Consul-helm: Error at consul-connect-inject-init container

[Shige99011]

Hi, I'm now trying the tutorial at https://learn.hashicorp.com/collections/consul/gs-consul-service-mesh with using microk8s.

Issue:
Errors happen when the services were deployed at the step https://learn.hashicorp.com/tutorials/consul/service-mesh-application-secure-networking?in=consul/gs-consul-service-mesh
Each pod for the services seems to be failed at init container (consul-connect-inject-init) but I cannot find any solution.
Do you have any idea to avoid this issue?

My environment is below:
OS: wsl2 (ubuntu 20.04)
microk8s: v1.20.5
kubernetes: v1.20.5
Consul helm chart: v0.30.1
(Consul helm chart was installed by command "microk8s helm3 install -f config.yaml consul hashicorp/consul --version "0.31.1"")

The descriptions for each pod are here:

api:

Name: api-deployment-v1-6bcbd7bd68-8tllk
Namespace: default
Priority: 0
Node: 5cg0372q3t-wsl/192.168.237.71
Start Time: Thu, 08 Apr 2021 16:28:18 +0900
Labels: app=api-v1
consul.hashicorp.com/connect-inject-status=injected
pod-template-hash=6bcbd7bd68
Annotations: cni.projectcalico.org/podIP: 10.1.32.112/32
cni.projectcalico.org/podIPs: 10.1.32.112/32
consul.hashicorp.com/connect-inject: true
consul.hashicorp.com/connect-inject-status: injected
consul.hashicorp.com/connect-service: api
consul.hashicorp.com/connect-service-port: 9090
prometheus.io/path: /metrics
prometheus.io/port: 20200
prometheus.io/scrape: true
Status: Pending
IP: 10.1.32.112
IPs:
IP: 10.1.32.112
Controlled By: ReplicaSet/api-deployment-v1-6bcbd7bd68
Init Containers:
consul-connect-inject-init:
Container ID: containerd://6b5498f0aa604edab128442da4b855d8fa8a8f5eda5aa7f2d88795dad3e44e04
Image: hashicorp/consul:1.9.4
Image ID: docker.io/hashicorp/consul@sha256:2e55655255ae22ad386c5fd9dd1681b750b65d451009c28361dcca47f7dc09ce
Port:
Host Port:
Command:
/bin/sh
-ec

  export CONSUL_HTTP_ADDR="${HOST_IP}:8500"
  export CONSUL_GRPC_ADDR="${HOST_IP}:8502"

  # Register the service. The HCL is stored in the volume so that
  # the preStop hook can access it to deregister the service.
  cat <<EOF >/consul/connect-inject/service.hcl
  services {
    id   = "${SERVICE_ID}"
    name = "api"
    address = "${POD_IP}"
    port = 9090
    meta = {
      pod-name = "${POD_NAME}"
      k8s-namespace = "${POD_NAMESPACE}"
    }
  }

  services {
    id   = "${PROXY_SERVICE_ID}"
    name = "api-sidecar-proxy"
    kind = "connect-proxy"
    address = "${POD_IP}"
    port = 20000
    meta = {
      pod-name = "${POD_NAME}"
      k8s-namespace = "${POD_NAMESPACE}"
    }

    proxy {
    config {
      envoy_prometheus_bind_addr = "0.0.0.0:20200"
    }
      destination_service_name = "api"
      destination_service_id = "${SERVICE_ID}"
      local_service_address = "127.0.0.1"
      local_service_port = 9090
    }

    checks {
      name = "Proxy Public Listener"
      tcp = "${POD_IP}:20000"
      interval = "10s"
      deregister_critical_service_after = "10m"
    }

    checks {
      name = "Destination Alias"
      alias_service = "${SERVICE_ID}"
    }
  }
  EOF

  /bin/consul services register \
    /consul/connect-inject/service.hcl

  # Generate the envoy bootstrap code
  /bin/consul connect envoy \
    -proxy-id="${PROXY_SERVICE_ID}" \
    -prometheus-scrape-path="/metrics" \
    -prometheus-backend-port="20100" \
    -bootstrap > /consul/connect-inject/envoy-bootstrap.yaml

