From 10867af9b9b57a7d53a54b2aca6e99fe0d2463e4 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 9 Oct 2026 22:53:03 +1100
Subject: [PATCH] Gate consul readiness on raft leader, drop container caps

---
 apps/overlays/au-syd1/consul/statefulset.yaml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/apps/overlays/au-syd1/consul/statefulset.yaml b/apps/overlays/au-syd1/consul/statefulset.yaml
index 48aabd1..8f42c2f 100644
--- a/apps/overlays/au-syd1/consul/statefulset.yaml
+++ b/apps/overlays/au-syd1/consul/statefulset.yaml
@@ -42,6 +42,10 @@ spec:
       containers:
         - name: consul
           image: hashicorp/consul:1.22.7
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
           command:
             - /bin/sh
             - -ec
@@ -65,8 +69,11 @@ spec:
             - {name: dns-tcp, containerPort: 8600, protocol: TCP}
             - {name: dns-udp, containerPort: 8600, protocol: UDP}
           readinessProbe:
-            tcpSocket:
-              port: 8301
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - wget -qO- http://127.0.0.1:8500/v1/status/leader | grep -q ':8300'
             initialDelaySeconds: 5
             periodSeconds: 10
           resources: