Prerequisites and personnel
This section identifies the roles, access, and prerequisite infrastructure required before deploying Consul Enterprise.
Roles and responsibilities
Requirements and recommendations for operating a secure Consul deployment may vary drastically depending on your intended workloads, operating system, and environment. This section will provide architecture recommendations to meet the technical requirements of your organization and deploy Consul to meet the requirements. This section defines the roles required from the participants, and includes authority and access needs to the working environment.
Personnel
Focusing on the deployment activity alone, we recommend enlisting a project leader and a Cloud administration team. A project leader primarily coordinates events, facilitates resources and assigns duties to the Cloud administration team.
Members of the Cloud administration team carry out functional tasks to install Consul Enterprise. For Cloud administrators, we make assumptions about general knowledge of the following:
- Cloud architecture and administration
- Administration-level experience with Linux
- Peripheral awareness of Docker
- Practical knowledge of Terraform
In addition, we strongly recommend requesting assistance from a Security Operations team. The emphasis is on integrating formal security controls required for services hosted in your preferred cloud environment.
Finally, it is essential to specify a role for the infrastructure automation team who will take over the deployment at the end of this exercise.
| Persona Title | Role Description | Responsibilities |
|---|---|---|
| Platform/Infrastructure Engineer | Define & implement the infrastructure decisions. | Manages Consul Service discovery and Service Mesh platform. |
| Security Engineer/Architect | Define and implement security framework in the platform | Manage security policies, access control, secrets and authorization policies. |
| Developer | Write codes and maintain applications. | Implements service-to-service communications and maintains deployment definitions. |
Access
The installation team requires administrative access to various resources to install and configure Consul Enterprise including:
- Compute/storage: compute instances, Kubernetes clusters, object storage
- Network: VPC, firewalls, load balancer, etc.
- TLS certificates: Load balancer security
- Identity: AWS IAM, AAD, Cloud IAM, etc.
- Secrets management and data encryption key management: AWS Secrets Manager, Azure KeyVault, Cloud Key Management, etc.
Multi-cloud and multi-runtime preparation
This section describes how platform teams will need to prepare the infrastructure for a large-scale deployment spanning on-premises and multi-cloud environments. The platform team will be responsible for infrastructure deployment, maintaining DevOps tooling, monitoring, and maintaining several clouds.
The following workflow outlines the key steps for deploying Consul across various environments, including Kubernetes, virtual machines (VMs), and Nomad. Each stage ensures that the necessary prerequisites are installed, Consul is deployed and configured, applications are launched, and communication between environments is established through Consul peering connections.
People
Platform team
The platform team manages the deployment of VM-based, Nomad, and Kubernetes infrastructure. They should be responsible for the following actions:
- Infrastructure creation via Terraform.
- Consul installation via Terraform for VMs.
- Consul installation via Helm for Kubernetes using GitOps.
- Setting up admin partitions on-premises.
- Setting up cluster peering between on-premises, AWS, and Azure deployments.
Development teams
Development teams deploy applications. On-premise, they should be responsible for installing a dashboard application on VMs and installing a counting application in Nomad. For cloud environments, they should look at installing a dashboard app on AWS and a counter app in Azure.
Infrastructure creation using Terraform
On-premise Consul install on VMs
Platform teams can follow the recommended deployment architecture discussed in the Consul Installation Guide to right-size the deployment, check component compatibility, and follow the deployment sequence using the provided Terraform modules.
On-premise Nomad install
Nomad and Consul client installation steps are provided in the deployment section below. For reference, the Nomad HVD provides initial configuration guidance.
Infrastructure creation for Kubernetes on AWS and Azure
The Terraform Installation Guide provides platform-specific guidance for creation. Teams can choose the Kubernetes distribution they prefer. This documentation focuses on Elastic Kubernetes Service (EKS) and Azure Kubernetes Service (AKS) specifically.
Consul installation via Helm on Kubernetes
Once the infrastructure is built, Consul can be installed on the Kubernetes cluster. HashiCorp publishes a Helm chart for Consul. The Helm values that will be used are discussed later on in the document.
Setting up admin partitions on-premises
Admin partitions are discussed in detail in the Administration Guide. In this guide, you will set up admin partitions in the on-premises cloud. This is so separate frontend and backend teams can have full administrative control of their respective partitions. Each of these teams will operate autonomously within their partition without the burden of managing the Consul control plane.
Setting up cluster peering between multiple clusters
Cluster peering is also introduced in the Administration Guide. In this guide, you will connect on-premises and Kubernetes clusters running on AWS and Azure using cluster peering. Cluster peering is also discussed in detail in the following sections.