forward consul zone to k8s consul DNS LB

The v3.13.0 images were never published (registry push failed), so the current pin cannot be pulled.

- pin api and ui images back to v3.12.0

Reviewed-on: #532
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/bind-internal/resolvers/forward-zones.yaml

@@ -1,10 +1,10 @@
 # Conditional forward zones, from the puppet openforwarder view.
-# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14,
+# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.200.5 (k8s consul DNS LB),
 #   k8s 198.18.200.8 (in-cluster bind-externaldns VIP).
 # k8s -> in-cluster bind-externaldns 198.18.200.8 for both the forward zone
 #   k8s.syd1.au.unkin.net and the reverse zone 200.18.198.in-addr.arpa, which
 #   external-dns now publishes to (see the external-dns migration PRs).
-# (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
+# (Zones that forwarded to 10.10.16.x were dropped.)
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
@@ -46,7 +46,7 @@ spec:
   type: forward
   catalog: false
   forwarders:
-    - 198.18.19.14
+    - 198.18.200.5
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone

apps/base/consul/README.md

@@ -1,12 +1,7 @@
 # consul (k8s)
 
-Consul servers (plain StatefulSet, overlay `apps/overlays/au-syd1/consul`) that
-join the VM datacenter `au-syd1` as extra raft voters. Pod `consul-server-N`
-advertises its own purelb LB IP `198.18.200.(11+N)`; `consul-dns` serves DNS on
-`198.18.200.5:53`. VSO renders the agent/default ACL tokens from
-`kv/kubernetes/namespace/consul/default/server-acl` into `consul-server-acl`
-(`acl-tokens.json`, hot-reloaded via `auto_reload_config`). Port 8501 serves
-the `consul-server-tls` certificate.
+Consul server cluster (DC `au-syd1`), deployed via the HashiCorp helm chart with
+ACLs enabled (`default_policy: deny`, parity with the VM cluster).
 
