unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

consul: add k8s servers joining the au-syd1 VM datacenter #531

Open
unkin-agent wants to merge 5 commits from benvin/consul-k8s-servers into main
pull from: benvin/consul-k8s-servers
merge into: unkin:main
Conversation 3 Commits 5 Files Changed 8
+391 -13
unkin-agent commented 2026-10-09 22:35:06 +11:00
Member
Copy Link
Copy Source

Consul servers in k8s join the VM au-syd1 datacenter as extra raft voters, so they need routable per-pod addresses, VM-matching ACL tokens and a TLS cert valid for the consul service names.

  • add a plain StatefulSet of consul 1.22.7 servers with per-pod purelb LBs (198.18.200.11-15) and a consul-dns LB
  • render agent/default ACL tokens via VSO into acl-tokens.json, mounted as a hot-reloaded -config-dir
  • add consul-server-tls Certificate (vault-issuer) for HTTPS on 8501
  • rename the VSO secret to server-acl and refresh the README
Consul servers in k8s join the VM `au-syd1` datacenter as extra raft voters, so they need routable per-pod addresses, VM-matching ACL tokens and a TLS cert valid for the consul service names. - add a plain StatefulSet of consul 1.22.7 servers with per-pod purelb LBs (198.18.200.11-15) and a consul-dns LB - render agent/default ACL tokens via VSO into `acl-tokens.json`, mounted as a hot-reloaded `-config-dir` - add `consul-server-tls` Certificate (vault-issuer) for HTTPS on 8501 - rename the VSO secret to `server-acl` and refresh the README
unkin-agent commented 2026-10-09 22:38:45 +11:00
Author
Member
Copy Link
Copy Source
  • apps/base/consul/gateway.yaml:15 — cert-manager.io/alt-names is not read by cert-manager gateway-shim (SANs come only from listener hostnames); consul-tls will not cover consul.service.au-syd1.consul or consul, so TLS on the LB :443 fails for those names → add a standalone Certificate with those dnsNames for the pods (or matching listener hostnames) and drop the annotation
  • nit: apps/overlays/au-syd1/consul/statefulset.yaml:55 — ACL tokens passed via -hcl end up in process argv (/proc/*/cmdline) and are frozen at pod start, so VSO refreshes never reach the agent → mount consul-server-acl as a config file under -config-dir (or set VSO rolloutRestartTargets)
- apps/base/consul/gateway.yaml:15 — `cert-manager.io/alt-names` is not read by cert-manager gateway-shim (SANs come only from listener hostnames); `consul-tls` will not cover `consul.service.au-syd1.consul` or `consul`, so TLS on the LB :443 fails for those names → add a standalone `Certificate` with those dnsNames for the pods (or matching listener hostnames) and drop the annotation - nit: apps/overlays/au-syd1/consul/statefulset.yaml:55 — ACL tokens passed via `-hcl` end up in process argv (`/proc/*/cmdline`) and are frozen at pod start, so VSO refreshes never reach the agent → mount `consul-server-acl` as a config file under `-config-dir` (or set VSO `rolloutRestartTargets`)
benvin changed target branch from benvin/consul-island-wipe to main 2026-10-09 22:46:49 +11:00
benvin added 3 commits 2026-10-09 22:46:49 +11:00
consul: remove standalone k8s consul overlay
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
41abdd42ef
consul: add k8s servers joining the au-syd1 VM datacenter
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
e66abc17d0
consul: render ACL tokens to a reloadable config file and add server TLS certificate
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
29092387d4
unkin-agent added 1 commit 2026-10-09 22:48:27 +11:00
Merge main
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
9bec0068c9
unkin-agent commented 2026-10-09 22:51:33 +11:00
Author
Member
Copy Link
Copy Source
  • nit: apps/overlays/au-syd1/consul/statefulset.yaml:67 — tcpSocket: 8301 passes before the pod has joined or sees a leader, so consul-dns routes to an unjoined server → exec-probe /v1/status/leader for a non-empty leader (per-pod LBs already publish not-ready, so no announce loop)
  • nit: apps/overlays/au-syd1/consul/statefulset.yaml:43 — no container securityContext → add allowPrivilegeEscalation: false and capabilities.drop: [ALL]
- nit: apps/overlays/au-syd1/consul/statefulset.yaml:67 — `tcpSocket: 8301` passes before the pod has joined or sees a leader, so `consul-dns` routes to an unjoined server → exec-probe `/v1/status/leader` for a non-empty leader (per-pod LBs already publish not-ready, so no announce loop) - nit: apps/overlays/au-syd1/consul/statefulset.yaml:43 — no container securityContext → add `allowPrivilegeEscalation: false` and `capabilities.drop: [ALL]`
unkin-agent added 1 commit 2026-10-09 22:53:17 +11:00
Gate consul readiness on raft leader, drop container caps
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
10867af9b9
unkin-agent commented 2026-10-09 23:00:21 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
All checks were successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Required
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin benvin/consul-k8s-servers:benvin/consul-k8s-servers
git checkout benvin/consul-k8s-servers
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#531
Delete Branch "benvin/consul-k8s-servers"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?