Secure Gossip Communication with Encryption
There are two different systems that need to be configured separately to encrypt communication within the datacenter: gossip encryption and TLS. TLS is used to secure the RPC calls between agents. Gossip communication is secured with a symmetric key, since gossip between agents is done over UDP. In this tutorial, you will only configure gossip encryption.
Gossip encryption
To enable gossip encryption, you need to use an encryption key when starting the
Consul agent. The key can be set with the encrypt
parameter in the agent
configuration file. Alternatively, the encryption key can be placed in a
separate configuration file with only the encrypt
field, since the agent can
merge multiple configuration files. The key must be 32-bytes, Base64 encoded.
You can use the Consul CLI command, consul keygen
, to generate a
cryptographically suitable key.
Enable on a new Consul datacenter
To enable gossip on a new datacenter, you will add the encryption key parameter
to the agent configuration file and then pass the file at startup with the
-config-dir
flag.
12345
"Encrypt: true" will be included in the output, if encryption is properly configured.
Note: all nodes within the same datacenter must share the same encryption key in order to send and receive datacenter information, including clients and servers. Additionally, if you're using multiple WAN joined datacenters, be sure to use the same encryption key in all datacenters.
Enable on an existing Consul datacenter
Gossip encryption can also be enabled on existing datacenters, but requires
several extra steps. The additional configuration of the agent configuration
parameters, encrypt_verify_incoming
and encrypt_verify_outgoing
is necessary.
Step 1: Generate an encryption key using consul keygen
.
Step 2: Set the encrypt
key, and set encrypt_verify_incoming
and encrypt_verify_outgoing
to false
in the agent configuration file. Then initiate a rolling update of all the
agents with these new values. After this step, the agents will be able to
decrypt gossip but will not yet be able to send encrypted traffic.
1234567
A rolling update can be made by restarting the Consul agents (clients and
servers) in turn. consul reload
or kill -HUP <process_id>
is not
sufficient to change the gossip configuration.
Step 3: Update the encrypt_verify_outgoing
setting to true
and perform
another rolling update of all the agents by restarting Consul on each agent. The
agents will now be sending encrypted gossip but will still allow incoming
unencrypted traffic.
1234567
Step 4: The previous step, enabling verify outgoing, must be completed on
all agents before continuing. Update the encrypt_verify_incoming
setting to
true
and perform a final rolling update on all the agents.
1234567
All the agents will now be strictly enforcing encrypted gossip. Note, the
default behavior of both encrypt_verify_incoming
and encrypt_verify_outgoing
is true
. You have set them in the configuration file as an explicit example.
Next steps
In this tutorial, you configured gossip encryption for all agents in your Consul datacenter. Complete the Secure Agent Communication with TLS Encryption tutorial and Secure Consul with Access Control Lists (ACLs) to finish securing your Consul datacenter.