 ## API access (ACL auth)
 
@@ -15,7 +10,9 @@ The HTTP API and UI are served on port 8500 behind the gateway at
 With ACLs enabled, requests beyond the anonymous policy require a token:
 
 ```bash
-# management token (the VM cluster's initial_management token):
+# management (bootstrap) token — seeded from Vault, synced by VSO into the
+# consul-bootstrap-acl-token secret; same value as the VM cluster's
+# initial_management token:
 CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token)
 
 curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader

apps/base/consul/service.yaml

@@ -1,6 +1,9 @@
 ---
-# ClusterIP service targeting the consul server pods' HTTP API and UI (8500),
-# the Gateway's backend.
+# ClusterIP service targeting the consul server pods' HTTP API (8500).
+# The HashiCorp chart only ships consul-ui (also 8500 via the server pods)
+# and the headless consul-server; this named service gives the Gateway a
+# stable API backend. Consul serves both the HTTP API and the UI (at /ui/)
+# on this same port, so routing the API hostname here preserves the UI too.
 apiVersion: v1
 kind: Service
 metadata:

apps/base/consul/vaultstaticsecret.yaml

@@ -2,24 +2,16 @@
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
-  name: server-acl
+  name: bootstrap-acl-token
   namespace: consul
 spec:
   destination:
     create: true
-    name: consul-server-acl
+    name: consul-bootstrap-acl-token
     overwrite: true
-    transformation:
-      excludeRaw: true
-      excludes:
-        - .*
-      templates:
-        acl-tokens.json:
-          text: >-
-            {"acl":{"tokens":{"agent":{{ get .Secrets "agent_token" | toJson }},"default":{{ get .Secrets "default_token" | toJson }}}}}
   hmacSecretData: true
   mount: kv
-  path: kubernetes/namespace/consul/default/server-acl
+  path: kubernetes/namespace/consul/default/bootstrap-acl-token
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default

apps/overlays/au-syd1/consul/certificate.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: consul-server-tls
-  namespace: consul
-spec:
-  secretName: consul-server-tls
-  issuerRef:
-    kind: ClusterIssuer
-    name: vault-issuer
-  commonName: consul.k8s.syd1.au.unkin.net
-  dnsNames:
-    - consul.service.consul
-    - consul.service.au-syd1.consul
-    - consul
-    - consul.k8s.syd1.au.unkin.net
-    - server.au-syd1.consul
-  privateKey:
-    algorithm: RSA
-    size: 4096

apps/overlays/au-syd1/consul/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: consul
-
-resources:
-  - ../../../base/consul
-  - statefulset.yaml
-  - services.yaml
-  - certificate.yaml
-
-configMapGenerator:
-  - name: consul-server-config
-    files:
-      - server.json

apps/overlays/au-syd1/consul/server.json

@@ -1,51 +0,0 @@
-{
-  "acl": {
-    "default_policy": "deny",
-    "down_policy": "extend-cache",
-    "enable_token_persistence": true,
-    "enabled": true
-  },
-  "auto_reload_config": true,
-  "bind_addr": "0.0.0.0",
-  "client_addr": "0.0.0.0",
-  "connect": {
-    "enabled": true
-  },
-  "datacenter": "au-syd1",
-  "disable_remote_exec": true,
-  "disable_update_check": true,
-  "leave_on_terminate": false,
-  "performance": {
-    "raft_multiplier": 10
-  },
-  "ports": {
-    "dns": 8600,
-    "grpc": 8502,
-    "http": 8500,
-    "https": 8501
-  },
-  "primary_datacenter": "au-syd1",
-  "retry_join": [
-    "198.18.200.11",
-    "198.18.200.12",
-    "198.18.200.13",
-    "198.18.200.14",
-    "198.18.200.15",
-    "ausyd1nxvm2005.main.unkin.net",
-    "ausyd1nxvm2006.main.unkin.net",
-    "ausyd1nxvm2007.main.unkin.net",
-    "ausyd1nxvm2008.main.unkin.net",
-    "ausyd1nxvm2009.main.unkin.net"
-  ],
-  "server": true,
-  "tls": {
-    "https": {
-      "cert_file": "/consul/tls/tls.crt",
-      "key_file": "/consul/tls/tls.key",
-      "verify_incoming": false
-    }
-  },
-  "ui_config": {
-    "enabled": true
-  }
-}

apps/overlays/au-syd1/consul/services.yaml

@@ -1,151 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-server
-  namespace: consul
-spec:
-  clusterIP: None
-  publishNotReadyAddresses: true
-  selector:
-    app: consul
-    component: server
-    release: consul
-  ports:
-    - {name: server, port: 8300, protocol: TCP}
-    - {name: serflan-tcp, port: 8301, protocol: TCP}
-    - {name: serflan-udp, port: 8301, protocol: UDP}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-dns
-  namespace: consul
-  annotations:
-    purelb.io/service-group: common
-    purelb.io/addresses: 198.18.200.5
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: consul
-    component: server
-    release: consul
-  ports:
-    - {name: dns-udp, port: 53, protocol: UDP, targetPort: 8600}
-    - {name: dns-tcp, port: 53, protocol: TCP, targetPort: 8600}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-server-0-lb
-  namespace: consul
-  annotations:
-    purelb.io/service-group: common
-    purelb.io/addresses: 198.18.200.11
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  publishNotReadyAddresses: true
-  selector:
-    statefulset.kubernetes.io/pod-name: consul-server-0
-  ports:
-    - {name: server, port: 8300, protocol: TCP}
-    - {name: serflan-tcp, port: 8301, protocol: TCP}
-    - {name: serflan-udp, port: 8301, protocol: UDP}
-    - {name: serfwan-tcp, port: 8302, protocol: TCP}
-    - {name: serfwan-udp, port: 8302, protocol: UDP}
-    - {name: http, port: 8500, protocol: TCP}
-    - {name: https, port: 443, protocol: TCP, targetPort: 8501}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-server-1-lb
-  namespace: consul
-  annotations:
-    purelb.io/service-group: common
-    purelb.io/addresses: 198.18.200.12
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  publishNotReadyAddresses: true
-  selector:
-    statefulset.kubernetes.io/pod-name: consul-server-1
-  ports:
-    - {name: server, port: 8300, protocol: TCP}
