{"id":871,"date":"2026-09-17T23:18:34","date_gmt":"2026-09-17T20:18:34","guid":{"rendered":"https:\/\/imaxis.ru\/?p=871"},"modified":"2026-09-18T00:06:08","modified_gmt":"2026-09-17T21:06:08","slug":"ustanovka-i-nastroyka-klastera-consul-na-ubuntu","status":"publish","type":"post","link":"https:\/\/imaxis.ru\/?p=871","title":{"rendered":"\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Consul \u043d\u0430 Ubuntu"},"content":{"rendered":"<h1>\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Consul \u043d\u0430 Ubuntu<\/h1>\n<p>Consul (HashiCorp) \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 service mesh: \u0445\u0440\u0430\u043d\u0438\u0442 \u0440\u0435\u0435\u0441\u0442\u0440 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043e\u0442\u0434\u0430\u0451\u0442 DNS\/HTTP-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u0441\u043b\u0435\u0434\u0438\u0442 \u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u0437\u043b\u043e\u0432 \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u044d\u0442\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0441\u043e\u0431\u0435\u0440\u0451\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 \u0438\u0437 \u0442\u0440\u0451\u0445 \u043d\u043e\u0434 \u043d\u0430 Ubuntu \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c ACL.<\/p>\n<p>\u041f\u0440\u0438\u043c\u0435\u0440 \u0434\u043b\u044f Ubuntu 20.04\/22.04\/24.04 \u0438 Debian 11+. \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f Consul \u2014 <strong>2.0.4<\/strong> (\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c 2026).<\/p>\n<hr \/>\n<h2>\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430<\/h2>\n<p>\u0414\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u0439 \u043d\u043e\u0434\u0435.<\/p>\n<p><strong>1. \u041f\u0430\u043a\u0435\u0442\u044b<\/strong><\/p>\n<pre><code class=\"language-bash\">apt update\napt install unzip wget\n<\/code><\/pre>\n<p><strong>2. \u0412\u0440\u0435\u043c\u044f<\/strong><\/p>\n<pre><code class=\"language-bash\">timedatectl set-timezone Europe\/Moscow\napt install chrony\nsystemctl enable chrony\n<\/code><\/pre>\n<p><strong>3. \u0418\u043c\u0435\u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432<\/strong><\/p>\n<p>\u041f\u0443\u0441\u0442\u044c \u043d\u043e\u0434\u044b:<\/p>\n<ol>\n<li><code>consul01.imaxis.local<\/code> (192.168.0.15)<\/li>\n<li><code>consul02.imaxis.local<\/code> (192.168.0.20)<\/li>\n<li><code>consul03.imaxis.local<\/code> (192.168.0.25)<\/li>\n<\/ol>\n<pre><code class=\"language-bash\"># \u0441\u0435\u0440\u0432\u0435\u0440 1\nhostnamectl set-hostname consul01.imaxis.local\n# \u0441\u0435\u0440\u0432\u0435\u0440 2\nhostnamectl set-hostname consul02.imaxis.local\n# \u0441\u0435\u0440\u0432\u0435\u0440 3\nhostnamectl set-hostname consul03.imaxis.local\n<\/code><\/pre>\n<pre><code class=\"language-bash\">vi \/etc\/hosts\n<\/code><\/pre>\n<pre><code>192.168.0.15 consul01.imaxis.local consul01\n192.168.0.20 consul02.imaxis.local consul02\n192.168.0.25 consul03.imaxis.local consul03\n<\/code><\/pre>\n<pre><code class=\"language-bash\">ping consul01\nping consul02\nping consul03\n<\/code><\/pre>\n<p><strong>4. \u0411\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440<\/strong><\/p>\n<pre><code class=\"language-bash\">iptables -I INPUT -p tcp --match multiport --dports 8300,8301,8302,8500,8600 -j ACCEPT\niptables -I INPUT -p udp --match multiport --dports 8301,8302,8600 -j ACCEPT\napt install iptables-persistent\nnetfilter-persistent save\n<\/code><\/pre>\n<hr \/>\n<h2>\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a<\/h2>\n<h3>\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430<\/h3>\n<p>\u0421\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u0435\u0440\u0441\u0438\u044e \u043d\u0430 <a href=\"https:\/\/releases.hashicorp.com\/consul\/\">\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a<\/a> (<strong>\u0434\u043e\u0441\u0442\u0443\u043f \u0438\u0437 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0442\u0440\u0430\u043d \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d<\/strong>).