consul-template template rendering order

[Nick Taylor]

Hi, we are trying to ensure a particular rendering order for a set of consul-templates on the same server. In particular, we want to make sure that one of the templates is the last one to be rendered, because that template's exec command depends on all files generated by the other templates.

In the documentation it says: 

"If a directory is given instead of a file, all files in the directory (recursively) will be merged in lexical order. So if multiple files declare a "consul" key for instance, the last one will be used."

What happens if we are specifying via files instead? Is there a way to ensure a specific order this way?

[Adam Greene]

in my hard-learned experience with what is currently master, the answer is 'no'.  I had 3 config files (cert, ca, and haproxy.cfg), and the haproxy.cfg was getting rendered and its command was triggered before the cert and CA were rendered... putting the templates in a particular order didn't matter.

what I have found that works is to use the new exec mode, such as:

template {

  source      = "/consul-template/template.d/internal-proxy.service.consul.pem.tmpl"

  perms       = 0400

  destination = "/etc/haproxy/ssl/internal-proxy.service.consul.pem"

}

template {

  source      = "/consul-template/template.d/service.capsci.ca.pem.tmpl"

  perms       = 0400

  destination = "/etc/haproxy/ssl/service.consul.ca.pem"

}

template {

  source      = "/consul-template/template.d/haproxy.tmpl"

  destination = "/etc/haproxy/haproxy.cfg"

}

exec {

  command       = "/haproxy_run.sh"

  reload_signal = "SIGUSR1"

  kill_signal   = "SIGTERM"

  splay         = "5s"

  kill_timeout  = "30s"

}

the problem I'm having, and I'll send an email shortly, is that the reload_signal isn't being sent, so in my case, the cert is expiring, it is being re-written to disk, but haproxy isn't being restarted and thus starts to fail because of the expired cert.  But otherwise it works like a charm :)

Oh, and I forgot to mention, I'm using master and not the latest official release because of some recent patches that I needed... your milage may vary.  

[James Phillips]

Hi Nick and Adam,

There's currently no control over the order. Because Go randomizes ranges over maps, they actually get shuffled here:

https://github.com/hashicorp/consul-template/blob/master/runner.go#L569-L575

Using exec mode is an interesting way to control this at startup. The child process won't be run for the first time until all the templates have been rendered once. I don't think this'll fix Nick's use case though, where you want to render the other files for sure first and then trigger on the last one. That would require a code change to recover the configured order of the templates.

-- James

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/consul/issues
IRC: #consul on Freenode
---
You received this message because you are subscribed to the Google Groups "Consul" group.
To unsubscribe from this group and stop receiving emails from it, send an email to consul-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/consul-tool/d7434651-12db-4b93-b7c3-e69e4f36eb9a%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Adam Greene]

hey james,

that isn't the behavior I'm seeing with exec; it always seems to render after all the templates have been rendered.  I tested this out a fair amount, but of course I could have gotten lucky.  However, the docs do say that it is run after all the templates are triggered... so I'm hoping the docs aren't wrong!

To unsubscribe from this group and stop receiving emails from it, send an email to consul-tool...@googlegroups.com.

[James Phillips]

Ah indeed, sorry I missed that - it does have one signal to the child after the loop over the templates:

https://github.com/hashicorp/consul-template/blob/master/runner.go#L496-L502

To unsubscribe from this group and stop receiving emails from it, send an email to consul-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/consul-tool/186add24-927a-4edf-b837-1cb7861cbeb7%40googlegroups.com.

[Nick Taylor]

The issue we're having is that certain post-render commands (in this case, restarts) are running before all our templates (config files) are rendered. Is there were a way to run consul-template in a "render-only" mode, and not run the post-render commands? Could the -once option help here?

[James Phillips]

Hi Nick,

Bubbling this one back up - did you figure out a solution? The once mode might help, but it changes how you run your service.

-- James

To unsubscribe from this group and stop receiving emails from it, send an email to consul-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/consul-tool/7fe15a36-eb75-4cd4-85b0-bc96b185e8ae%40googlegroups.com.