unkinben
614c4b1aa6
Phase 2 of the consul migration: expose the HTTP API (not just the UI) at consul.k8s.syd1.au.unkin.net, now rebased onto main post-#280 (ACLs enabled). - Adds a consul-http ClusterIP service targeting the server pods on 8500 (API + UI share the port, so the UI stays reachable at /ui/) - Repoints the consul and consul-svc HTTPRoutes from consul-ui:80 to consul-http:8500 - Documents ACL-authenticated access in apps/base/consul/README.md: token from kv/kubernetes/namespace/consul/default/bootstrap-acl-token (VSO-synced), X-Consul-Token curl and consul CLI usage, UI token login, and the prefer-vault-minted-tokens note Verification post-merge (ACLs are live, so authenticated): CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token) && curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader Rollback: revert the HTTPRoute backends to consul-ui:80. Reviewed-on: #282 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
26 lines
717 B
YAML
26 lines
717 B
YAML
---
|
|
# ClusterIP service targeting the consul server pods' HTTP API (8500).
|
|
# The HashiCorp chart only ships consul-ui (also 8500 via the server pods)
|
|
# and the headless consul-server; this named service gives the Gateway a
|
|
# stable API backend. Consul serves both the HTTP API and the UI (at /ui/)
|
|
# on this same port, so routing the API hostname here preserves the UI too.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: consul-http
|
|
namespace: consul
|
|
labels:
|
|
app.kubernetes.io/name: consul
|
|
app.kubernetes.io/instance: consul
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: consul
|
|
component: server
|
|
release: consul
|
|
ports:
|
|
- name: http
|
|
port: 8500
|
|
protocol: TCP
|
|
targetPort: 8500
|