<\/p>\n<pre><code class=\"language-bash\">CONSUL_VER=&quot;2.0.4&quot;\nwget https:\/\/releases.hashicorp.com\/consul\/${CONSUL_VER}\/consul_${CONSUL_VER}_linux_amd64.zip\nunzip consul_*_linux_amd64.zip -d \/usr\/bin\/\nconsul -v\n<\/code><\/pre>\n<pre><code>Consul v2.0.4\nProtocol 2 spoken by default, understands 2 to 3 ...\n<\/code><\/pre>\n<h3>\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430<\/h3>\n<pre><code class=\"language-bash\">useradd -r -c 'Consul DCS service' consul\nmkdir -p \/var\/lib\/consul \/etc\/consul.d\nchown consul:consul \/var\/lib\/consul \/etc\/consul.d\nchmod 775 \/var\/lib\/consul \/etc\/consul.d\n<\/code><\/pre>\n<p><strong>\u0421\u0438\u0441\u0442\u0435\u043c\u043d\u0430\u044f \u0443\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c <code>consul<\/code>, \u0432\u043b\u0430\u0434\u0435\u043b\u0435\u0446 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432.<\/strong><\/p>\n<p>\u041a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u043d\u043e\u0434\u0435:<\/p>\n<pre><code class=\"language-bash\">consul keygen\n<\/code><\/pre>\n<pre><code>wHFWVHTstpfh08ZflUs4FD2FAMueraoCN2LyqmeLxV0=\n<\/code><\/pre>\n<p>\u041f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0432\u0441\u0435\u0445 \u043d\u043e\u0434\u0430\u0445:<\/p>\n<pre><code class=\"language-bash\">CONSUL_TOKEN=wHFWVHTstpfh08ZflUs4FD2FAMueraoCN2LyqmeLxV0=\nCONSUL_SERVER1=consul01.imaxis.local\nCONSUL_SERVER2=consul02.imaxis.local\nCONSUL_SERVER3=consul03.imaxis.local\n<\/code><\/pre>\n<p>\u0421\u043e\u0437\u0434\u0430\u0451\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n<pre><code class=\"language-bash\">cat &gt; \/etc\/consul.d\/config.json &lt;&lt;EOF\n{\n    &quot;bind_addr&quot;: &quot;0.0.0.0&quot;,\n    &quot;bootstrap_expect&quot;: 3,\n    &quot;client_addr&quot;: &quot;0.0.0.0&quot;,\n    &quot;datacenter&quot;: &quot;dc1&quot;,\n    &quot;node_name&quot;: &quot;$(hostname)&quot;,\n    &quot;data_dir&quot;: &quot;\/var\/lib\/consul&quot;,\n    &quot;domain&quot;: &quot;consul&quot;,\n    &quot;enable_local_script_checks&quot;: true,\n    &quot;dns_config&quot;: {\n        &quot;enable_truncate&quot;: true,\n        &quot;only_passing&quot;: true\n    },\n    &quot;enable_syslog&quot;: true,\n    &quot;encrypt&quot;: &quot;${CONSUL_TOKEN}&quot;,\n    &quot;leave_on_terminate&quot;: true,\n    &quot;log_level&quot;: &quot;INFO&quot;,\n    &quot;rejoin_after_leave&quot;: true,\n    &quot;retry_join&quot;: [\n        &quot;${CONSUL_SERVER1}&quot;,\n        &quot;${CONSUL_SERVER2}&quot;,\n        &quot;${CONSUL_SERVER3}&quot;\n    ],\n    &quot;server&quot;: true,\n    &quot;start_join&quot;: [\n        &quot;${CONSUL_SERVER1}&quot;,\n        &quot;${CONSUL_SERVER2}&quot;,\n        &quot;${CONSUL_SERVER3}&quot;\n    ],\n    &quot;ui_config&quot;: { &quot;enabled&quot;: true }\n}\nEOF\n<\/code><\/pre>\n<p>\u0433\u0434\u0435:<\/p>\n<ul>\n<li><code>bind_addr<\/code> \u2014 \u0430\u0434\u0440\u0435\u0441 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u043d\u0438\u044f (\u0432 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u2014 \u0432\u0441\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b);<\/li>\n<li><code>bootstrap_expect<\/code> \u2014 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430;<\/li>\n<li><code>client_addr<\/code> \u2014 \u0430\u0434\u0440\u0435\u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432;<\/li>\n<li><code>datacenter<\/code> \u2014 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440 (\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043e\u0434\u043d\u043e\u0433\u043e \u0414\u0426 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0432 \u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438);<\/li>\n<li><code>node_name<\/code> \u2014 \u0438\u043c\u044f \u043d\u043e\u0434\u044b;<\/li>\n<li><code>data_dir<\/code> \u2014 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0434\u0430\u043d\u043d\u044b\u0445;<\/li>\n<li><code>domain<\/code> \u2014 \u0434\u043e\u043c\u0435\u043d \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432;<\/li>\n<li><code>enable_local_script_checks<\/code> \u2014 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u043d\u0430 \u0430\u0433\u0435\u043d\u0442\u0435;<\/li>\n<li><code>dns_config<\/code> \u2014 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b DNS;<\/li>\n<li><code>enable_syslog<\/code> \u2014 \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 syslog;<\/li>\n<li><code>encrypt<\/code> \u2014 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (\u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0439 \u043d\u0430 \u0432\u0441\u0435\u0445 \u043d\u043e\u0434\u0430\u0445);<\/li>\n<li><code>leave_on_terminate<\/code> \u2014 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u043d\u043e\u0434\u0443 \u043f\u0440\u0438 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435;<\/li>\n<li><code>log_level<\/code> \u2014 <code>trace<\/code>\/<code>debug<\/code>\/<code>info<\/code>\/<code>warn<\/code>\/<code>err<\/code>;<\/li>\n<li><code>rejoin_after_leave<\/code> \u2014 \u0430\u0432\u0442\u043e-\u0432\u043e\u0437\u0432\u0440\u0430\u0442 \u043d\u043e\u0434\u044b \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440;<\/li>\n<li><code>retry_join<\/code> \u2014 \u0443\u0437\u043b\u044b \u0434\u043b\u044f \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f (\u043f\u043e\u0432\u0442\u043e\u0440 \u0434\u043e \u0443\u0441\u043f\u0435\u0445\u0430);<\/li>\n<li><code>server<\/code> \u2014 \u0440\u0435\u0436\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430;<\/li>\n<li><code>start_join<\/code> \u2014 \u0443\u0437\u043b\u044b \u0434\u043b\u044f \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435;<\/li>\n<li><code>ui_config<\/code> \u2014 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441.<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">cat \/etc\/consul.d\/config.json\nconsul validate \/etc\/consul.d\n<\/code><\/pre>\n<pre><code>Configuration is valid!\n<\/code><\/pre>\n<p>\u041f\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0435:<\/p>\n<pre><code>Config validation failed: No private IPv4 address found\n<\/code><\/pre>\n<p>\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c:<\/p>\n<pre><code class=\"language-json\">&quot;advertise_addr&quot;: &quot;1.2.3.4&quot;,\n<\/code><\/pre>\n<p><strong><code>advertise_addr<\/code> \u2014 \u0430\u0434\u0440\u0435\u0441, \u043e\u0431\u044a\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0434\u0440\u0443\u0433\u0438\u043c \u0443\u0437\u043b\u0430\u043c; \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u043c \u0430\u0434\u0440\u0435\u0441\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430.<\/strong><\/p>\n<p>\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f:<\/p>\n<ul>\n<li><code>Node name ... will not be discoverable via DNS due to invalid characters<\/code> \u2014 \u0438\u043c\u044f \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 <code>hosts<\/code>, \u0430 \u043d\u0435 DNS;<\/li>\n<li><code>bootstrap_expect &gt; 0: expecting 3 servers<\/code> \u2014 \u043d\u0435 \u0432\u0441\u0435 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u044b.