How to Sync K8s Service to Consul Cluster which is outside the K8s?

5/27/2019

From the consul-k8s documentThe Consul server cluster can run either in or out of a Kubernetes cluster. The Consul server cluster does not need to be running on the same machine or same platform as the sync process. The sync process needs to be configured with the address to the Consul cluster as well as any additional access information such as ACL tokens.

The consul cluster I am trying to sync is outside the k8s cluster, based on the document, I must pass the address to consul cluster for sync process.However, the helm chart for installing the sync process didn’t contains any value to configure the consul cluster ip address.

syncCatalog: 

  # True if you want to enable the catalog sync. "-" for default. 

  enabled: false 

  image: null 

  default: true # true will sync by default, otherwise requires annotation 



  # toConsul and toK8S control whether syncing is enabled to Consul or K8S 

  # as a destination. If both of these are disabled, the sync will do nothing. 

  toConsul: true 

  toK8S: true 



  # k8sPrefix is the service prefix to prepend to services before registering 

  # with Kubernetes. For example "consul-" will register all services 

  # prepended with "consul-". (Consul -> Kubernetes sync) 

  k8sPrefix: null 



  # consulPrefix is the service prefix which preprends itself 

  # to Kubernetes services registered within Consul 

  # For example, "k8s-" will register all services peprended with "k8s-". 

  # (Kubernetes -> Consul sync) 

  consulPrefix: null 



  # k8sTag is an optional tag that is applied to all of the Kubernetes services 

  # that are synced into Consul. If nothing is set, defaults to "k8s". 

  # (Kubernetes -> Consul sync) 

  k8sTag: null 



  # syncClusterIPServices syncs services of the ClusterIP type, which may 

  # or may not be broadly accessible depending on your Kubernetes cluster. 

  # Set this to false to skip syncing ClusterIP services. 

  syncClusterIPServices: true 



  # nodePortSyncType configures the type of syncing that happens for NodePort 

  # services. The valid options are: ExternalOnly, InternalOnly, ExternalFirst. 

  # - ExternalOnly will only use a node's ExternalIP address for the sync 

  # - InternalOnly use's the node's InternalIP address 

  # - ExternalFirst will preferentially use the node's ExternalIP address, but 

  #   if it doesn't exist, it will use the node's InternalIP address instead. 

  nodePortSyncType: ExternalFirst 



  # aclSyncToken refers to a Kubernetes secret that you have created that contains 

  # an ACL token for your Consul cluster which allows the sync process the correct 

  # permissions. This is only needed if ACLs are enabled on the Consul cluster. 

  aclSyncToken: 

    secretName: null 

    secretKey: null 



  # nodeSelector labels for syncCatalog pod assignment, formatted as a muli-line string. 

  # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector 

  # Example: 

  # nodeSelector: | 

  #   beta.kubernetes.io/arch: amd64 

  nodeSelector: null

So How can I set the consul cluster ip address for sync process?

-- Blue Steel
consul
kubernetes
kubernetes-helm

1 Answer

5/27/2019

It looks like the sync service runs via the consul agent on the k8s host.

          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
          command: 
            - consul-k8s sync-catalog \
                  -http-addr=${HOST_IP}:8500

That can't be configured directly but helm can configure the agent/client via client.join (yaml src):

If this is null (default), then the clients will attempt to automatically join the server cluster running within Kubernetes. This means that with server.enabled set to true, clients will automatically join that cluster. If server.enabled is not true, then a value must be specified so the clients can join a valid cluster.

This value is passed to the consul agent as the --retry-join option.

client:
  enabled: true
  join:
  - consul1
  - consul2
  - consul3
syncCatalog:
  enabled: true
-- Matt
Source: StackOverflow