From b7d976a82bf7fbb88b044cdf0499c2201a4dc0e5 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 25 Jul 2026 17:05:29 +1000
Subject: [PATCH] Enable ACLs on k8s consul with Vault-sourced bootstrap token

Phase 1 of the consul VM->k8s migration: bring the k8s consul cluster to
ACL parity with the authoritative VM cluster before snapshot-restore. The
VM cluster runs ACLs enabled with default_policy deny and down_policy
extend-cache; the k8s cluster currently runs with ACLs disabled. Sourcing
the bootstrap/management token from Vault lets the k8s cluster bootstrap
with the SAME initial_management token as the VM cluster, so puppet
automation and the eventual snapshot-restore line up. No token material is
placed in git.

- Enable global.acls.manageSystemACLs so the chart manages system ACL
  tokens/policies for consul components.
- Point global.acls.bootstrapToken at a pre-existing Kubernetes secret
  consul-bootstrap-acl-token (key token); when populated the
  server-acl-init job skips bootstrapping and adopts that token as the
  management token.
- Add a VaultAuth (mount k8s/au/syd1, role default) and VaultStaticSecret
  in the consul namespace that sync kv/kubernetes/namespace/consul/default/
  bootstrap-acl-token into the consul-bootstrap-acl-token secret via VSO.
- Merge the acl block (enabled, default_policy deny, down_policy
  extend-cache, enable_token_persistence) into the server extraConfig to
  match the VM cluster posture.
---
 apps/base/consul/kustomization.yaml      |  2 ++
 apps/base/consul/vaultauth.yaml          | 18 ++++++++++++++++++
 apps/base/consul/vaultstaticsecret.yaml  | 17 +++++++++++++++++
 apps/overlays/au-syd1/consul/values.yaml | 19 +++++++++++++++++++
 4 files changed, 56 insertions(+)
 create mode 100644 apps/base/consul/vaultauth.yaml
 create mode 100644 apps/base/consul/vaultstaticsecret.yaml

diff --git a/apps/base/consul/kustomization.yaml b/apps/base/consul/kustomization.yaml
index 2c2b5da..217d383 100644
--- a/apps/base/consul/kustomization.yaml
+++ b/apps/base/consul/kustomization.yaml
@@ -6,3 +6,5 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
diff --git a/apps/base/consul/vaultauth.yaml b/apps/base/consul/vaultauth.yaml
new file mode 100644
index 0000000..af9bee0
--- /dev/null
+++ b/apps/base/consul/vaultauth.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: consul
+spec:
+  allowedNamespaces:
+    - consul
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
diff --git a/apps/base/consul/vaultstaticsecret.yaml b/apps/base/consul/vaultstaticsecret.yaml
new file mode 100644
index 0000000..6cd7a6d
--- /dev/null
+++ b/apps/base/consul/vaultstaticsecret.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: bootstrap-acl-token
+  namespace: consul
+spec:
+  destination:
+    create: true
+    name: consul-bootstrap-acl-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/consul/default/bootstrap-acl-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
diff --git a/apps/overlays/au-syd1/consul/values.yaml b/apps/overlays/au-syd1/consul/values.yaml
index 424c6ee..cc9f434 100644
--- a/apps/overlays/au-syd1/consul/values.yaml
+++ b/apps/overlays/au-syd1/consul/values.yaml
@@ -3,6 +3,19 @@ global:
   datacenter: au-syd1
   domain: consul
 
+  acls:
+    # Enable chart-managed ACL tokens/policies for Consul system components.
+    manageSystemACLs: true
+    # Source the bootstrap/management token from a pre-existing Kubernetes secret
+    # instead of letting the chart generate one. The secret is synced from Vault
+    # via VSO (see ../../../base/consul/vaultauth.yaml and vaultstaticsecret.yaml).
+    # When this secret is populated the server-acl-init job SKIPS bootstrapping and
+    # uses the supplied token as the management token, so the k8s cluster bootstraps
+    # with the SAME initial_management token as the authoritative VM cluster.
+    bootstrapToken:
+      secretName: consul-bootstrap-acl-token
+      secretKey: token
+
 server:
   image: hashicorp/consul:1.22.7
   replicas: 5
@@ -17,6 +30,12 @@ server:
 
   extraConfig: |
     {
+      "acl": {
+        "enabled": true,
+        "default_policy": "deny",
+        "down_policy": "extend-cache",
+        "enable_token_persistence": true
+      },
       "disable_remote_exec": true,
       "disable_update_check": true,
       "performance": {