  # Copy the Consul binary
  cp /bin/consul /consul/connect-inject/consul
State:          Waiting
  Reason:       CrashLoopBackOff
Last State:     Terminated
  Reason:       Error
  Exit Code:    1
  Started:      Thu, 08 Apr 2021 20:06:22 +0900
  Finished:     Thu, 08 Apr 2021 20:06:32 +0900
Ready:          False
Restart Count:  46
Limits:
  cpu:     50m
  memory:  150Mi
Requests:
  cpu:     50m
  memory:  25Mi
Environment:
  HOST_IP:            (v1:status.hostIP)
  POD_IP:             (v1:status.podIP)
  POD_NAME:          api-deployment-v1-6bcbd7bd68-8tllk (v1:metadata.name)
  POD_NAMESPACE:     default (v1:metadata.namespace)
  SERVICE_ID:        $(POD_NAME)-api
  PROXY_SERVICE_ID:  $(POD_NAME)-api-sidecar-proxy
Mounts:
  /consul/connect-inject from consul-connect-inject-data (rw)
  /var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)

Containers:
api:
Container ID:
Image: nicholasjackson/fake-service:v0.7.8
Image ID:
Port: 9090/TCP
Host Port: 0/TCP
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Environment:
LISTEN_ADDR: 127.0.0.1:9090
NAME: api-v1
MESSAGE: Response from API v1
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)
envoy-sidecar:
Container ID:
Image: envoyproxy/envoy-alpine:v1.16.0
Image ID:
Port:
Host Port:
Command:
envoy
--config-path
/consul/connect-inject/envoy-bootstrap.yaml
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Environment:
HOST_IP: (v1:status.hostIP)
CONSUL_HTTP_ADDR: $(HOST_IP):8500
Mounts:
/consul/connect-inject from consul-connect-inject-data (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)
consul-sidecar:
Container ID:
Image: hashicorp/consul-k8s:0.25.0
Image ID:
Port:
Host Port:
Command:
consul-k8s
consul-sidecar
-service-config
/consul/connect-inject/service.hcl
-consul-binary
/consul/connect-inject/consul
-enable-metrics-merging=true
-merged-metrics-port=20100
-service-metrics-port=9090
-service-metrics-path=/metrics
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Limits:
cpu: 20m
memory: 50Mi
Requests:
cpu: 20m
memory: 25Mi
Environment:
HOST_IP: (v1:status.hostIP)
CONSUL_HTTP_ADDR: $(HOST_IP):8500
Mounts:
/consul/connect-inject from consul-connect-inject-data (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)
Conditions:
Type Status
Initialized False
Ready False
ContainersReady False
PodScheduled True
Volumes:
default-token-75xsg:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-75xsg
Optional: false
consul-connect-inject-data:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit:
QoS Class: Burstable
Node-Selectors:
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Pulled 58m (x36 over 3h38m) kubelet Container image "hashicorp/consul:1.9.4" already present on machine
Warning BackOff 3m49s (x953 over 3h38m) kubelet Back-off restarting failed container

The log of the consul-connec-inject-init container of the pod api-deployment-v1-6bcbd7bd68-8tllk is here:

