Phase 1 of the consul VM->k8s migration: bring the k8s consul cluster to
ACL parity with the authoritative VM cluster before snapshot-restore. The
VM cluster runs ACLs enabled with default_policy deny and down_policy
extend-cache; the k8s cluster currently runs with ACLs disabled. Sourcing
the bootstrap/management token from Vault lets the k8s cluster bootstrap
with the SAME initial_management token as the VM cluster, so puppet
automation and the eventual snapshot-restore line up. No token material is
placed in git.
- Enable global.acls.manageSystemACLs so the chart manages system ACL
tokens/policies for consul components.
- Point global.acls.bootstrapToken at a pre-existing Kubernetes secret
consul-bootstrap-acl-token (key token); when populated the
server-acl-init job skips bootstrapping and adopts that token as the
management token.
- Add a VaultAuth (mount k8s/au/syd1, role default) and VaultStaticSecret
in the consul namespace that sync kv/kubernetes/namespace/consul/default/
bootstrap-acl-token into the consul-bootstrap-acl-token secret via VSO.
- Merge the acl block (enabled, default_policy deny, down_policy
extend-cache, enable_token_persistence) into the server extraConfig to
match the VM cluster posture.
unkinben