Files

T

History

unkinben 614c4b1aa6 Route consul API hostname to the HTTP API (8500) (#282 )

Phase 2 of the consul migration: expose the HTTP API (not just the UI) at consul.k8s.syd1.au.unkin.net, now rebased onto main post-#280 (ACLs enabled).

- Adds a consul-http ClusterIP service targeting the server pods on 8500 (API + UI share the port, so the UI stays reachable at /ui/)
- Repoints the consul and consul-svc HTTPRoutes from consul-ui:80 to consul-http:8500
- Documents ACL-authenticated access in apps/base/consul/README.md: token from kv/kubernetes/namespace/consul/default/bootstrap-acl-token (VSO-synced), X-Consul-Token curl and consul CLI usage, UI token login, and the prefer-vault-minted-tokens note

Verification post-merge (ACLs are live, so authenticated): CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token) && curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader

Rollback: revert the HTTPRoute backends to consul-ui:80.
Reviewed-on: #282
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

2026-07-25 18:19:38 +10:00

gateway.yaml

fix(gateways): add explicit group: "" to all certificateRefs entries (#153 )

2026-05-23 23:47:24 +10:00

httproute.yaml

Route consul API hostname to the HTTP API (8500) (#282 )

2026-07-25 18:19:38 +10:00

kustomization.yaml

Route consul API hostname to the HTTP API (8500) (#282 )

2026-07-25 18:19:38 +10:00

namespace.yaml

feat(consul): deploy HashiCorp Consul 1.22.7 via Helm chart (5-replica cluster) (#149 )

2026-05-23 22:40:49 +10:00

README.md

Route consul API hostname to the HTTP API (8500) (#282 )

2026-07-25 18:19:38 +10:00

service.yaml

Route consul API hostname to the HTTP API (8500) (#282 )

2026-07-25 18:19:38 +10:00

vaultauth.yaml

Enable ACLs on k8s consul with Vault-sourced bootstrap token (#280 )

2026-07-25 17:39:18 +10:00

vaultstaticsecret.yaml

Enable ACLs on k8s consul with Vault-sourced bootstrap token (#280 )

2026-07-25 17:39:18 +10:00

README.md

consul (k8s)

Consul server cluster (DC au-syd1), deployed via the HashiCorp helm chart with ACLs enabled (default_policy: deny, parity with the VM cluster).

API access (ACL auth)

The HTTP API and UI are served on port 8500 behind the gateway at https://consul.k8s.syd1.au.unkin.net (and https://consul.service.consul). With ACLs enabled, requests beyond the anonymous policy require a token:

# management (bootstrap) token — seeded from Vault, synced by VSO into the
# consul-bootstrap-acl-token secret; same value as the VM cluster's
# initial_management token:
CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token)

curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader

# consul CLI:
CONSUL_HTTP_ADDR=https://consul.k8s.syd1.au.unkin.net CONSUL_HTTP_TOKEN=$CONSUL_HTTP_TOKEN consul members

The UI at the same hostname exposes an ACL login (top right) — paste a token. Anonymous requests get the anonymous-token policy only (reads for DNS/service discovery; no writes, no ACL/token APIs).

Prefer short-lived tokens minted by Vault's consul secrets engine over the management token for day-to-day use; the terraform-* CI roles already work this way.