2021-04-08T20:11:38.770684700+09:00 Registered service: api
2021-04-08T20:11:39.055657300+09:00 Registered service: api-sidecar-proxy
2021-04-08T20:11:43.055848300+09:00 flag provided but not defined: -prometheus-scrape-path
2021-04-08T20:11:43.055902300+09:00 Usage:
2021-04-08T20:11:43.055914300+09:00 -address value
2021-04-08T20:11:43.055925300+09:00 LAN address to advertise in the gateway service registration
2021-04-08T20:11:43.055931100+09:00 -admin-access-log-path string
2021-04-08T20:11:43.055965300+09:00 The path to write the access log for the administration server. If no access log is desired specify "/dev/null". By default it will use "/dev/null". (default "/dev/null")
2021-04-08T20:11:43.056048800+09:00 -admin-bind string
2021-04-08T20:11:43.056063300+09:00 The address:port to start envoy's admin server on. Envoy requires this but care must be taken to ensure it's not exposed to an untrusted network as it has full control over the secrets and config of the proxy. (default "localhost:19000")
2021-04-08T20:11:43.056072600+09:00 -bind-address =:
2021-04-08T20:11:43.056079500+09:00 Bind address to use instead of the default binding rules given as =: pairs. This flag may be specified multiple times to add multiple bind addresses.
2021-04-08T20:11:43.056085900+09:00 -bootstrap
2021-04-08T20:11:43.056092200+09:00 Generate the bootstrap.json but don't exec envoy
2021-04-08T20:11:43.056099400+09:00 -ca-file value
2021-04-08T20:11:43.056106500+09:00 Path to a CA file to use for TLS when communicating with Consul. This can also be specified via the CONSUL_CACERT environment variable.
2021-04-08T20:11:43.056113800+09:00 -ca-path value
2021-04-08T20:11:43.056120200+09:00 Path to a directory of CA certificates to use for TLS when communicating with Consul. This can also be specified via the CONSUL_CAPATH environment variable.
2021-04-08T20:11:43.056128300+09:00 -client-cert value
2021-04-08T20:11:43.056139100+09:00 Path to a client cert file to use for TLS when 'verify_incoming' is enabled. This can also be specified via the CONSUL_CLIENT_CERT environment variable.
2021-04-08T20:11:43.056150500+09:00 -client-key value
2021-04-08T20:11:43.056158800+09:00 Path to a client key file to use for TLS when 'verify_incoming' is enabled. This can also be specified via the CONSUL_CLIENT_KEY environment variable.
2021-04-08T20:11:43.056167100+09:00 -deregister-after-critical string
2021-04-08T20:11:43.056175800+09:00 The amount of time the gateway services health check can be failing before being deregistered (default "6h")
2021-04-08T20:11:43.056217200+09:00 -envoy-binary string
2021-04-08T20:11:43.056229700+09:00 The full path to the envoy binary to run. By default will just search $PATH. Ignored if -bootstrap is used.
2021-04-08T20:11:43.056235900+09:00 -envoy-version string
2021-04-08T20:11:43.056241100+09:00 Sets the envoy-version that the envoy binary has. (default "1.16.2")
2021-04-08T20:11:43.056246500+09:00 -expose-servers
2021-04-08T20:11:43.056254900+09:00 Expose the servers for WAN federation via this mesh gateway
2021-04-08T20:11:43.056434500+09:00 -gateway string
2021-04-08T20:11:43.056472400+09:00 The type of gateway to register. One of: terminating, ingress, or mesh
2021-04-08T20:11:43.056479300+09:00 -grpc-addr string
2021-04-08T20:11:43.056484500+09:00 Set the agent's gRPC address and port (in http(s)://host:port format). Alternatively, you can specify CONSUL_GRPC_ADDR in ENV. (default "192.168.237.71:8502")
2021-04-08T20:11:43.056490100+09:00 -http-addr address
2021-04-08T20:11:43.056494800+09:00 The address and port of the Consul HTTP agent. The value can be an IP address or DNS address, but it must also include the port. This can also be specified via the CONSUL_HTTP_ADDR environment variable. The default value is http://127.0.0.1:8500. The scheme can also be set to HTTPS by setting the environment variable CONSUL_HTTP_SSL=true.
2021-04-08T20:11:43.056541800+09:00 -mesh-gateway
2021-04-08T20:11:43.056548500+09:00 Configure Envoy as a Mesh Gateway.
2021-04-08T20:11:43.056554100+09:00 -namespace default
2021-04-08T20:11:43.056559200+09:00 Specifies the namespace to query. If not provided, the namespace will be inferred from the request's ACL token, or will default to the default namespace. Namespaces are a Consul Enterprise feature.
2021-04-08T20:11:43.056571300+09:00 -no-central-config
2021-04-08T20:11:43.056576300+09:00 By default the proxy's bootstrap configuration can be customized centrally. This requires that the command run on the same agent as the proxy will and that the agent is reachable when the command is run. In cases where either assumption is violated this flag will prevent the command attempting to resolve config from the local agent.
2021-04-08T20:11:43.056583800+09:00 -omit-deprecated-tags
2021-04-08T20:11:43.056589600+09:00 In Consul 1.9.0 the format of metric tags for Envoy clusters was updated from consul.[service|dc|...] to consul.destination.[service|dc|...]. The old tags were preserved for backward compatibility,but can be disabled with this flag.
2021-04-08T20:11:43.056614900+09:00 -proxy-id string
2021-04-08T20:11:43.056619500+09:00 The proxy's ID on the local agent.
2021-04-08T20:11:43.056625400+09:00 -register
2021-04-08T20:11:43.056630100+09:00 Register a new gateway service before configuring and starting Envoy
2021-04-08T20:11:43.056634300+09:00 -service string
2021-04-08T20:11:43.056638400+09:00 Service name to use for the registration
2021-04-08T20:11:43.056642400+09:00 -sidecar-for string
2021-04-08T20:11:43.056646600+09:00 The ID of a service instance on the local agent that this proxy should become a sidecar for. It requires that the proxy service is registered with the agent as a connect-proxy with Proxy.DestinationServiceID set to this value. If more than one such proxy is registered it will fail.
2021-04-08T20:11:43.056653200+09:00 -tls-server-name value
2021-04-08T20:11:43.056658200+09:00 The server name to use as the SNI host when connecting via TLS. This can also be specified via the CONSUL_TLS_SERVER_NAME environment variable.
2021-04-08T20:11:43.056677700+09:00 -token value
2021-04-08T20:11:43.056681600+09:00 ACL token to use in the request. This can also be specified via the CONSUL_HTTP_TOKEN environment variable. If unspecified, the query will default to the token of the Consul agent at the HTTP address.
2021-04-08T20:11:43.056685300+09:00 -token-file value
2021-04-08T20:11:43.056689000+09:00 File containing the ACL token to use in the request instead of one specified via the -token argument or CONSUL_HTTP_TOKEN environment variable. This can also be specified via the CONSUL_HTTP_TOKEN_FILE environment variable.
2021-04-08T20:11:43.056692500+09:00 -wan-address value
2021-04-08T20:11:43.056697000+09:00 WAN address to advertise in the gateway service registration. For ingress gateways, only an IP address (without a port) is required.