-    - {name: serflan-tcp, port: 8301, protocol: TCP}
-    - {name: serflan-udp, port: 8301, protocol: UDP}
-    - {name: serfwan-tcp, port: 8302, protocol: TCP}
-    - {name: serfwan-udp, port: 8302, protocol: UDP}
-    - {name: http, port: 8500, protocol: TCP}
-    - {name: https, port: 443, protocol: TCP, targetPort: 8501}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-server-2-lb
-  namespace: consul
-  annotations:
-    purelb.io/service-group: common
-    purelb.io/addresses: 198.18.200.13
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  publishNotReadyAddresses: true
-  selector:
-    statefulset.kubernetes.io/pod-name: consul-server-2
-  ports:
-    - {name: server, port: 8300, protocol: TCP}
-    - {name: serflan-tcp, port: 8301, protocol: TCP}
-    - {name: serflan-udp, port: 8301, protocol: UDP}
-    - {name: serfwan-tcp, port: 8302, protocol: TCP}
-    - {name: serfwan-udp, port: 8302, protocol: UDP}
-    - {name: http, port: 8500, protocol: TCP}
-    - {name: https, port: 443, protocol: TCP, targetPort: 8501}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-server-3-lb
-  namespace: consul
-  annotations:
-    purelb.io/service-group: common
-    purelb.io/addresses: 198.18.200.14
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  publishNotReadyAddresses: true
-  selector:
-    statefulset.kubernetes.io/pod-name: consul-server-3
-  ports:
-    - {name: server, port: 8300, protocol: TCP}
-    - {name: serflan-tcp, port: 8301, protocol: TCP}
-    - {name: serflan-udp, port: 8301, protocol: UDP}
-    - {name: serfwan-tcp, port: 8302, protocol: TCP}
-    - {name: serfwan-udp, port: 8302, protocol: UDP}
-    - {name: http, port: 8500, protocol: TCP}
-    - {name: https, port: 443, protocol: TCP, targetPort: 8501}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul-server-4-lb
-  namespace: consul
-  annotations:
-    purelb.io/service-group: common
-    purelb.io/addresses: 198.18.200.15
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  publishNotReadyAddresses: true
-  selector:
-    statefulset.kubernetes.io/pod-name: consul-server-4
-  ports:
-    - {name: server, port: 8300, protocol: TCP}
-    - {name: serflan-tcp, port: 8301, protocol: TCP}
-    - {name: serflan-udp, port: 8301, protocol: UDP}
-    - {name: serfwan-tcp, port: 8302, protocol: TCP}
-    - {name: serfwan-udp, port: 8302, protocol: UDP}
-    - {name: http, port: 8500, protocol: TCP}
-    - {name: https, port: 443, protocol: TCP, targetPort: 8501}

apps/overlays/au-syd1/consul/statefulset.yaml

@@ -1,131 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: consul-server
-  namespace: consul
-  labels:
-    app: consul
-    component: server
-    release: consul
-spec:
-  serviceName: consul-server
-  replicas: 1
-  minReadySeconds: 30
-  podManagementPolicy: OrderedReady
-  selector:
-    matchLabels:
-      app: consul
-      component: server
-      release: consul
-  template:
-    metadata:
-      labels:
-        app: consul
-        component: server
-        release: consul
-    spec:
-      terminationGracePeriodSeconds: 30
-      securityContext:
-        runAsUser: 100
-        runAsGroup: 1000
-        runAsNonRoot: true
-        fsGroup: 1000
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app: consul
-                  component: server
-              topologyKey: kubernetes.io/hostname
-      containers:
-        - name: consul
-          image: hashicorp/consul:1.22.7
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: [ALL]
-          command:
-            - /bin/sh
-            - -ec
-            # ponytail: contiguous .11-.15 block
-            - >-
-              exec consul agent
-              -config-dir=/consul/config
-              -config-dir=/consul/acl
-              -data-dir=/consul/data
-              -node="${HOSTNAME}"
-              -advertise="198.18.200.$((11 + ${HOSTNAME##*-}))"
-          ports:
-            - {name: server, containerPort: 8300, protocol: TCP}
-            - {name: serflan-tcp, containerPort: 8301, protocol: TCP}
-            - {name: serflan-udp, containerPort: 8301, protocol: UDP}
-            - {name: serfwan-tcp, containerPort: 8302, protocol: TCP}
-            - {name: serfwan-udp, containerPort: 8302, protocol: UDP}
-            - {name: http, containerPort: 8500, protocol: TCP}
-            - {name: https, containerPort: 8501, protocol: TCP}
-            - {name: grpc, containerPort: 8502, protocol: TCP}
-            - {name: dns-tcp, containerPort: 8600, protocol: TCP}
-            - {name: dns-udp, containerPort: 8600, protocol: UDP}
-          readinessProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - wget -qO- http://127.0.0.1:8500/v1/status/leader | grep -q ':8300'
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 2Gi
-          volumeMounts:
-            - name: data
-              mountPath: /consul/data
-            - name: config
-              mountPath: /consul/config
-              readOnly: true
-            - name: acl
-              mountPath: /consul/acl
-              readOnly: true
-            - name: tls
-              mountPath: /consul/tls
-              readOnly: true
-      volumes:
-        - name: config
-          configMap:
-            name: consul-server-config
-        - name: acl
-          secret:
-            secretName: consul-server-acl
-            defaultMode: 0440
-        - name: tls
-          secret:
-            secretName: consul-server-tls
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        storageClassName: cephrbd-fast-retain
-        resources:
-          requests:
-            storage: 10Gi
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: consul-server
-  namespace: consul
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app: consul
-      component: server
-      release: consul