From 4453c8604a395693feb3f9e735af4d7255fbc973 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 28 Apr 2024 00:49:57 +1000 Subject: [PATCH 1/3] fix: fix proxyurl for vault - change to http:// - change to localhost --- hieradata/roles/infra/storage/vault.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 8785f7c..1209319 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -17,5 +17,7 @@ profiles::nginx::simpleproxy::nginx_vhost: 'vault.service.consul' profiles::nginx::simpleproxy::nginx_aliases: - vault - vault.main.unkin.net +profiles::nginx::simpleproxy::proxy_scheme: 'http' +profiles::nginx::simpleproxy::proxy_host: '127.0.0.1' profiles::nginx::simpleproxy::proxy_port: 8200 profiles::nginx::simpleproxy::proxy_path: '/' From bf44c8f7b7a0c85d161c544e26f0cfd5154b6604 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 28 Apr 2024 01:03:57 +1000 Subject: [PATCH 2/3] feat: deploy consul agent - install the consul agent on all nodes, except consul servers --- hieradata/common.yaml | 2 ++ site/profiles/manifests/consul/client.pp | 39 ++++++++++++++++++++++++ 2 files changed, 41 insertions(+) diff --git a/hieradata/common.yaml b/hieradata/common.yaml index 9fa4d12..8be8ee2 100644 --- a/hieradata/common.yaml +++ b/hieradata/common.yaml @@ -85,6 +85,8 @@ profiles::dns::base::ns_role: 'roles::infra::dns::resolver' profiles::dns::base::use_ns: 'region' profiles::consul::server::members_role: roles::infra::storage::consul profiles::consul::token::node_editor::accessor_id: '024e27bd-c5bb-41e7-a578-b766509e11bc' +profiles::consul::client::members_lookup: true +profiles::consul::client::members_role: roles::infra::storage::consul profiles::packages::install: - bash-completion diff --git a/site/profiles/manifests/consul/client.pp b/site/profiles/manifests/consul/client.pp index edfd1ec..684c7b5 100644 --- a/site/profiles/manifests/consul/client.pp +++ b/site/profiles/manifests/consul/client.pp @@ -5,8 +5,47 @@ class profiles::consul::client ( Enum['http','https'] $consul_protocol = 'http', Stdlib::Port $consul_port = 8500, String $consul_api_token = lookup('profiles::consul::server::acl_tokens_initial_management'), + Boolean $members_lookup = false, + String $members_role = undef, + Array $consul_servers = [], + Stdlib::Absolutepath $data_dir = '/opt/consul', ) { + if $facts['enc_role'] != $members_role { + + # set a datacentre/cluster name + $consul_cluster = "${::facts['country']}-${::facts['region']}" + + # if lookup is enabled, find all the hosts in the specified role and create the servers_array + if $members_lookup { + + # check that the role is also set + unless !($members_role == undef) { + fail("members_role must be provided for ${title} when members_lookup is True") + } + + # if it is, find hosts, sort them so they dont cause changes every run + $servers_array = sort(query_nodes("enc_role='${members_role}' and region='${::facts['region']}'", 'networking.fqdn')) + + # else use provided array from params + }else{ + $servers_array = $consul_servers + } + + # deploy the consul agent + class { 'consul': + config_hash => { + 'data_dir' => $data_dir, + 'datacenter' => $consul_cluster, + 'log_level' => 'INFO', + 'node_name' => $facts['networking']['fqdn'], + 'retry_join' => $servers_array, + 'bind_addr' => $::facts['networking']['ip'], + 'advertise_addr' => $::facts['networking']['ip'], + }, + } + } + # Create ACL policy that allows nodes to update themselves and read others consul_policy { $facts['networking']['hostname']: description => "${facts['networking']['fqdn']} puppet-generated-policy", From dff3f932977e325e69c2b774eeba7091ead22653 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 28 Apr 2024 15:39:03 +1000 Subject: [PATCH 3/3] feat: change forwarded domain for consul - change forward lookup zone for consul from consul.service.consul -> service.consul --- hieradata/roles/infra/dns/resolver.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hieradata/roles/infra/dns/resolver.yaml b/hieradata/roles/infra/dns/resolver.yaml index 6be9009..ceb8863 100644 --- a/hieradata/roles/infra/dns/resolver.yaml +++ b/hieradata/roles/infra/dns/resolver.yaml @@ -61,8 +61,8 @@ profiles::dns::resolver::zones: - 10.10.16.32 - 10.10.16.33 forward: 'only' - consul.service.consul-forward: - domain: 'consul.service.consul' + service.consul-forward: + domain: 'service.consul' zone_type: 'forward' forwarders: - 198.18.13.19 @@ -79,7 +79,7 @@ profiles::dns::resolver::views: - dmz.unkin.net-forward - network.unkin.net-forward - prod.unkin.net-forward - - consul.service.consul-forward + - service.consul-forward - 13.18.198.in-addr.arpa-forward - 14.18.198.in-addr.arpa-forward - 15.18.198.in-addr.arpa-forward