web:

Name: web-deployment-667ff8b4fb-7rjft
Namespace: default
Priority: 0
Node: 5cg0372q3t-wsl/192.168.237.71
Start Time: Thu, 08 Apr 2021 16:31:03 +0900
Labels: app=web
consul.hashicorp.com/connect-inject-status=injected
pod-template-hash=667ff8b4fb
Annotations: cni.projectcalico.org/podIP: 10.1.32.114/32
cni.projectcalico.org/podIPs: 10.1.32.114/32
consul.hashicorp.com/connect-inject: true
consul.hashicorp.com/connect-inject-status: injected
consul.hashicorp.com/connect-service: web
consul.hashicorp.com/connect-service-port: 9090
consul.hashicorp.com/connect-service-upstreams: api:9091
prometheus.io/path: /metrics
prometheus.io/port: 20200
prometheus.io/scrape: true
Status: Pending
IP: 10.1.32.114
IPs:
IP: 10.1.32.114
Controlled By: ReplicaSet/web-deployment-667ff8b4fb
Init Containers:
consul-connect-inject-init:
Container ID: containerd://13be514cb2c0f3df00148a6efddc7e1991527f1eedcb261326d2e73a49aa1c27
Image: hashicorp/consul:1.9.4
Image ID: docker.io/hashicorp/consul@sha256:2e55655255ae22ad386c5fd9dd1681b750b65d451009c28361dcca47f7dc09ce
Port:
Host Port:
Command:
/bin/sh
-ec

  export CONSUL_HTTP_ADDR="${HOST_IP}:8500"
  export CONSUL_GRPC_ADDR="${HOST_IP}:8502"

  # Register the service. The HCL is stored in the volume so that
  # the preStop hook can access it to deregister the service.
  cat <<EOF >/consul/connect-inject/service.hcl
  services {
    id   = "${SERVICE_ID}"
    name = "web"
    address = "${POD_IP}"
    port = 9090
    meta = {
      pod-name = "${POD_NAME}"
      k8s-namespace = "${POD_NAMESPACE}"
    }
  }

  services {
    id   = "${PROXY_SERVICE_ID}"
    name = "web-sidecar-proxy"
    kind = "connect-proxy"
    address = "${POD_IP}"
    port = 20000
    meta = {
      pod-name = "${POD_NAME}"
      k8s-namespace = "${POD_NAMESPACE}"
    }

    proxy {
    config {
      envoy_prometheus_bind_addr = "0.0.0.0:20200"
    }
      destination_service_name = "web"
      destination_service_id = "${SERVICE_ID}"
      local_service_address = "127.0.0.1"
      local_service_port = 9090
      upstreams {
        destination_type = "service"
        destination_name = "api"
        local_bind_port = 9091
      }
    }

    checks {
      name = "Proxy Public Listener"
      tcp = "${POD_IP}:20000"
      interval = "10s"
      deregister_critical_service_after = "10m"
    }

    checks {
      name = "Destination Alias"
      alias_service = "${SERVICE_ID}"
    }
  }
  EOF

