unkinben
614c4b1aa6
Phase 2 of the consul migration: expose the HTTP API (not just the UI) at consul.k8s.syd1.au.unkin.net, now rebased onto main post-#280 (ACLs enabled). - Adds a consul-http ClusterIP service targeting the server pods on 8500 (API + UI share the port, so the UI stays reachable at /ui/) - Repoints the consul and consul-svc HTTPRoutes from consul-ui:80 to consul-http:8500 - Documents ACL-authenticated access in apps/base/consul/README.md: token from kv/kubernetes/namespace/consul/default/bootstrap-acl-token (VSO-synced), X-Consul-Token curl and consul CLI usage, UI token login, and the prefer-vault-minted-tokens note Verification post-merge (ACLs are live, so authenticated): CONSUL_HTTP_TOKEN=$(vault kv get -field=token kv/kubernetes/namespace/consul/default/bootstrap-acl-token) && curl -H "X-Consul-Token: $CONSUL_HTTP_TOKEN" https://consul.k8s.syd1.au.unkin.net/v1/status/leader Rollback: revert the HTTPRoute backends to consul-ui:80. Reviewed-on: #282 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
84 lines
1.7 KiB
YAML
84 lines
1.7 KiB
YAML
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: consul-http-redirect
|
|
namespace: consul
|
|
labels:
|
|
app.kubernetes.io/name: consul
|
|
app.kubernetes.io/instance: consul
|
|
spec:
|
|
hostnames:
|
|
- consul.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: consul
|
|
sectionName: http
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: consul
|
|
namespace: consul
|
|
labels:
|
|
app.kubernetes.io/name: consul
|
|
app.kubernetes.io/instance: consul
|
|
spec:
|
|
hostnames:
|
|
- consul.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: consul
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: consul-http
|
|
port: 8500
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: consul-svc
|
|
namespace: consul
|
|
labels:
|
|
app.kubernetes.io/name: consul
|
|
app.kubernetes.io/instance: consul
|
|
spec:
|
|
hostnames:
|
|
- consul.service.consul
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: consul
|
|
sectionName: consul-svc
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: consul-http
|
|
port: 8500
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|