<\/li>\n<\/ul>\n<p>\u042e\u043d\u0438\u0442 systemd:<\/p>\n<pre><code class=\"language-bash\">vi \/etc\/systemd\/system\/consul.service\n<\/code><\/pre>\n<pre><code class=\"language-ini\">[Unit]\nDescription=Consul Service Discovery Agent\nDocumentation=https:\/\/www.consul.io\/\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nUser=consul\nGroup=consul\nExecStart=\/usr\/bin\/consul agent -config-dir=\/etc\/consul.d\nExecReload=\/bin\/kill -HUP $MAINPID\nKillSignal=SIGINT\nTimeoutStopSec=5\nRestart=on-failure\nSyslogIdentifier=consul\n\n[Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n<h3>\u0417\u0430\u043f\u0443\u0441\u043a \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430<\/h3>\n<pre><code class=\"language-bash\">systemctl start consul\nsystemctl enable consul\nsystemctl status consul\n<\/code><\/pre>\n<pre><code>Active: active (running) since ...\n<\/code><\/pre>\n<pre><code class=\"language-bash\">consul members\nconsul members -detailed\n<\/code><\/pre>\n<p>\u0412\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441: <code>http:\/\/&lt;IP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430&gt;:8500<\/code>.<\/p>\n<hr \/>\n<h2>\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f (ACL)<\/h2>\n<p>\u0411\u0435\u0437 ACL \u0447\u0430\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e, \u0430 \u0447\u0430\u0441\u0442\u044c \u2014 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0430. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u043c \u0442\u043e\u043a\u0435\u043d\u044b.<\/p>\n<h3>\u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 ACL<\/h3>\n<pre><code class=\"language-bash\">vi \/etc\/consul.d\/config.json\n<\/code><\/pre>\n<p>\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c:<\/p>\n<pre><code class=\"language-json\">{\n  ...\n    &quot;ui_config&quot;: { &quot;enabled&quot;: true },\n    &quot;acl&quot;: {\n        &quot;enabled&quot;: true,\n        &quot;default_policy&quot;: &quot;deny&quot;,\n        &quot;enable_token_persistence&quot;: true\n    }\n}\n<\/code><\/pre>\n<p><strong>\u041f\u043e\u0441\u043b\u0435 <code>\"ui_config\": { \"enabled\": true }<\/code> \u043d\u0443\u0436\u043d\u0430 \u0437\u0430\u043f\u044f\u0442\u0430\u044f \u2014 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441 JSON \u0441\u0442\u0440\u043e\u0433\u0438\u0439. <code>default_policy: deny<\/code> \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0442\u043e\u043a\u0435\u043d\u0430.<\/strong><\/p>\n<pre><code class=\"language-bash\">consul validate \/etc\/consul.d\/config.json\nsystemctl restart consul\n<\/code><\/pre>\n<p>\u0412 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u043f\u043e\u044f\u0432\u0438\u0442\u0441\u044f \u0441\u0441\u044b\u043b\u043a\u0430 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430.<\/p>\n<h3>\u0420\u0430\u0431\u043e\u0442\u0430 \u0441 \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438<\/h3>\n<pre><code class=\"language-bash\">consul acl bootstrap\n<\/code><\/pre>\n<p><strong>\u041f\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0435 <code>The ACL system is currently in legacy mode<\/code> \u2014 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0430 \u043d\u0435 \u043d\u0430 \u0432\u0441\u0435\u0445 \u043d\u043e\u0434\u0430\u0445.