  /bin/consul services register \
    /consul/connect-inject/service.hcl

  # Generate the envoy bootstrap code
  /bin/consul connect envoy \
    -proxy-id="${PROXY_SERVICE_ID}" \
    -prometheus-scrape-path="/metrics" \
    -prometheus-backend-port="20100" \
    -bootstrap > /consul/connect-inject/envoy-bootstrap.yaml

  # Copy the Consul binary
  cp /bin/consul /consul/connect-inject/consul
State:          Terminated
  Reason:       Error
  Exit Code:    1
  Started:      Thu, 08 Apr 2021 20:09:37 +0900
  Finished:     Thu, 08 Apr 2021 20:09:47 +0900
Last State:     Terminated
  Reason:       Error
  Exit Code:    1
  Started:      Thu, 08 Apr 2021 20:04:20 +0900
  Finished:     Thu, 08 Apr 2021 20:04:29 +0900
Ready:          False
Restart Count:  46
Limits:
  cpu:     50m
  memory:  150Mi
Requests:
  cpu:     50m
  memory:  25Mi
Environment:
  HOST_IP:            (v1:status.hostIP)
  POD_IP:             (v1:status.podIP)
  POD_NAME:          web-deployment-667ff8b4fb-7rjft (v1:metadata.name)
  POD_NAMESPACE:     default (v1:metadata.namespace)
  SERVICE_ID:        $(POD_NAME)-web
  PROXY_SERVICE_ID:  $(POD_NAME)-web-sidecar-proxy
Mounts:
  /consul/connect-inject from consul-connect-inject-data (rw)
  /var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)

Containers:
web:
Container ID:
Image: nicholasjackson/fake-service:v0.7.8
Image ID:
Port: 9090/TCP
Host Port: 0/TCP
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Environment:
LISTEN_ADDR: 0.0.0.0:9090
UPSTREAM_URIS: http://localhost:9091
NAME: web
MESSAGE: Hello World
API_CONNECT_SERVICE_HOST: 127.0.0.1
API_CONNECT_SERVICE_PORT: 9091
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)
envoy-sidecar:
Container ID:
Image: envoyproxy/envoy-alpine:v1.16.0
Image ID:
Port:
Host Port:
Command:
envoy
--config-path
/consul/connect-inject/envoy-bootstrap.yaml
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Environment:
HOST_IP: (v1:status.hostIP)
CONSUL_HTTP_ADDR: $(HOST_IP):8500
Mounts:
/consul/connect-inject from consul-connect-inject-data (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)
consul-sidecar:
Container ID:
Image: hashicorp/consul-k8s:0.25.0
Image ID:
Port:
Host Port:
Command:
consul-k8s
consul-sidecar
-service-config
/consul/connect-inject/service.hcl
-consul-binary
/consul/connect-inject/consul
-enable-metrics-merging=true
-merged-metrics-port=20100
-service-metrics-port=9090
-service-metrics-path=/metrics
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Limits:
cpu: 20m
memory: 50Mi
Requests:
cpu: 20m
memory: 25Mi
Environment:
HOST_IP: (v1:status.hostIP)
CONSUL_HTTP_ADDR: $(HOST_IP):8500
Mounts:
/consul/connect-inject from consul-connect-inject-data (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-75xsg (ro)
Conditions:
Type Status
Initialized False
Ready False
ContainersReady False
PodScheduled True
Volumes:
default-token-75xsg:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-75xsg
Optional: false
consul-connect-inject-data:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit:
QoS Class: Burstable
Node-Selectors:
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning BackOff 3m46s (x958 over 3h38m) kubelet Back-off restarting failed container

The log for consul-connect-inject-init of the pod web-deployment-667ff8b4fb-7rjft is here:

