Consul: support multiple datacenters with diffrent encryption keys

[wayhome]

I have two datacenters, they use diffrent encryption keys. So the consul join -wan will failed with "[ERR] memberlist: failed to receive: No installed keys could decrypt the message".

I run the consul keyring --list, it tell me the WAN and LAN use the same encryption key .

Is there a way to make the WAN and LAN to use the diffrent key, so I can use the WAN encryption key only for communication with other datacenter.

[kamaradclimber]

I am impacted by the same issue on consul 0.5.2

We've added encryption to ensure that no poorly configured agent could make two clusters join by mistake (which is hard to undo).

But now encrypted clusters cannot talk to each other via wan.

It this behavior the intent?

[slackpad]

Hi @youngking and @kamaradclimber you are correct, the current key goes to both WAN and LAN. We will take a look at making this more flexible.

[pradeepnss]

Any updates on this issue ?

[xavvo]

for the moment, the only help to get this going is to write into the remote keyring yourself and then restart the servers. And don't use the keyring command or API after that 8)

[slackpad]

We are going to close this out against the network areas feature in Consul Enterprise.

Network areas perform all their gossip over TCP, which can be secured with TLS, so this is a much more manageable solution than supporting multiple gossip keys for the WAN. After looking into this, the plumbing and management around gossip keys is really complex, so adding the ability to selectively manage different keys in different datacenters would be difficult to implement and use. Network areas, in combination with new TLS configs like ca_path make it much easier to delegate authority and manage encryption when there are a large number of Consul clusters joined on the WAN.

[xavvo]

Hmmm. Can I read this, that we will have network areas available to the public any time soon?