<\/strong><\/p>\n<pre><code>AccessorID:       af5eaac1-4f0b-d46a-58ba-64ec857dfc4c\nSecretID:         59ac7fa8-dca6-e066-ff33-0bf9bb6f466a\nDescription:      Bootstrap Token (Global Management)\nPolicies:\n   00000000-0000-0000-0000-000000000001 - global-management\n<\/code><\/pre>\n<p><strong><code>SecretID<\/code> \u2014 \u0442\u043e\u043a\u0435\u043d \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 UI \u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0437 CLI.<\/strong><\/p>\n<pre><code class=\"language-bash\">export CONSUL_HTTP_TOKEN=59ac7fa8-dca6-e066-ff33-0bf9bb6f466a\nconsul acl token create -policy-name global-management\nconsul acl token list\nconsul acl token delete -id 54b5f2bb-1a57-3884-f0ea-1284f84186f5\n<\/code><\/pre>\n<p><strong>\u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u2014 \u043f\u043e <code>AccessorID<\/code>.<\/strong><\/p>\n<h3>\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0434\u043b\u044f DNS<\/h3>\n<p>\u041f\u043e\u0441\u043b\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f ACL DNS-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u044e\u0442 \u043e\u0442\u0432\u0435\u0447\u0430\u0442\u044c. \u0421\u043e\u0437\u0434\u0430\u0451\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443:<\/p>\n<pre><code class=\"language-bash\">cd \/etc\/consul.d\/\nvi dns-request-policy.txt\n<\/code><\/pre>\n<pre><code>node_prefix &quot;&quot; {\n  policy = &quot;read&quot;\n}\n\nservice_prefix &quot;&quot; {\n  policy = &quot;read&quot;\n}\n<\/code><\/pre>\n<pre><code class=\"language-bash\">consul acl policy create -name &quot;dns-requests&quot; -rules @dns-request-policy.txt\nconsul acl token create -description &quot;Token for DNS Requests&quot; -policy-name dns-requests\n<\/code><\/pre>\n<pre><code>AccessorID:       b53741e2-7663-eag6-fd67-a64dbd32feb5\nSecretID:         42bd65e5-42a5-356b-a81b-60eff20f657\nDescription:      Token for DNS Requests\nPolicies:\n   89e42b6b-bbec-5263-bc7b-60f3a604a0d6 - dns-requests\n<\/code><\/pre>\n<p><strong><code>SecretID<\/code> \u2014 \u0442\u043e\u043a\u0435\u043d \u0434\u043b\u044f DNS.<\/strong><\/p>\n<p>\u041d\u0430 \u0432\u0441\u0435\u0445 \u043d\u043e\u0434\u0430\u0445 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0443\u0435\u043c\u0441\u044f \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u0442\u043e\u043a\u0435\u043d \u0430\u0433\u0435\u043d\u0442\u0430:<\/p>\n<pre><code class=\"language-bash\">export CONSUL_HTTP_TOKEN=59ac7fa8-dca6-e066-ff33-0bf9bb6f466a\nconsul acl set-agent-token default 42bd65e5-42a5-356b-a81b-60eff20f657\n<\/code><\/pre>\n<hr \/>\n<h2>\u0422\u043e\u043d\u043a\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438<\/h2>\n<ul>\n<li><strong>\u0412\u0435\u0440\u0441\u0438\u0438 Consul<\/strong> \u2014 2.x (\u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c 2026); API-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438\u0437 \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432 1.x \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b, \u043d\u043e \u0441\u0432\u0435\u0440\u044f\u0439\u0442\u0435\u0441\u044c \u0441 changelog.<\/li>\n<li><strong><code>encrypt<\/code> \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0439 \u043d\u0430 \u0432\u0441\u0435\u0445 \u043d\u043e\u0434\u0430\u0445<\/strong> \u2014 \u0438\u043d\u0430\u0447\u0435 \u0430\u0433\u0435\u043d\u0442\u044b \u043d\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u0441\u044f.<\/li>\n<li><strong><code>bootstrap_expect<\/code><\/strong> \u2014 \u0434\u043e\u043b\u0436\u043d\u043e \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0442\u044c \u0441 \u0447\u0438\u0441\u043b\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432; \u043f\u0440\u0438 \u043c\u0435\u043d\u044c\u0448\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440 \u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u0441\u044f.