Skip to content

Fix parts of admin-partitions guide #19621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jjti merged 1 commit into from
Nov 14, 2023
Merged

Fix parts of admin-partitions guide #19621

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 16 additions & 14 deletions website/content/docs/enterprise/admin-partitions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,10 @@ All Consul clients must be able to initiate Gossip, HTTPS, and RPC connections t
For Consul on Kubernetes, a dedicated `partition` Kubernetes `LoadBalancer` service is deployed to allow communication from clients to servers for admin partitions support (refer to [Kubernetes Requirements](#kubernetes-requirements) for additional information).

For other runtimes, refer to the documentation for your infrastructure environment for instructions on how to allow communication on the following ports:
- 443 (HTTPS API requests)
- 8300 (RPC)
- 8301 (Gossip)
- 443 (HTTPS API requests)
- 8502 (gRPC from [Consul Dataplane](/consul/docs/connect/dataplane/consul-dataplane))

### Security Configurations

Expand Down Expand Up @@ -154,14 +155,14 @@ Verify that your Consul deployment meets the [Kubernetes Requirements](#kubernet
1. Create the license secret in server cluster.

```shell-session
$ kubectl create --context ${SERVER_CONTEXT} ns consul
$ kubectl create --context ${SERVER_CONTEXT} namespace consul
$ kubectl create secret --context ${SERVER_CONTEXT} --namespace consul generic license --from-file=key=./path/to/license.hclic
```

1. Create the license secret in the non-default partition cluster for your workloads. This step must be repeated for every additional non-default partition cluster.

```shell-session
$ kubectl create --context ${CLIENT_CONTEXT} ns consul
$ kubectl create --context ${CLIENT_CONTEXT} namespace consul
$ kubectl create secret --context ${CLIENT_CONTEXT} --namespace consul generic license --from-file=key=./path/to/license.hclic
```

Expand All @@ -184,7 +185,7 @@ Verify that your Consul deployment meets the [Kubernetes Requirements](#kubernet
enableConsulNamespaces: true
tls:
enabled: true
image: hashicorp/consul-enterprise:1.14.0-ent
image: hashicorp/consul-enterprise:1.16.3-ent
adminPartitions:
enabled: true
acls:
Expand All @@ -207,7 +208,7 @@ Verify that your Consul deployment meets the [Kubernetes Requirements](#kubernet
$ helm install ${HELM_RELEASE_SERVER} hashicorp/consul --version "1.0.0" --create-namespace --namespace consul --values server.yaml
```

1. After the server starts, get the external IP address for partition service so that it can be added to the client configuration. The IP address is used to bootstrap connectivity between servers and workload pods on the non-default partition cluster. <a name="get-external-ip-address"/>
1. After the server starts, get the external IP address for partition service so that it can be added to the client configuration (`externalServers.hosts`). The IP address is used to bootstrap connectivity between servers and workload pods on the non-default partition cluster. <a name="get-external-ip-address"/>

```shell-session
$ kubectl get services --selector="app=consul,component=server" --namespace consul --output jsonpath="{range .items[*]}{@.status.loadBalancer.ingress[*].ip}{end}"
Expand All @@ -220,21 +221,21 @@ Verify that your Consul deployment meets the [Kubernetes Requirements](#kubernet
$ kubectl config view --output "jsonpath={.clusters[?(@.name=='${CLIENT_CONTEXT}')].cluster.server}"
```

Use the IP address printed to the console to configure the `k8sAuthMethodHost` parameter in the workload configuration file for your non-default partition cluster running your workloads.
Use the IP address printed to the console to configure the `externalServers.k8sAuthMethodHost` parameter in the workload configuration file for your non-default partition cluster running your workloads.

1. Copy the server certificate to the non-default partition cluster running your workloads.

