hashicorp / consul

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
https://www.consul.io
Other
28.4k stars 4.43k forks source link

Grpc Health Check: tls_skip_verify value is ignored #19110

Closed MaheshBGajera closed 1 year ago

MaheshBGajera commented 1 year ago

Overview of the Issue

I am registering a grpc service on consul with grpc health check. My service runs on self signed tls certificate and hence I want health check to skip cert verification and as documented, I used tls_skip_verify=true in this registration request but it has no effect, health check keeps on failing with error 'certificate signed by unknown authority'.

I am using latest version of consul.

here is the sample json payload which I use to register service to consul. { 'id': 'test', 'name': 'test', 'address': 'host ip here', 'port': 6666, 'check': { 'name': 'xyz-check', 'grpc': '127.0.0.1:6666', 'grpc_use_tls': true, 'tls_skip_verify': true, 'interval': '10s' }, 'enable_tag_override': false, 'meta': { 'maxCapacity':10, 'availableCapacity':10, 'usesTls': true' }, 'tags': [ 'test' ] }

Reproduction Steps

Use latest version of consul and register check for a grpc secure service where in service is running on self signed certificate. use skip_cert_verify=true to skip cert verification but it will be ignored.

Consul info for both Client and Server

Client info ``` agent: check_monitors = 0 check_ttls = 0 checks = 1 services = 1 build: prerelease = revision = 68f81912 version = 1.16.2 version_metadata = consul: acl = disabled known_servers = 1 server = false runtime: arch = amd64 cpu_count = 16 goroutines = 49 max_procs = 16 os = linux version = go1.20.8 serf_lan: coordinate_resets = 0 encrypted = false event_queue = 0 event_time = 8 failed = 0 health_score = 0 intent_queue = 0 left = 0 member_time = 5069 members = 5 query_queue = 0 query_time = 4 ``` ``` { "client_addr": "0.0.0.0", "data_dir": "/opt/consul", "datacenter":"test", "enable_script_checks": false, "log_level": "INFO", "retry_join": [ "test-server01.test.some.com" ], "server": false } ```

Operating system and Environment details

Linux #50~20.04.1-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux

MaheshBGajera commented 1 year ago

Please Ignore.

Issue is with Nodejs lib we use.