hashicorp / hashicorp/consul

Consul starts slowly on AWS CENTOS 7 AMI's. Can be fixed by removing sudo from run-consul

Open
#9,767 0 comments 0 reactions 0 assignees View on GitHub
theme/packaging type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

Any scripts that run in user data of Centos AMI's on AWS that use 'sudo' in the line have a 25 second delay due to some bug in the standard Centos image build. This is not Hashicorp's problem, but it is possible for us to make a minor change to speed up instance boot time.

The run-consul script contains these lines:
```
sudo systemctl daemon-reload
sudo systemctl enable consul.service
sudo systemctl restart consul.service
```

Which seems strange to me since all the documentation I have seen executes run-consul itself with sudo, so I would think that it is unnecesary to define it again in the run-consul script.
By removing sudo in these lines and executing run-consul as usual in user data and not using sudo, reduced Centos user data startup time in AWS from 1.5 minutes to about 3 seconds in my tests (while generating ssh host certificates in my use case):

```
[centos@ip-10-4-102-134 ~]$ cat /var/log/user-data.log
127.0.0.1 ip-10-4-102-134.ap-southeast-2.compute.internal ip-10-4-102-134
2021-02-14 07:26:51 hostname: ip-10-4-102-134.ap-southeast-2.compute.internal
2021-02-14 07:26:51 hostname: ip-10-4-102-134.ap-southeast-2.compute.internal ip-10-4-102-134
2021-02-14 07:26:51 [INFO] [run-consul] Creating default Consul configuration
2021-02-14 07:26:51 [INFO] [run-consul] Installing Consul config file in /opt/consul/config/default.json
2021-02-14 07:26:51 [INFO] [run-consul] Creating systemd config file to run Consul in /etc/systemd/system/consul.service
2021-02-14 07:26:51 [INFO] [run-consul] Reloading systemd config and starting Consul
2021-02-14 07:26:52 Waiting for Vault login
WARNING! The VAULT_TOKEN environment variable is set! This takes precedence
over the value set by this command. To use the value set by this command,
unset the VAULT_TOKEN environment variable or set it to the token displayed
below.

2021-02-14 07:26:52

2021-02-14 07:26:52 Aquiring vault data...
2021-02-14 07:26:52 Request Vault sign's the SSH host key and becomes a known host for other machines.
ssh-rsa
{
"request_id": "b1347acd-835f-8229-9229-13f2f01ed264",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"serial_number": "bbbac72a320b554a",
"signed_key": "ssh-rsa-cert-v01@openssh.com
},
"warnings": null
}
ssh-rsa-cert-v01@openssh.com
HostCertificate
2021-02-14 07:26:53 Creating /etc/ssh/ssh_known_hosts
2021-02-14 07:26:53 /etc/ssh/ssh_known_hosts octal_permissions currently 0644.
@cert-authority *.consul,*.ap-southeast-2.compute.amazonaws.com
9442133 -rw-r--r--. 1 root root 789 Feb 14 07:26 /etc/ssh/ssh_known_hosts
2021-02-14 07:26:53 Added CA to /etc/ssh/ssh_known_hosts.
2021-02-14 07:26:53 Creating /home/centos/.ssh/known_hosts
2021-02-14 07:26:53 /home/centos/.ssh/known_hosts octal_permissions currently 0644.
@cert-authority *.consul,*.ap-southeast-2.compute.amazonaws.com
16971 -rw-r--r--. 1 root root 789 Feb 14 07:26 /home/centos/.ssh/known_hosts
2021-02-14 07:26:53 Added CA to /home/centos/.ssh/known_hosts.
TrustedUserCAKeys
2021-02-14 07:26:53 Signing SSH host key done. Revoking vault token...
Success! Revoked token (if it existed)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.