Consul's web UI allows you to view and interact with Consul via a graphical user interface, which can lower the barrier of entry for new users, and ease troubleshooting.
If you were running Consul in production you would need to enable the UI in
Consul's configuration file or using the -ui command line flag, but because
your agent is running in development mode, the UI is automatically enabled.
»Navigate to the UI
If you have already stopped the agent you were using in the previous tutorials, you can visit a live demo-instance of the Consul Web UI to explore the steps in this tutorial.
If you are still running the agent that you used for the previous tutorials, you
will be able to follow the activities in this tutorial more closely. Open a browser
window and navigate to the UI, which is available at the /ui path on the same
port as the HTTP API (port 8500).
A page will load that has a pink menu bar across the top. Welcome to the Consul Web UI.
»View services
The landing page for the UI is the services page, which gives you a list of all registered services including their health, tags, type, and source. You can click on a specific service to learn more about its instance count, the health of individual instances, and which agent each instance is registered with.
You can filter the services visible on the page based on their name, tag, status, or other search terms.
Try it: filter for sidecar services by typing sidecar in the search bar
and pressing the enter key.
You can learn about individual services by clicking on them.
Try it: click on the web-sidecar-proxy service to explore what
information is available. Now select the one listed instance of the
web-sidecar-proxy service to see what information is available on an
instance-to-instance basis.
»View nodes
Next click on the "Nodes" option in the pink top navigation bar to go to the nodes page. There you'll find an overview of the entire datacenter including the health status of each node. You can select individual nodes to learn about their health checks, registered services, round trip time, and lock sessions.
You can also filter the nodes by heath status, or search for them in the search bar.
Try it: Select the nodes page from the top menu bar and click on your local machine.
»Manage the Key-Value store
In the top navigation, click "Key/Value" to view the page for Consul KV. If you
are using the same agent that from previous tutorials, you should see one key,
foo.
The keys page has a folder-like structure. Objects appear nested according to their key prefix. For example, you could have a folder for each application, business function, or a nested combination of the two.
Try it: From the main page, click the blue "Create" button to add a new
key-value pair. Call the key redis/user with a value Alice. Now create
another pair with the key redis/password and the value 123. On the main
page, notice that there is only one new entry, called "redis", with a folder
icon next to it.
When you are clicked into a folder, Consul will automatically nest new keys under that folder, without you needing to type the prefix.
»Manage Access Control Lists
Consul uses Access Control Lists (ACLs) to secure access to the UI, API, CLI, service communications, and agent communications. You need to configure ACLs in your Consul datacenter to secure it for production, however, on your development agent they aren't enabled, so the there isn't much to see on your "ACL" page at the moment.
You can secure the UI itself with ACLs, by limiting read, write, and update permissions for the various pages in the UI. You do this by creating a token with the appropriate permissions, and adding it to the UI under the ACL page. To remove access, simply select "Stop using" from your tokens action menu in the token list.
Security Warning: The browser can store tokens that you add to the UI.
»Manage intentions
Click on the "Intentions" menu item to navigate to the intentions page in the UI. There aren't any intentions there yet, but if you are still running the same agent that you used for the previous tutorials, you can create an intention to block communication between your web and socat services.
Try it: Click on the blue "Create" button. On the creation page set the
source service to "web" and the destination to "socat". Make a deny intention.
Open a terminal window and try to connect to to the socat service with the
command nc 127.0.0.1 9191. It should exit immediately. Now on the main
intentions page, click on the "..." menu item at the right of the new intention.
Delete it and try to connect again. This time it should succeed.
»Adjust UI settings
Click on "Settings" at the far-right of the menu bar. Here you can edit the UI's settings.
If you have set up a metrics dashboard to monitor your services, you can add a link on the settings page that will auto-populate placeholders for there service name and datacenter, and link out to each service's metrics from its UI page.
You can also choose whether or not you would like to set up a blocking query to update the UI in real time, rather than upon refresh. This is off by default because it can have performance implications.
»UI task table
As you may have noticed, some pages of the web UI are read-only, while others are interactive. Below is a table with the CRUD actions available for each page.
| Page | Action |
|---|---|
| Services | Read |
| Nodes | Read |
| Key/Value | Create, Read, Update, Delete |
| Intentions | Create, Read, Update, Delete |
| ACLs | Create, Read, Update, Delete |
»Next steps
So far you have explored the core functionality and features of Consul, including service discovery, securing services with a mesh, and using the key value store.
Continue to the next tutorial, Create a Local Consul Datacenter to learn how to join multiple Consul agents together or learn how to create a local datacenter deployed with Helm on Minikube.