<\/li>\n<li><strong><code>advertise_addr<\/code><\/strong> \u2014 \u0437\u0430\u0434\u0430\u0432\u0430\u0439\u0442\u0435 \u043f\u0440\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u0445, \u0438\u043d\u0430\u0447\u0435 <code>No private IPv4 address found<\/code>.<\/li>\n<li><strong>JSON \u0441\u0442\u0440\u043e\u0433\u0438\u0439<\/strong> \u2014 \u0437\u0430\u0431\u044b\u0442\u0430\u044f \u0437\u0430\u043f\u044f\u0442\u0430\u044f \u043f\u0435\u0440\u0435\u0434 <code>acl<\/code> \u043b\u043e\u043c\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433.<\/li>\n<li><strong>ACL \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u0441\u0435\u0445 \u043d\u043e\u0434\u0430\u0445<\/strong> \u2014 \u0438\u043d\u0430\u0447\u0435 bootstrap \u0432\u0435\u0440\u043d\u0451\u0442 <code>legacy mode<\/code>.<\/li>\n<li><strong>DNS \u043f\u043e\u0441\u043b\u0435 ACL<\/strong> \u2014 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0439\u0442\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 <code>dns-requests<\/code> \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u0435 \u0442\u043e\u043a\u0435\u043d \u0430\u0433\u0435\u043d\u0442\u0430.<\/li>\n<li><strong><code>enable_local_script_checks<\/code><\/strong> \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u0430\u0433\u0435\u043d\u0442\u0435; \u0432 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435 \u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e.<\/li>\n<li><strong>UI \u0431\u0435\u0437 \u0442\u043e\u043a\u0435\u043d\u0430<\/strong> \u2014 \u043f\u0440\u0438 <code>default_policy: deny<\/code> \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 <code>SecretID<\/code>.<\/li>\n<\/ul>\n<hr \/>\n<h2>\u0428\u043f\u0430\u0440\u0433\u0430\u043b\u043a\u0430<\/h2>\n<pre><code class=\"language-bash\">CONSUL_VER=&quot;2.0.4&quot;\nwget https:\/\/releases.hashicorp.com\/consul\/${CONSUL_VER}\/consul_${CONSUL_VER}_linux_amd64.zip\nunzip consul_*_linux_amd64.zip -d \/usr\/bin\/\nuseradd -r consul\nmkdir -p \/var\/lib\/consul \/etc\/consul.d &amp;&amp; chown consul:consul \/var\/lib\/consul \/etc\/consul.d\nconsul keygen            # -&gt; encrypt\n# \/etc\/consul.d\/config.json: server=true, bootstrap_expect=3, retry_join, ui_config\nconsul validate \/etc\/consul.d\nsystemctl enable consul --now\nconsul members\nconsul acl bootstrap\n<\/code><\/pre>\n<p><em>\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430: Ubuntu 20.04\/22.04\/24.04, Debian 11+ + Consul 2.0.4.<\/em><br \/>\n<em>\u0414\u0430\u0442\u0430: \u0421\u0435\u043d\u0442\u044f\u0431\u0440\u044c 2026.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Consul \u043d\u0430 Ubuntu Consul (HashiCorp) \u2014<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-871","post","type-post","status-publish","format-standard","hentry","category-linux"],"aioseo_notices":[],"views":6,"_links":{"self":[{"href":"https:\/\/imaxis.ru\/index.php?rest_route=\/wp\/v2\/posts\/871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/imaxis.ru\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/imaxis.ru\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/imaxis.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=871"}],"version-history":[{"count":3,"href":"https:\/\/imaxis.ru\/index.php?rest_route=\/wp\/v2\/posts\/871\/revisions"}],"predecessor-version":[{"id":886,"href":"https:\/\/imaxis.ru\/index.php?rest_route=\/wp\/v2\/posts\/871\/revisions\/886"}],"wp:attachment":[{"href":"https:\/\/imaxis.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/imaxis.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/imaxis.ru\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}