dns: keep VM consul forwarder as fallback

WAN federation through mesh gateways makes Consul verify server certs against `server.<dc>.consul` and `<node_name>.server.<dc>.consul`. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified.

- add `server.<country>-<region>.consul` to consul server alt_names
- add `<fqdn>.server.<country>-<region>.consul` to consul server alt_names

Reviewed-on: #547
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/country/au/region/drw1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - syd1

hieradata/country/au/region/syd1.yaml

@@ -4,6 +4,7 @@ certbot::client::webserver: ausyd1nxvm2057.main.unkin.net
 profiles_dns_upstream_forwarder_unkin:
   - 198.18.200.7
 profiles_dns_upstream_forwarder_consul:
+  - 198.18.200.5
   - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
   - 198.18.19.20

hieradata/country/au/region/syd1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - drw1

hieradata/roles/infra/storage/consul.yaml

@@ -13,19 +13,9 @@ profiles::consul::server::addresses:
   grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
   grpc: 8502
-  grpc_tls: 8503
   dns: 8600
   http: 8500
   https: -1
-profiles::consul::server::tls:
-  defaults:
-    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
-    cert_file: /etc/pki/tls/vault/full_chain.crt
-    key_file: /etc/pki/tls/vault/private.key
-  internal_rpc:
-    verify_incoming: false
-    verify_outgoing: false
-    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'
@@ -58,18 +48,6 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: frr_exporter
     disposition: write
-  - resource: service
-    segment: mesh-gateway
-    disposition: write
-  - resource: service_prefix
-    segment: ''
-    disposition: read
-  - resource: node_prefix
-    segment: ''
-    disposition: read
-  - resource: agent_prefix
-    segment: ''
-    disposition: read
 profiles::consul::prepared_query::rules:
   vault:
     ensure: 'present'

site/profiles/manifests/consul/mesh_gateway.pp

@@ -1,52 +0,0 @@
-# profiles::consul::mesh_gateway
-class profiles::consul::mesh_gateway (
-  Stdlib::IP::Address $address    = $facts['networking']['ip'],
-  Stdlib::Port        $port       = 8443,
-  Stdlib::Port        $http_port  = 8500,
-  Stdlib::Port        $grpc_port  = 8502,
-  Stdlib::Absolutepath $token_file = '/etc/consul.d/mesh-gateway.token',
-) {
-  include profiles::consul::client
-
-  # include after profiles::consul::server, which declares Class['consul'] only once /data is mounted
-  if defined(Class['consul']) {
-    package { 'envoy':
-      ensure => installed,
-    }
-
-    file { $token_file:
-      ensure  => file,
-      owner   => 'consul',
-      group   => 'consul',
-      mode    => '0600',
-      require => Class['consul'],
-      content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
-    }
-
-    systemd::unit_file { 'consul-mesh-gateway.service':
-      enable    => true,
-      active    => true,
-      content   => @("UNIT"),
-        [Unit]
-        Description=Consul mesh gateway (envoy)
-        Requires=consul.service
-        After=consul.service
-
-        [Service]
-        User=consul
-        Group=consul
-        ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
-          -address=${address}:${port} -wan-address=${address}:${port} \
-          -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
-          -token-file=${token_file}
-        Restart=on-failure
-        RestartSec=5
-
-        [Install]
-        WantedBy=multi-user.target
-        | UNIT
-      require   => [Package['envoy'], Class['consul']],
-      subscribe => File[$token_file],
-    }
-  }
-}

site/profiles/manifests/consul/server.pp

@@ -11,7 +11,6 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
-  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -113,8 +112,6 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
-          'tls'                  => $tls,
-          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,
@@ -132,7 +129,7 @@ class profiles::consul::server (
           'advertise_addr'       => $advertise_addr,
           'retry_join'           => $servers_array,
           'retry_join_wan'       => $remote_servers_array,
-          'connect'              => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true },
+          'connect'              => { 'enabled' => true },
           'recursors'            => ['198.18.19.16'],
         },
       }

site/roles/manifests/infra/storage/consul.pp

@@ -8,6 +8,5 @@ class roles::infra::storage::consul {
     include profiles::base
     include profiles::base::datavol
     include profiles::consul::server
-    include profiles::consul::mesh_gateway
   }
 }