Route consul API hostname to the HTTP API (8500) #282

2026-07-25T17:06:54+10:00

unkinben commented

2026-07-25 17:06:54 +10:00

Phase 2 of the consul migration: expose the HTTP API (not just the UI) at consul.k8s.syd1.au.unkin.net, now rebased onto main post-#280 (ACLs enabled).

Adds a consul-http ClusterIP service targeting the server pods on 8500 (API + UI share the port, so the UI stays reachable at /ui/)
Repoints the consul and consul-svc HTTPRoutes from consul-ui:80 to consul-http:8500
Documents ACL-authenticated access in apps/base/consul/README.md: token from kv/kubernetes/namespace/consul/default/bootstrap-acl-token (VSO-synced), X-Consul-Token curl and consul CLI usage, UI token login, and the prefer-vault-minted-tokens note

Verification post-merge (ACLs are live, so authenticated): CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token) && curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader

Rollback: revert the HTTPRoute backends to consul-ui:80.

Phase 2 of the consul migration: expose the HTTP API (not just the UI) at consul.k8s.syd1.au.unkin.net, now rebased onto main post-#280 (ACLs enabled). - Adds a consul-http ClusterIP service targeting the server pods on 8500 (API + UI share the port, so the UI stays reachable at /ui/) - Repoints the consul and consul-svc HTTPRoutes from consul-ui:80 to consul-http:8500 - Documents ACL-authenticated access in apps/base/consul/README.md: token from kv/kubernetes/namespace/consul/default/bootstrap-acl-token (VSO-synced), X-Consul-Token curl and consul CLI usage, UI token login, and the prefer-vault-minted-tokens note Verification post-merge (ACLs are live, so authenticated): CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token) && curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader Rollback: revert the HTTPRoute backends to consul-ui:80.

unkinben added 2 commits 2026-07-25 18:15:31 +10:00

Route consul API hostname to the HTTP API (8500) 3d2bdec0b8

Phase 2 of the consul VM->k8s migration: terraform backends, the Vault
consul secret engine, and puppet all need the consul HTTP API reachable at
consul.k8s.syd1.au.unkin.net. The Gateway/HTTPRoutes currently send both
that hostname and the consul.service.consul listener to consul-ui:80,
which serves only the UI, not the /v1 API. Consul serves the HTTP API and
the UI (/ui/) on the same port 8500, so routing everything to 8500
preserves the UI while exposing the API.

- Add a consul-http ClusterIP service selecting the consul server pods
  (app=consul, component=server, release=consul) on port 8500.
- Repoint the consul and consul-svc HTTPRoutes from consul-ui:80 to
  consul-http:8500.

Document ACL-authenticated API access

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

1f501e0df3

unkinben force-pushed benvin/consul-api-route from 9e0364f29f to 1f501e0df3

2026-07-25 18:15:31 +10:00

Compare

benvin merged commit 614c4b1aa6 into main

2026-07-25 18:19:39 +10:00

benvin deleted branch benvin/consul-api-route

2026-07-25 18:19:39 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#282