unkinben
614c4b1aa6
Phase 2 of the consul migration: expose the HTTP API (not just the UI) at consul.k8s.syd1.au.unkin.net, now rebased onto main post-#280 (ACLs enabled). - Adds a consul-http ClusterIP service targeting the server pods on 8500 (API + UI share the port, so the UI stays reachable at /ui/) - Repoints the consul and consul-svc HTTPRoutes from consul-ui:80 to consul-http:8500 - Documents ACL-authenticated access in apps/base/consul/README.md: token from kv/kubernetes/namespace/consul/default/bootstrap-acl-token (VSO-synced), X-Consul-Token curl and consul CLI usage, UI token login, and the prefer-vault-minted-tokens note Verification post-merge (ACLs are live, so authenticated): CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token) && curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader Rollback: revert the HTTPRoute backends to consul-ui:80. Reviewed-on: #282 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# consul (k8s)
|
|
|
|
Consul server cluster (DC `au-syd1`), deployed via the HashiCorp helm chart with
|
|
ACLs enabled (`default_policy: deny`, parity with the VM cluster).
|
|
|
|
## API access (ACL auth)
|
|
|
|
The HTTP API and UI are served on port 8500 behind the gateway at
|
|
`https://consul.k8s.syd1.au.unkin.net` (and `https://consul.service.consul`).
|
|
With ACLs enabled, requests beyond the anonymous policy require a token:
|
|
|
|
```bash
|
|
# management (bootstrap) token — seeded from Vault, synced by VSO into the
|
|
# consul-bootstrap-acl-token secret; same value as the VM cluster's
|
|
# initial_management token:
|
|
CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token)
|
|
|
|
curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader
|
|
|
|
# consul CLI:
|
|
CONSUL_HTTP_ADDR=https://consul.k8s.syd1.au.unkin.net CONSUL_HTTP_TOKEN=$CONSUL_HTTP_TOKEN consul members
|
|
```
|
|
|
|
The UI at the same hostname exposes an ACL login (top right) — paste a token.
|
|
Anonymous requests get the anonymous-token policy only (reads for DNS/service
|
|
discovery; no writes, no ACL/token APIs).
|
|
|
|
Prefer short-lived tokens minted by Vault's consul secrets engine over the
|
|
management token for day-to-day use; the terraform-* CI roles already work this
|
|
way.
|