```shell-session
$ kubectl get secret ${HELM_RELEASE_SERVER}-consul-ca-cert --context ${SERVER_CONTEXT} -n consul --output yaml | kubectl apply --namespace consul --context ${CLIENT_CONTEXT} --filename -
```

1. Copy the server key to the non-default partition cluster running your workloads.
1. Copy the server key to the non-default partition cluster running your workloads:

```shell-session
$ kubectl get secret ${HELM_RELEASE_SERVER}-consul-ca-key --context ${SERVER_CONTEXT} --namespace consul --output yaml | kubectl apply --namespace consul --context ${CLIENT_CONTEXT} --filename -
```

1. If ACLs were enabled in the server configuration values file, copy the token to the non-default partition cluster running your workloads.
1. If ACLs were enabled in the server configuration values file, copy the token to the non-default partition cluster running your workloads:

```shell-session
$ kubectl get secret ${HELM_RELEASE_SERVER}-consul-partitions-acl-token --context ${SERVER_CONTEXT} --namespace consul --output yaml | kubectl apply --namespace consul --context ${CLIENT_CONTEXT} --filename -
Expand All @@ -250,7 +251,7 @@ Verify that your Consul deployment meets the [Kubernetes Requirements](#kubernet

1. Create a configuration for each non-default admin partition.

<CodeTabs heading="partition-workload.yaml">
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this snippet below uses --values client.yaml

<CodeTabs heading="client.yaml">

<CodeBlockConfig lineNumbers highlight="2,12,15,20,27,29,33">

Expand All @@ -259,10 +260,10 @@ Verify that your Consul deployment meets the [Kubernetes Requirements](#kubernet
name: consul
enabled: false
enableConsulNamespaces: true
image: hashicorp/consul-enterprise:1.14.0-ent
image: hashicorp/consul-enterprise:1.16.3-ent
adminPartitions:
enabled: true
name: partition-workload
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the screenshot uses clients

name: clients
tls:
enabled: true
caCert:
Expand Down Expand Up @@ -310,12 +311,13 @@ You can log into the Consul UI to verify that the partitions appear as expected.
1. If ACLs are enabled, you will need the partitions ACL token, which can be read from the Kubernetes secret. The token is an encoded string that must be decoded in base64, e.g.:

```shell-session
$ kubectl get secret --namespace consul ${HELM_RELEASE_SERVER}-consul-bootstrap-acl-token --template "{{ .data.token | base64decode }}"
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this command assumers server context

$ kubectl get secret --namespace consul --context ${SERVER_CONTEXT} --template "{{ .data.token | base64decode }}" ${HELM_RELEASE_SERVER}-consul-bootstrap-acl-token
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

# josh @ josh-XWGWHJ0JV2 in ~/GitHub/jjti/consul-exp/telemetry-collector on git:main x [20:55:23]
$ kubectl get secret --namespace consul --context ${SERVER_CONTEXT} --template "{{ .data.token | base64decode }}" ${HELM_RELEASE_SERVER}-consul-bootstrap-acl-token
ac2e6a52-3fc1-e2b2-...

```

The example command gets the token using the secret name configured in the values file (`bootstrap.secretName`), decodes the secret, and prints the usable token to the console in JSON format.
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is just out of date

The example command gets the secret from the default partition cluster, decodes the secret, and prints the token to the console.

1. Open the Consul UI in a browser using the external IP address and port number described in a previous step (see [step 4](#get-external-ip-address)).
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's step 4 not 5 now


1. Open the Consul UI in a browser using the external IP address and port number described in a previous step (see [step 5](#get-external-ip-address)).
1. Click **Log in** and enter the decoded token when prompted.

You will see the `default` and `clients` partitions available in the **Admin Partition** drop-down menu.
Expand Down
4 changes: 2 additions & 2 deletions website/content/docs/install/ports.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,13 @@ port.

## Ports Table

Before running Consul, you should ensure the following bind ports are accessible.
Before running Consul, you should ensure the following bind ports are accessible:

| Use | Default Ports |
| ------------------------------------------------------------------------------------------------------------- | ----------------- |
| DNS: The DNS server (TCP and UDP) | 8600 |
| HTTP: The HTTP API (TCP Only) | 8500 |
| HTTPS: The HTTPs API | disabled (8501)\* |
| HTTPS: The HTTPS API | disabled (8501)\* |
Copy link
Copy Markdown
Contributor Author

@jjti jjti Nov 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this has bothered me for a bit

| gRPC: The gRPC API | disabled (8502)\* |
| gRPC TLS: The gRPC API with TLS connections | disabled (8503)\* |
| LAN Serf: The Serf LAN port (TCP and UDP) | 8301 |
Expand Down