Day 1: Security and Network Operations

Gossip Encryption

There are two different systems that need to be configured separately to encrypt communication within the cluster: gossip encryption and TLS. TLS is used to secure the RPC calls between agents. Gossip encryption is secured with a symmetric key, since gossip between nodes is done over UDP. In this guide we will configure both.

To complete the RPC encryption section, you must have configured agent certificates.

Gossip Encryption

To enable gossip encryption, you need to use an encryption key when starting the Consul agent. The key can be set with the encrypt parameter in the agent configuration file. Alternatively, the encryption key can be placed in a separate configuration file with only the encrypt field, since the agent can merge multiple configuration files. The key must be 16-bytes, Base64 encoded.

You can use the Consul CLI command, consul keygen, to generate a cryptographically suitable key.

$ consul keygen
cg8StVXbQJ0gPvMd9o7yrg==

Enable on a New Cluster

To enable gossip on a new cluster, we will add the encryption key parameter to the agent configuration file and then pass the file at startup with the -config-dir flag.

{
  "data_dir": "/opt/consul",
  "log_level": "INFO",
  "node_name": "bulldog",
  "server": true,
  "encrypt": "JY34uTPZyfUE+6tinMYEVw=="
}
$ consul agent -config-dir=/etc/consul.d/
==> Starting Consul agent...
==> Starting Consul agent RPC...
==> Consul agent running!
         Node name: 'Armons-MacBook-Air.local'
        Datacenter: 'dc1'
            Server: false (bootstrap: false)
       Client Addr: 127.0.0.1 (HTTP: 8500, HTTPS: -1, DNS: 8600, RPC: 8400)
      Cluster Addr: 10.1.10.12 (LAN: 8301, WAN: 8302)
    Gossip encrypt: true, RPC-TLS: false, TLS-Incoming: false
...

"Encrypt: true" will be included in the output, if encryption is properly configured.

Note: all nodes within a cluster must share the same encryption key in order to send and receive cluster information, including clients and servers. Additionally, if you're using multiple WAN joined datacenters, be sure to use the same encryption key in all datacenters.

Enable on an Existing Cluster

Gossip encryption can also be enabled on an existing cluster, but requires several extra steps. The additional configuration of the agent configuration parameters, encrypt_verify_incoming and encrypt_verify_outgoing is necessary.

Step 1: Generate an encryption key using consul keygen.

$ consul keygen
JY34uTPZyfUE+6tinMYEVw==

Step 2: Set the encrypt key, and set encrypt_verify_incoming and encrypt_verify_outgoing to false in the agent configuration file. Then initiate a rolling update of the cluster with these new values. After this step, the agents will be able to decrypt gossip but will not yet be sending encrypted traffic.

{
  "data_dir": "/opt/consul",
  "log_level": "INFO",
  "node_name": "bulldog",
  "server": true,
  "encrypt": "JY34uTPZyfUE+6tinMYEVw==",
  "encrypt_verify_incoming": false,
  "encrypt_verify_outgoing": false
}

A rolling update can be made by restarting the Consul agents (clients and servers) in turn. consul reload or kill -HUP <process_id> is not sufficient to change the gossip configuration.

Step 3: Update the encrypt_verify_outgoing setting to true and perform another rolling update of the cluster by restarting Consul on each agent. The agents will now be sending encrypted gossip but will still allow incoming unencrypted traffic.

{
  "data_dir": "/opt/consul",
  "log_level": "INFO",
  "node_name": "bulldog",
  "server": true,
  "encrypt": "JY34uTPZyfUE+6tinMYEVw==",
  "encrypt_verify_incoming": false,
  "encrypt_verify_outgoing": true
}

Step 4: The previous step, enabling verify outgoing, must be completed on all agents before continuing. Update the encrypt_verify_incoming setting to true and perform a final rolling update of the cluster.

{
  "data_dir": "/opt/consul",
  "log_level": "INFO",
  "node_name": "bulldog",
  "server": true,
  "encrypt": "JY34uTPZyfUE+6tinMYEVw==",
  "encrypt_verify_incoming": true,
  "encrypt_verify_outgoing": true
}

All the agents will now be strictly enforcing encrypted gossip. Note, the default behavior of both encrypt_verify_incoming and encrypt_verify_outgoing is true. We have set them in the configuration file as an explicit example.

Summary

In this guide we configured both gossip encryption. Securing agent communication is a recommended set in setting up a production ready cluster.