Consul 1.15 Multi Datacenter Federation — 20 Questions

Question 1

When configuring Mesh Gateways for WAN federation, what is the primary purpose of the 'wan' bind address?

Accepted Answer

To act as an entry point for cross-datacenter traffic in a mesh.. Mesh gateways use the wan bind address to facilitate cross-datacenter traffic routing when native WAN gossip cannot be used or is restricted.

Answer

To synchronize the local KV store.

Answer

To restrict gossip to the LAN only.

Answer

multiple_choice

Answer

To provide an API endpoint for remote users.

Question 2

Which command is used to check the health of the local agent?

Accepted Answer

consul info. The 'consul operator raft list-peers' or 'consul info' can provide information, but 'consul monitor' or checking the UI is more direct for health.

Answer

consul status

Answer

consul ping

Answer

consul get

Question 3

Which protocol do Consul servers use to maintain the WAN gossip pool?

Accepted Answer

Serf (SWIM). Consul uses the Serf library, which implements the SWIM-based gossip protocol for both LAN and WAN communication.

Answer

gRPC

Answer

DNS

Answer

HTTP

Question 4

A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?

Accepted Answer

primary_datacenter. The 'primary_datacenter' and 'allow_stale' settings are crucial, but cross-DC discovery often fails if the 'enable_local_script_checks' or specific WAN gossip configurations prevent cross-link visibility.

Answer

enable_central_config

Answer

node_meta

Answer

check_ttl

Question 5

In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?

Accepted Answer

Secondary datacenters continue to operate, but ACL updates are blocked.. While ACL replication will stall, the secondary datacenters continue to function using their own local raft states.

Answer

Secondary datacenters elect a new primary.

Answer

All secondary datacenters immediately shut down.

Answer

The entire WAN federation is dismantled.

Question 6

You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?

Accepted Answer

The changes are asynchronously replicated to all secondary datacenters.. ACL replication automatically propagates changes from the primary to secondary datacenters to maintain consistency.

Answer

The changes only propagate if the secondary is in maintenance mode.

Answer

The changes require a manual trigger on secondary servers.

Answer

The changes are ignored by secondary datacenters.

Question 7

You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?

Accepted Answer

consul members -wan. The 'consul members -wan' command provides a view of the nodes known to the local server in the WAN pool.

Answer

consul operator raft list-peers

Answer

consul monitor

Answer

consul kv get

Question 8

How do you enable WAN federation between two Consul datacenters that do not share a network?

Accepted Answer

By deploying Mesh Gateways.. Mesh gateways allow cross-datacenter communication in environments where direct WAN gossip is not possible.

Answer

By disabling ACLs.

Answer

By increasing the gossip interval.

Answer

By using a load balancer in front of the servers.

Question 9

You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?

Accepted Answer

consul join -wan <remote-server-address>. The consul join command with the -wan flag is the standard mechanism to introduce a node from one datacenter into the WAN gossip pool of another.

Answer

consul members -wan

Answer

consul reload -wan

Answer

consul agent -join-wan

Question 10

What is the role of a Consul server in a non-primary datacenter regarding ACLs?

Accepted Answer

They replicate the ACL state from the primary.. Secondary servers in an ACL-replicated setup act as a read-only mirror of the primary's ACL policy set.

Answer

They ignore all ACLs.

Answer

They can write new ACL policies independently.

Answer

They become the primary if the original primary fails.

Question 11

A service in datacenter A needs to call a service in datacenter B. If 'prepared_queries' are not used, how does the service discovery query look?

Accepted Answer

.service..consul. When not using prepared queries, standard DNS discovery across DCs follows the pattern .service..consul.

Answer

<service>.service.consul

Answer

..service.consul

Answer

remote.<service>.service.consul

Question 12

What is the purpose of the 'datacenter' field in the Consul agent configuration?

Accepted Answer

To segment the cluster into logical datacenters.. The datacenter field defines the name of the datacenter the agent belongs to, which is used for service registration and routing.

Answer

To limit the number of clients.

Answer

To enable encryption.

Answer

To identify the node for metrics.

Question 13

What happens to the gossip protocol if the 'encrypt' key is mismatched between two datacenters trying to join via WAN?

Accepted Answer

The join fails.. If the encryption keys do not match, the agents will be unable to decrypt the gossip packets and the join will fail.

Answer

The join proceeds with warnings.

Answer

The connection defaults to unencrypted.

Answer

Only metadata is encrypted.

Question 14

When configuring ACL replication, where must the 'acl_replication_token' be defined?

Accepted Answer

In the secondary datacenter's server agents.. The replication token is configured on the secondary datacenter's Consul servers to allow them to read from the primary.

Answer

In the primary datacenter's client agents.

Answer

In the Consul Enterprise license file.

Answer

On all nodes in both datacenters.

Question 15

You want to ensure that specific services in a remote datacenter are only accessible to certain local services. How can you achieve this?

Accepted Answer

Use Consul Intentions.. Intentions are the native Consul mechanism to control service-to-service communication, and they work across datacenters when correctly configured.

Answer

Use firewall rules on all nodes.

Answer

Modify DNS resolution.

Answer

Use ACL tokens.

Question 16

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

Accepted Answer

A list of datacenters to attempt for service resolution.. The 'failover' block in a prepared query allows you to define a list of datacenters to try if the local datacenter lookup returns no healthy instances.

Answer

The timeout for the WAN gossip.

Answer

The encryption algorithm for failover traffic.

Answer

The number of retries per node.

Question 17

Which file path is standard for storing the Consul server configuration, including WAN settings?

Accepted Answer

/etc/consul.d. The '/etc/consul.d' directory is the standard location for Consul configuration files on Linux systems.

Answer

/tmp/consul

Answer

/opt/consul/bin

Answer

/var/lib/consul

Question 18

What is the default port used for WAN gossip between Consul servers?

Accepted Answer

8302. The default port for WAN gossip is 8302, distinct from the LAN gossip port 8301.

Answer

8301

Answer

8500

Answer

8300

Question 19

Which file format is used for Consul configuration?

Accepted Answer

HCL or JSON. Consul supports both HCL (HashiCorp Configuration Language) and JSON for its configuration files.

Answer

INI

Answer

YAML

Answer

XML

Question 20

What is the benefit of using a Mesh Gateway in a multi-datacenter deployment with overlapping IP space?

Accepted Answer

It allows cross-datacenter traffic without routing overlapping networks.. Mesh gateways allow communication between datacenters with overlapping IP ranges by acting as an SNI-based proxy that terminates and re-originates the mTLS connection.

Answer

It reduces the server memory usage.

Answer

It eliminates the need for ACLs.

Answer

It increases the gossip speed.