Cloud Parts

HashiCorp Consul

A service registry with health checks and a DNS interface, plus a service mesh that configures Envoy proxies for mTLS between services.

What it is
Service discovery & mesh,DNS,Coordination services
Type
Commercial product
Made by
HashiCorp, an IBM company
License
Business Source License 1.1 since 1.17 (source-available, not OSI open source); MPL 2.0 before the August 2023 change
Facts checked
5 October 2026
Website Source code

What it is

Consul is one binary that runs as an agent in one of two roles. Three or five server agents per datacenter hold the state: the service catalog, health check results, the key/value store and mesh configuration. They elect a leader and replicate every change with Raft, so a write counts only once a majority of servers has stored it. Client agents run on every machine, register the services there, run their health checks (an HTTP endpoint, a TCP port, a script) and forward requests to the servers. All agents in a datacenter also join a gossip pool built on HashiCorp’s Serf library, which spreads membership and detects failed nodes without the servers polling every machine. Apps find each other by asking an agent: a DNS query for payments.service.consul on port 8600 returns only instances that pass their checks, and the HTTP API returns the same data in more detail.

On top of the catalog sits the service mesh, first released as Connect in Consul 1.2 in 2018. The servers run a certificate authority (built in, or backed by Vault) and issue each service a certificate. Envoy sidecars, configured by Consul over Envoy’s xDS API, use those certificates for mutual TLS and enforce intentions, rules such as “web may call payments”. On Kubernetes and ECS, Consul dataplanes can replace the client agents, with a single gRPC connection to the servers instead of gossip. Consul moved from MPL 2.0 to the Business Source License with version 1.17 in 2023. HashiCorp’s hosted version, HCP Consul Dedicated, reached end of life on November 12, 2025, and Consul 2.0 (May 2026) switched to IBM’s versioning and support lifecycle.

Why teams pick it

  • One catalog and mesh across VMs, bare metal, Kubernetes, Amazon ECS, Lambda and Nomad, not just one Kubernetes cluster
  • The DNS interface lets existing apps find healthy instances without code changes or a client library
  • Health checks run on the agent next to each service, and failed instances drop out of DNS and API answers
  • mTLS and intentions with a built-in CA or Vault, plus L7 traffic splitting for canary and blue-green releases
  • Several datacenters can be joined with WAN federation or cluster peering, each keeping its own catalog

Watch out for

  • Business Source License since 1.17: free to use in production, but not OSI open source, and not allowed in a competing hosted or embedded product
  • Real operational work: a Raft quorum of servers, an agent or dataplane on every node, gossip encryption keys, ACL tokens and TLS; if a quorum of servers is lost, writes stop and recovery is manual
  • Edition split: Community edition’s mesh covers a single cluster, multi-tenancy (admin partitions, namespaces), read replicas, automated backups and audit logging need Enterprise, and an Enterprise Standard licence doesn’t cover the mesh at all
  • HCP Consul Dedicated, the managed version, ended on November 12, 2025; HashiCorp’s migration path is self-managed Consul Enterprise, not Community edition
  • The KV store is basic (values up to 512 KB) and feature complete: good for configuration, locks and leader election, not as a database

Alternatives

What all service discovery & mesh have in common →
EnvoyOpen sourceA C++ proxy for the edge and between services, configured live through the xDS APIs; the data plane under Istio, Envoy Gateway, Consul’s mesh and many others.IstioOpen sourceThe Kubernetes service mesh started by Google, IBM and Lyft: mutual TLS, traffic routing and telemetry between services, through Envoy sidecars or the sidecar-less ambient mode.

How it fits with other technologies

Register a service with a health check and an Envoy sidecar · hcl

# web.hcl
service {
  name = "web"
  port = 8080
  check {
    http     = "http://localhost:8080/health"
    interval = "10s" # fail it and web drops out of DNS answers
  }
  connect {
    sidecar_service {
      proxy {
        upstreams = [{
          destination_name = "payments"
          local_bind_port  = 9191 # web calls localhost:9191; Envoy adds mTLS
        }]
      }
    }
  }
}

# consul services register web.hcl
# consul connect envoy -sidecar-for web
# consul intention create -allow web payments
# dig @127.0.0.1 -p 8600 web.service.consul   # healthy instances only

Community edition, Enterprise and HCP#

Community edition is free under the BUSL. Enterprise comes in two licences, and the cheaper one leaves out the service mesh.

