From 3d2bdec0b8d2e7c712b51280a43690aa72140e53 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 25 Jul 2026 17:06:09 +1000
Subject: [PATCH] Route consul API hostname to the HTTP API (8500)

Phase 2 of the consul VM->k8s migration: terraform backends, the Vault
consul secret engine, and puppet all need the consul HTTP API reachable at
consul.k8s.syd1.au.unkin.net. The Gateway/HTTPRoutes currently send both
that hostname and the consul.service.consul listener to consul-ui:80,
which serves only the UI, not the /v1 API. Consul serves the HTTP API and
the UI (/ui/) on the same port 8500, so routing everything to 8500
preserves the UI while exposing the API.

- Add a consul-http ClusterIP service selecting the consul server pods
  (app=consul, component=server, release=consul) on port 8500.
- Repoint the consul and consul-svc HTTPRoutes from consul-ui:80 to
  consul-http:8500.
---
 apps/base/consul/httproute.yaml     |  8 ++++----
 apps/base/consul/kustomization.yaml |  1 +
 apps/base/consul/service.yaml       | 25 +++++++++++++++++++++++++
 3 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 apps/base/consul/service.yaml

diff --git a/apps/base/consul/httproute.yaml b/apps/base/consul/httproute.yaml
index 34e4f95..8e83bce 100644
--- a/apps/base/consul/httproute.yaml
+++ b/apps/base/consul/httproute.yaml
@@ -46,8 +46,8 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: consul-ui
-          port: 80
+          name: consul-http
+          port: 8500
           weight: 1
       matches:
         - path:
@@ -74,8 +74,8 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: consul-ui
-          port: 80
+          name: consul-http
+          port: 8500
           weight: 1
       matches:
         - path:
diff --git a/apps/base/consul/kustomization.yaml b/apps/base/consul/kustomization.yaml
index 217d383..bfc5f94 100644
--- a/apps/base/consul/kustomization.yaml
+++ b/apps/base/consul/kustomization.yaml
@@ -6,5 +6,6 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
+  - service.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
diff --git a/apps/base/consul/service.yaml b/apps/base/consul/service.yaml
new file mode 100644
index 0000000..9737123
--- /dev/null
+++ b/apps/base/consul/service.yaml
@@ -0,0 +1,25 @@
+---
+# ClusterIP service targeting the consul server pods' HTTP API (8500).
+# The HashiCorp chart only ships consul-ui (also 8500 via the server pods)
+# and the headless consul-server; this named service gives the Gateway a
+# stable API backend. Consul serves both the HTTP API and the UI (at /ui/)
+# on this same port, so routing the API hostname here preserves the UI too.
+apiVersion: v1
+kind: Service
+metadata:
+  name: consul-http
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  type: ClusterIP
+  selector:
+    app: consul
+    component: server
+    release: consul
+  ports:
+    - name: http
+      port: 8500
+      protocol: TCP
+      targetPort: 8500