2021-04-08T20:15:02.355318800+09:00 Registered service: web
2021-04-08T20:15:02.455177300+09:00 Registered service: web-sidecar-proxy
2021-04-08T20:15:06.658419100+09:00 flag provided but not defined: -prometheus-scrape-path
2021-04-08T20:15:06.658451600+09:00 Usage:
2021-04-08T20:15:06.658458200+09:00 -address value
2021-04-08T20:15:06.658464400+09:00 LAN address to advertise in the gateway service registration
2021-04-08T20:15:06.658469200+09:00 -admin-access-log-path string
2021-04-08T20:15:06.658474200+09:00 The path to write the access log for the administration server. If no access log is desired specify "/dev/null". By default it will use "/dev/null". (default "/dev/null")
2021-04-08T20:15:06.658489100+09:00 -admin-bind string
2021-04-08T20:15:06.658494600+09:00 The address:port to start envoy's admin server on. Envoy requires this but care must be taken to ensure it's not exposed to an untrusted network as it has full control over the secrets and config of the proxy. (default "localhost:19000")
2021-04-08T20:15:06.658500600+09:00 -bind-address =:
2021-04-08T20:15:06.658505200+09:00 Bind address to use instead of the default binding rules given as =: pairs. This flag may be specified multiple times to add multiple bind addresses.
2021-04-08T20:15:06.658511600+09:00 -bootstrap
2021-04-08T20:15:06.658516100+09:00 Generate the bootstrap.json but don't exec envoy
2021-04-08T20:15:06.658521100+09:00 -ca-file value
2021-04-08T20:15:06.658525900+09:00 Path to a CA file to use for TLS when communicating with Consul. This can also be specified via the CONSUL_CACERT environment variable.
2021-04-08T20:15:06.658530600+09:00 -ca-path value
2021-04-08T20:15:06.658535300+09:00 Path to a directory of CA certificates to use for TLS when communicating with Consul. This can also be specified via the CONSUL_CAPATH environment variable.
2021-04-08T20:15:06.658540200+09:00 -client-cert value
2021-04-08T20:15:06.658544800+09:00 Path to a client cert file to use for TLS when 'verify_incoming' is enabled. This can also be specified via the CONSUL_CLIENT_CERT environment variable.
2021-04-08T20:15:06.658549100+09:00 -client-key value
2021-04-08T20:15:06.658553500+09:00 Path to a client key file to use for TLS when 'verify_incoming' is enabled. This can also be specified via the CONSUL_CLIENT_KEY environment variable.
2021-04-08T20:15:06.658557800+09:00 -deregister-after-critical string
2021-04-08T20:15:06.658562100+09:00 The amount of time the gateway services health check can be failing before being deregistered (default "6h")
2021-04-08T20:15:06.658568200+09:00 -envoy-binary string
2021-04-08T20:15:06.658572900+09:00 The full path to the envoy binary to run. By default will just search $PATH. Ignored if -bootstrap is used.
2021-04-08T20:15:06.658577500+09:00 -envoy-version string
2021-04-08T20:15:06.658582000+09:00 Sets the envoy-version that the envoy binary has. (default "1.16.2")
2021-04-08T20:15:06.658598400+09:00 -expose-servers
2021-04-08T20:15:06.658603000+09:00 Expose the servers for WAN federation via this mesh gateway
2021-04-08T20:15:06.658607400+09:00 -gateway string
2021-04-08T20:15:06.658611700+09:00 The type of gateway to register. One of: terminating, ingress, or mesh
2021-04-08T20:15:06.658616000+09:00 -grpc-addr string
2021-04-08T20:15:06.658620700+09:00 Set the agent's gRPC address and port (in http(s)://host:port format). Alternatively, you can specify CONSUL_GRPC_ADDR in ENV. (default "192.168.237.71:8502")
2021-04-08T20:15:06.658625500+09:00 -http-addr address
2021-04-08T20:15:06.658630700+09:00 The address and port of the Consul HTTP agent. The value can be an IP address or DNS address, but it must also include the port. This can also be specified via the CONSUL_HTTP_ADDR environment variable. The default value is http://127.0.0.1:8500. The scheme can also be set to HTTPS by setting the environment variable CONSUL_HTTP_SSL=true.
2021-04-08T20:15:06.658654200+09:00 -mesh-gateway
2021-04-08T20:15:06.658659300+09:00 Configure Envoy as a Mesh Gateway.
2021-04-08T20:15:06.658664700+09:00 -namespace default
2021-04-08T20:15:06.658669200+09:00 Specifies the namespace to query. If not provided, the namespace will be inferred from the request's ACL token, or will default to the default namespace. Namespaces are a Consul Enterprise feature.
2021-04-08T20:15:06.658674100+09:00 -no-central-config
2021-04-08T20:15:06.658678800+09:00 By default the proxy's bootstrap configuration can be customized centrally. This requires that the command run on the same agent as the proxy will and that the agent is reachable when the command is run. In cases where either assumption is violated this flag will prevent the command attempting to resolve config from the local agent.
2021-04-08T20:15:06.658685100+09:00 -omit-deprecated-tags
2021-04-08T20:15:06.658689900+09:00 In Consul 1.9.0 the format of metric tags for Envoy clusters was updated from consul.[service|dc|...] to consul.destination.[service|dc|...]. The old tags were preserved for backward compatibility,but can be disabled with this flag.
2021-04-08T20:15:06.658694400+09:00 -proxy-id string
2021-04-08T20:15:06.658701400+09:00 The proxy's ID on the local agent.
2021-04-08T20:15:06.658708500+09:00 -register
2021-04-08T20:15:06.658713100+09:00 Register a new gateway service before configuring and starting Envoy
2021-04-08T20:15:06.658717400+09:00 -service string
2021-04-08T20:15:06.658722000+09:00 Service name to use for the registration
2021-04-08T20:15:06.658726700+09:00 -sidecar-for string
2021-04-08T20:15:06.658780200+09:00 The ID of a service instance on the local agent that this proxy should become a sidecar for. It requires that the proxy service is registered with the agent as a connect-proxy with Proxy.DestinationServiceID set to this value. If more than one such proxy is registered it will fail.
2021-04-08T20:15:06.658793800+09:00 -tls-server-name value
2021-04-08T20:15:06.658799200+09:00 The server name to use as the SNI host when connecting via TLS. This can also be specified via the CONSUL_TLS_SERVER_NAME environment variable.
2021-04-08T20:15:06.658803600+09:00 -token value
2021-04-08T20:15:06.658808100+09:00 ACL token to use in the request. This can also be specified via the CONSUL_HTTP_TOKEN environment variable. If unspecified, the query will default to the token of the Consul agent at the HTTP address.
2021-04-08T20:15:06.658812500+09:00 -token-file value
2021-04-08T20:15:06.658817200+09:00 File containing the ACL token to use in the request instead of one specified via the -token argument or CONSUL_HTTP_TOKEN environment variable. This can also be specified via the CONSUL_HTTP_TOKEN_FILE environment variable.
2021-04-08T20:15:06.658821800+09:00 -wan-address value
2021-04-08T20:15:06.658826400+09:00 WAN address to advertise in the gateway service registration. For ingress gateways, only an IP address (without a port) is required.

Thanks for your help.

[lkysow]

Hi, you must use the Helm values yaml from the learn guide. You're using a difference Helm yaml because your consul version is 1.9.4 but it needs to use 1.10.0-alpha1:

global:
  name: consul
  datacenter: dc1
  image: hashicorp/consul:1.10.0-alpha
  metrics:
    # Configures the Helm chart’s components to expose Prometheus metrics for the Consul service mesh.
    enabled: true
    # Publishes consul agent metrics. Only applicable if  global.metrics.enabled is true.
    enableAgentMetrics: true
server:
  replicas: 1
ui:
  enabled: true
connectInject:
  enabled: true
  default: true
  # Configures metrics for Consul service mesh services. All values are overridable
  # via annotations on a per-pod basis.
  metrics:
    # Configures the Consul sidecar to run a merged metrics server
    # to combine and serve both Envoy and Application metrics.
    defaultEnableMerging: true
controller:
  enabled: true
# prometheus configures a Prometheus installation.
prometheus:
  # When true, the Helm chart will install a demo Prometheus server
  # instance alongside Consul.
  enabled: true
# grafana configures a Grafana installation.
grafana:
  # When true, the Helm chart will install a demo grafana instance
  # alongside Consul.
  enabled: true

[Shige99011]

Thanks for your quick response, @lkysow .
I tried your helm values.yaml and confirmed the errors have gone!! I can make the learning go ahead, anyway.
By the way, when will the new version of consul(v1.10.0) be released?

Thank you.

[lkysow]

We're planning to release a beta in the next week or two. The GA release does not have a date yet.

[grishy]

It would be cool to make a note at:
https://learn.hashicorp.com/tutorials/consul/service-mesh-application-secure-networking?in=consul/gs-consul-service-mesh

[lkysow]

@grishy sorry, what should the note say?

[grishy]

Hmmm.
This was apparently changed recently. (page with tutorial)
I had the same error although I walked the steps. This is how I found this issue
@lkysow

[lkysow]

Oh gotcha, yeah we must have updated it. Sorry for the trouble.