FeatureCommunityEnterprise StandardEnterprise Premium
Service discovery, DNS, KV storeYesYesYes
Service meshSingle cluster onlyNoYes
API, ingress and terminating gatewaysYesNoYes
Several runtimes in one deploymentNoYesYes
Admin partitions and namespacesNoYesYes
Read replicas, redundancy zones, automated backupsNoYesYes
Audit logging, OIDC login, FIPS 140-3 buildsNoYesYes
Locality-aware routing, fault injection, per-service rate limitsNoNoYes
  • HCP Consul Dedicated, the version HashiCorp ran for you, reached end of life on November 12, 2025. Its clusters can be migrated only to self-managed Consul Enterprise.
  • From 2.0, Consul follows IBM’s Version-Modification-Fix lifecycle: 2.0.x is planned to be supported until April 30, 2028. 1.21 was the last LTS release.

Alternatives#

Other ways to get discovery or a mesh, depending on where your services run.

Istio

CNCF graduated

A Kubernetes-first mesh with Envoy sidecars or a sidecar-less ambient mode. Also the base of the AKS add-on and Cloud Service Mesh on GKE.

Linkerd

CNCF graduated

A Kubernetes mesh with small Rust proxies and fewer knobs. The project ships edge releases; stable builds come from vendors such as Buoyant.

Cloud registries

managed

AWS Cloud Map and Google Service Directory keep a registry with DNS and API lookups as a managed service, so there are no servers to run. Cloud Map can also health-check instances.

Kubernetes Service DNS

built in

If everything runs in one cluster, Services already get stable DNS names backed by healthy pods, with no extra system to operate.

See it in a real stack

No architecture uses HashiCorp Consul yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2013–2026

By 2014 more teams were splitting applications into services on many machines, and every service had to find a database, a queue or another service, know which copies were healthy, and pick up settings such as a maintenance-mode flag. Existing answers covered parts of this. DNS worked everywhere but knew nothing about health and was cached unpredictably; ZooKeeper offered a consistent registry, but every app needed a client library for it.

HashiCorp co-founder Armon Dadgar announced Consul on April 17, 2014, as one tool for service discovery, health checking and key/value configuration, answering lookups over both DNS and HTTP and spanning several datacenters. The announcement argued that “distributed messaging, leader election, security, data storage are not components anyone should build from scratch”, so Consul reused HashiCorp’s Serf library, released the year before, for gossip, and Raft, a consensus algorithm from Stanford, for leader election.

Consul 1.2 added Connect in June 2018, turning the registry into a service mesh with certificates, intentions and sidecar proxies, and Envoy became the proxy Consul configures. In 2023 HashiCorp moved Consul to the Business Source License from version 1.17. IBM completed its purchase of HashiCorp in February 2025, HCP Consul Dedicated shut down that November, and Consul 2.0 arrived in May 2026.

Why it’s built this way

Gossip for membership, Raft only on the servers
Only the three to five servers take part in Raft, so thousands of client agents don’t slow down consensus. Membership and failure detection travel by gossip, which the announcement chose because it is lightweight and performant.
Health checks run by an agent on every node
The agent next to each service runs its checks and reports the result, so failure detection is spread across the cluster instead of a central poller, and DNS answers can leave out unhealthy instances.
DNS as the default way to discover services
Almost every program can already resolve a name. Answering name.service.consul lets existing apps use the catalog without code changes; the HTTP API is there for apps that want more.
Each datacenter keeps its own catalog
Catalogs aren’t replicated between datacenters by default. A request for another datacenter’s services is forwarded to that datacenter’s servers, so nothing has to keep one global copy in sync, but while a datacenter is unreachable its services are too.

Timeline

  1. 2013

    HashiCorp releases Serf, the gossip library Consul builds on

  2. 2014

    Consul 0.1 released in April

  3. 2017

    Consul 1.0 in October

  4. 2018

    Consul 1.2 adds Connect, its service mesh, in June

  5. 2023

    Moves to the Business Source License with version 1.17

  6. 2025

    IBM completes its HashiCorp acquisition; HCP Consul Dedicated ends in November

  7. 2026

    Consul 2.0 in May, on IBM’s versioning and support lifecycle

Sources34 · facts checked 5 October 2026

Improve this page on GitHub