HC-001

HashiCorp Certified: Consul Associate (003) Exam Details

Exam Objective Domains

What Is HashiCorp Consul?

HashiCorp Consul is a multi-networking tool that provides service discovery, service mesh (with Consul Connect), health checking, key/value storage, and multi-datacenter support. It enables applications to discover and securely communicate with each other across dynamic infrastructure environments including VMs, containers, and Kubernetes. Consul uses a gossip protocol for membership and failure detection, and the Raft consensus protocol for strong consistency of its data store.

Exam Tip: Consul's four core use cases are: service discovery, service mesh (zero-trust networking), network automation, and key/value storage. Understand how each feature maps to Consul capabilities. The exam tests both OSS and Enterprise features.

Consul vs Other Service Mesh Tools

Consul Architecture Components

Exam Tip: Client agents are stateless and lightweight -- they run on EVERY node where services are registered. Server agents are stateful and participate in Raft consensus. Only server agents store data. Always deploy an odd number of servers (3 or 5).

Gossip Protocol (Serf)

Consul uses the Serf library for gossip-based membership management and failure detection. There are two gossip pools:

Gossip uses a SWIM-based protocol for efficient membership management. Each agent periodically probes a random other agent; if a probe fails, it asks other agents to confirm before marking the node as failed. This provides distributed failure detection without a central monitor.

Consensus Protocol (Raft)

Consul server agents use Raft for leader election and log replication. All writes go through the leader, which replicates to followers.

Exam Tip: 3 or 5 servers are recommended. More than 5 is NOT recommended as it increases replication overhead without significant resilience gains. Losing quorum means the cluster becomes read-only -- no new writes, registrations, or KV updates are possible.

Consul Ports Reference

Dev Mode vs Production

Running consul agent -dev starts Consul in development mode for testing:

• Single-node server (no cluster)
• In-memory storage (data lost on restart)
• No TLS, no ACLs enabled
• Listens on localhost only
• UI enabled at http://localhost:8500/ui
• Never use dev mode in production

Service Registration

Services are registered with the local Consul agent so that other services can discover them. Registration can be done via configuration file, HTTP API, or Consul CLI.

Service Discovery Methods

DNS Query Format

Exam Tip: DNS-based discovery only returns healthy services by default. The domain suffix is always .consul. Use SRV records to get both IP and port. Tags can be used as a prefix to filter: v1.web.service.consul.

Health Check Types

Health Check States

Exam Tip: Only services with passing and warning health status are returned in DNS queries. Critical and maintenance services are filtered out. Use consul maint -enable to place a node or service in maintenance mode for planned downtime.

Consul Connect Overview

Consul Connect is the service mesh capability of Consul. It provides secure service-to-service communication using mutual TLS (mTLS) encryption, service identity, and intention-based authorization. Connect uses sidecar proxies (Envoy by default) to transparently handle mTLS without application code changes.

Intentions (Authorization)

Intentions control which services may communicate with each other. They are identity-based -- they use service names (identities), not IP addresses.

Exam Tip: Intentions follow a deny-by-default model when the default policy is "deny." The most specific intention wins. L7 intentions (HTTP path/header matching) require Envoy as the proxy. L4 intentions work with any Connect proxy.

Gateway Types

Exam Tip: Mesh gateways are essential for cross-datacenter service mesh. They eliminate the need for direct connectivity between all service instances across DCs. Traffic flows: Service -> Local Proxy -> Local Mesh GW -> Remote Mesh GW -> Remote Proxy -> Service.

Sidecar Proxy Registration

The web service connects to the api service by making requests to localhost:9091. The sidecar proxy handles mTLS, service discovery, and routing transparently.

Key/Value Store

Consul's built-in KV store provides a simple, distributed key-value storage for dynamic configuration, feature flags, coordination, and leader election. The KV store is strongly consistent (reads go through the leader by default) and supports blocking queries for real-time updates.

Exam Tip: KV values are limited to 512KB per entry. Keys use / as a delimiter for hierarchical organization but are stored flat (no actual directories). The HTTP API supports CAS (Check-And-Set) for optimistic locking via the ?cas=<index> parameter.

Consul ACL System

ACLs control access to Consul resources. The ACL system uses tokens that are associated with policies. Policies define rules specifying allowed operations on resources.

ACL Policy Rules

Exam Tip: ACL bootstrapping creates the initial management token with global management policy. This is equivalent to a root token. Use consul acl bootstrap which can only run once. The default policy (allow or deny) is set in the agent configuration.

ACL CLI Commands

Gossip Encryption & TLS

Consul supports two layers of security for agent communication:

Exam Tip: Gossip encryption uses a symmetric key shared by all agents. Use consul keygen to generate it. TLS uses certificates for identity verification. verify_incoming = true requires clients to present certificates. verify_outgoing = true requires servers to present certificates.

Server Agent vs Client Agent

Consistency Modes

Exam Tip: Use stale mode for high-throughput read scenarios where slight staleness is acceptable. The consistent mode adds latency because the leader must verify its leadership with a quorum. DNS queries always use stale mode by default for performance.

Backup & Restore

Snapshot: Captures ALL Consul state (KV, services, ACLs, intentions, sessions). This is the recommended backup method. Snapshots are saved as a single atomic file. Only the leader can save snapshots by default; use the stale parameter to allow snapshots from followers.

Exam Tip: consul snapshot save captures everything. consul kv export captures KV data only. For disaster recovery, always use snapshots. Consul Enterprise supports automatic snapshot saving to cloud storage (S3, GCS, Azure Blob).

Consul Enterprise Features

Exam Tip: Namespaces isolate resources (services, KV, ACLs) within a partition. Admin Partitions provide stronger isolation and separate the network plane. Both are Enterprise-only features. OSS Consul has a single implicit "default" partition and namespace.

Consul Observability