Multi Datacenter Federation practice questions

enable_central_config

Why it fails: This manages config entries, not cross-DC discovery.

node_meta

Why it fails: Node metadata does not impact discovery resolution.

check_ttl

Why it fails: TTL checks are local to the node.

To synchronize the local KV store.

Why it fails: KV store synchronization is handled by the server nodes.

To restrict gossip to the LAN only.

Why it fails: The WAN address is for WAN traffic.

multiple_choice

Why it fails: This is a key, not a concept.

To provide an API endpoint for remote users.

Why it fails: API endpoints are typically on the client or server bind addresses.

<service>.service.consul

Why it fails: This only searches the local datacenter.

<datacenter>.<service>.service.consul

Why it fails: Incorrect syntax.

remote.<service>.service.consul

Why it fails: Incorrect syntax.

/tmp/consul

Why it fails: This is not for persistent configs.

/opt/consul/bin

Why it fails: This is for binaries.

/var/lib/consul

Why it fails: This is for data, not configuration.

8301

Why it fails: 8301 is for LAN gossip.

8500

Why it fails: 8500 is for the HTTP API.

8300

Why it fails: 8300 is for RPC.

KV Mirroring.

Why it fails: KV mirroring is a feature, but ACL replication is the standard for secrets.

Automatic Secret Rotation.

Why it fails: This is not a specific multi-DC feature.

Centralized Config.

Why it fails: This is for configuration entries, not secrets.

To sync secondary data.

Why it fails: This is for gossip membership.

To force a specific leader.

Why it fails: Leadership is via Raft.

To rotate the encryption key.

Why it fails: Key rotation is a separate process.

All datacenters must have identical node names.

Why it fails: Node names must be unique.

Consul clients must be able to communicate directly with all remote servers.

Why it fails: Only servers need WAN connectivity.

All nodes must be in the same subnet.

Why it fails: Consul works across different subnets.

They replace the need for Consul servers in the secondary datacenter.

Why it fails: Servers are still required.

They increase the latency of LAN gossip.

Why it fails: They do not handle LAN gossip.

They require a separate Consul Enterprise license.

Why it fails: They are available in both versions.

consul status

Why it fails: This is not a valid command.

consul ping

Why it fails: This is not a valid command.

consul get

Why it fails: This is not a valid command.

The 'client_addr' restricted to local only.

Why it fails: Client addresses are for local access.

The 'ui' configuration set to true.

Why it fails: UI configuration is independent.

service_prefix "*" { policy = "write" }

Why it fails: Write access is not required for discovery.

agent_prefix "" { policy = "read" }

Why it fails: Agent read is for local agent status.

acl_prefix "" { policy = "read" }

Why it fails: This relates to ACL management, not service discovery.

All services must be in the same namespace.

Why it fails: Namespaces are local to the datacenter.

The local agent must have superuser permissions.

Why it fails: Superuser is not needed for discovery.

A global root ACL token on every client node.

Why it fails: Not required on clients.

The 'raft_protocol' version set to 1.

Why it fails: This is not related to ACL replication.

The full list of local service definitions.

Why it fails: Service details are requested via RPC, not gossip.

The local KV store contents.

Why it fails: KV is not part of gossip.

Disabling ACLs in the primary datacenter.

Why it fails: This defeats the purpose.

Configuring local KV store mirroring.

Why it fails: KV mirroring is not for ACLs.

Service discovery in all datacenters stops immediately.

Why it fails: Local discovery continues.

All Consul agents in the federation crash.

Why it fails: Consul is resilient.

Existing cross-datacenter traffic routes fail.

Why it fails: Traffic continues until sessions time out.

Configure the secondary datacenter's servers with the same encryption key for gossip as the primary datacenter.

Why it fails: While using the same gossip encryption key across datacenters is a common practice for security, it is not strictly required for WAN federation. Each datacenter can have its own gossip key for LAN, and the WAN gossip uses a separate key. However, for WAN federation to work, the WAN gossip encryption key must match. This option refers to the general gossip key, which is not the specific requirement for federation.

Enable Connect in both datacenters and configure a mesh gateway in each datacenter to route cross-datacenter traffic.

Why it fails: While mesh gateways are used for cross-datacenter service-to-service communication with Connect, they are not required for basic WAN federation or catalog-based service discovery. Connect and mesh gateways add service mesh capabilities but are not prerequisites for federation itself. The question focuses on federation and discovery, which rely on WAN gossip and RPC, not on Connect.

Set the primary_datacenter configuration in the secondary datacenter's agents to the name of the primary datacenter.

Why it fails: primary_datacenter is used for ACL replication and is set in the secondary datacenter to indicate the primary for ACLs. However, it is not required for WAN federation or service discovery. WAN federation is established via retry_join_wan and proper TLS configuration. Setting primary_datacenter alone does not enable federation or discovery; it only directs ACL replication.

The retry_join_wan addresses must use the Serf WAN port 8302 instead of the LAN port 8301.

Why it fails: retry_join_wan expects the LAN addresses of the remote datacenter's servers, and Consul automatically uses the correct WAN gossip port (8302) for the join. Specifying port 8302 directly is not required and would not cause a decryption error. The error indicates a key mismatch, not a port issue.

The ACL replication token is missing from the dc2 server configuration, preventing secure communication.

Why it fails: ACL replication token is used for replicating ACL policies and tokens, not for encrypting WAN gossip. Even if ACLs are enabled, the absence of a replication token would not cause a gossip decryption error. The error specifically points to a mismatch in the gossip encryption key, not ACL configuration.

The dc2 servers are not configured with a unique node name, causing conflicts during the join.

Why it fails: Node names must be unique within a datacenter, but duplicate node names across datacenters are allowed and do not affect WAN federation. A node name conflict would produce different errors, such as 'Node name already exists', not a decryption failure. The decryption error is unrelated to node naming.

In the agent configuration of every client agent in each datacenter, using the encrypt parameter.

Why it fails: The encrypt parameter sets the LAN gossip encryption key, not the WAN key. Client agents use the LAN gossip to communicate within their datacenter. They do not participate in WAN gossip, so configuring encrypt on clients does not affect WAN federation. The WAN key must be set on servers using encrypt_wan, and clients are not involved in WAN communication.

In the server's configuration using the primary_datacenter parameter, which propagates the key to all datacenters.

Why it fails: The primary_datacenter parameter is used to designate the primary datacenter for ACL replication. It does not handle gossip encryption keys. Encryption keys are not propagated automatically; they must be manually configured on each server. Using primary_datacenter for this purpose is incorrect and would not enable WAN encryption.

In the Consul KV store under the key 'wan/encrypt', which is automatically read by all servers.

Why it fails: Consul does not read gossip encryption keys from the KV store. Encryption keys are part of the agent configuration and must be provided at startup or via configuration files. The KV store is used for application data, not for agent security settings. Storing the key in KV would be insecure and would not be automatically applied to agents.