时间戳

首页 > 解决方案 > 服务器还活着，但客户端没有！“没有安装的密钥可以解密消息”，如何在领事上解决这个问题？

consul - 服务器还活着，但客户端没有！“没有安装的密钥可以解密消息”，如何在领事上解决这个问题？

问题描述

一旦我启用encrypt，我所有的领事集群都失败了。这是sudo systemctl consul status：

memberlist：接收失败：没有安装的密钥可以解密

Nov 01 08:49:30 server-1 consul[593217]: 2021-11-01T08:49:30.031+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.7:37442
Nov 01 08:49:58 server-1 consul[593217]: 2021-11-01T08:49:58.992+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.4:41492
Nov 01 08:49:59 server-1 consul[593217]: 2021-11-01T08:49:59.882+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.12:35558
Nov 01 08:50:00 server-1 consul[593217]: 2021-11-01T08:50:00.042+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.7:37460
Nov 01 08:50:29 server-1 consul[593217]: 2021-11-01T08:50:29.004+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.4:41510
Nov 01 08:50:29 server-1 consul[593217]: 2021-11-01T08:50:29.895+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.12:35576
Nov 01 08:50:30 server-1 consul[593217]: 2021-11-01T08:50:30.056+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.7:37478
Nov 01 08:50:59 server-1 consul[593217]: 2021-11-01T08:50:59.018+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.4:41528
Nov 01 08:50:59 server-1 consul[593217]: 2021-11-01T08:50:59.909+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.12:35594
Nov 01 08:51:00 server-1 consul[593217]: 2021-11-01T08:51:00.067+0330 [ERROR] agent.server.memberlist.lan: memberlist: failed to receive: No installed keys could decrypt the message from=10.10.10.7:37496

ACL和TLS被注释掉，我什至在我的所有注释中encrypt，clients但仍然收到上述输出。我该如何解决这个问题？谢谢。

标签： consulconsul-health-check

解决方案

encrypt您必须在两种类型的节点上具有完全相同的设置：服务器和客户端。或者，您必须在任何地方禁用加密。您可以参考官方教程在现有集群上逐步启用加密。

UPD： 在所有节点（客户端和服务器）中使用一个密钥的一些有用命令。

从所有节点获取密钥信息

consul keyring -list

生成新密钥

consul keygen

向所有节点广播新密钥

consul keyring -install=<<KEY>>

切换到新密钥

consul keyring -use=<<KEY>>

推荐阅读