Consul starts slowly on AWS CENTOS 7 AMI's. Can be fixed by removing sudo from run-consul
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
Any scripts that run in user data of Centos AMI's on AWS that use 'sudo' in the line have a 25 second delay due to some bug in the standard Centos image build. This is not Hashicorp's problem, but it is possible for us to make a minor change to speed up instance boot time.
The run-consul script contains these lines:
```
sudo systemctl daemon-reload
sudo systemctl enable consul.service
sudo systemctl restart consul.service
```
Which seems strange to me since all the documentation I have seen executes run-consul itself with sudo, so I would think that it is unnecesary to define it again in the run-consul script.
By removing sudo in these lines and executing run-consul as usual in user data and not using sudo, reduced Centos user data startup time in AWS from 1.5 minutes to about 3 seconds in my tests (while generating ssh host certificates in my use case):
```
[centos@ip-10-4-102-134 ~]$ cat /var/log/user-data.log
127.0.0.1 ip-10-4-102-134.ap-southeast-2.compute.internal ip-10-4-102-134
2021-02-14 07:26:51 hostname: ip-10-4-102-134.ap-southeast-2.compute.internal
2021-02-14 07:26:51 hostname: ip-10-4-102-134.ap-southeast-2.compute.internal ip-10-4-102-134
2021-02-14 07:26:51 [INFO] [run-consul] Creating default Consul configuration
2021-02-14 07:26:51 [INFO] [run-consul] Installing Consul config file in /opt/consul/config/default.json
2021-02-14 07:26:51 [INFO] [run-consul] Creating systemd config file to run Consul in /etc/systemd/system/consul.service
2021-02-14 07:26:51 [INFO] [run-consul] Reloading systemd config and starting Consul
2021-02-14 07:26:52 Waiting for Vault login
WARNING! The VAULT_TOKEN environment variable is set! This takes precedence
over the value set by this command. To use the value set by this command,
unset the VAULT_TOKEN environment variable or set it to the token displayed
below.
2021-02-14 07:26:52
2021-02-14 07:26:52 Aquiring vault data...
2021-02-14 07:26:52 Request Vault sign's the SSH host key and becomes a known host for other machines.
ssh-rsa
{
"request_id": "b1347acd-835f-8229-9229-13f2f01ed264",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"serial_number": "bbbac72a320b554a",
"signed_key": "ssh-rsa-cert-v01@openssh.com
},
"warnings": null
}
ssh-rsa-cert-v01@openssh.com
HostCertificate
2021-02-14 07:26:53 Creating /etc/ssh/ssh_known_hosts
2021-02-14 07:26:53 /etc/ssh/ssh_known_hosts octal_permissions currently 0644.
@cert-authority *.consul,*.ap-southeast-2.compute.amazonaws.com
9442133 -rw-r--r--. 1 root root 789 Feb 14 07:26 /etc/ssh/ssh_known_hosts
2021-02-14 07:26:53 Added CA to /etc/ssh/ssh_known_hosts.
2021-02-14 07:26:53 Creating /home/centos/.ssh/known_hosts
2021-02-14 07:26:53 /home/centos/.ssh/known_hosts octal_permissions currently 0644.
@cert-authority *.consul,*.ap-southeast-2.compute.amazonaws.com
16971 -rw-r--r--. 1 root root 789 Feb 14 07:26 /home/centos/.ssh/known_hosts
2021-02-14 07:26:53 Added CA to /home/centos/.ssh/known_hosts.
TrustedUserCAKeys
2021-02-14 07:26:53 Signing SSH host key done. Revoking vault token...
Success! Revoked token (if it existed)
```
Contributor guide
Assessment
This issue has not been assessed yet.