, the Vault cluster repeatedly lost leadership, and it is believed that this phenomenon is caused by the firewall failing to check the Consul Agent activation status in Zone A and Zone B.
To solve this, have a Consul Cluster for each zone. I am also considering using the serf_lan_allowed_cidrs option.
However, since there are only a few nodes in the B Zone, is there a way to set a threshold to ensure durability even if the liveness check fails? Or if there is another better way, please let me know.