consul: keep VM servers in syd1 client join list

WAN federation through mesh gateways makes Consul verify server certs against `server.<dc>.consul` and `<node_name>.server.<dc>.consul`. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified.

- add `server.<country>-<region>.consul` to consul server alt_names
- add `<fqdn>.server.<country>-<region>.consul` to consul server alt_names

Reviewed-on: #547
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/country/au/region/drw1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - syd1

hieradata/country/au/region/syd1.yaml

@@ -8,8 +8,14 @@ profiles_dns_upstream_forwarder_consul:
 profiles_dns_upstream_forwarder_k8s:
   - 198.18.19.20
 profiles::consul::client::members_lookup: false
-# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
+# static list: hosts compiled in k8s can't look up the servers in PuppetDB.
+# VM names stay until the VM servers are retired.
 profiles::consul::client::consul_servers:
+  - 198.18.200.11
+  - 198.18.200.12
+  - 198.18.200.13
+  - 198.18.200.14
+  - 198.18.200.15
   - ausyd1nxvm2005.main.unkin.net
   - ausyd1nxvm2006.main.unkin.net
   - ausyd1nxvm2007.main.unkin.net

hieradata/country/au/region/syd1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - drw1

hieradata/roles/infra/storage/consul.yaml

@@ -13,19 +13,9 @@ profiles::consul::server::addresses:
   grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
   grpc: 8502
-  grpc_tls: 8503
   dns: 8600
   http: 8500
   https: -1
-profiles::consul::server::tls:
-  defaults:
-    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
-    cert_file: /etc/pki/tls/vault/full_chain.crt
-    key_file: /etc/pki/tls/vault/private.key
-  internal_rpc:
-    verify_incoming: false
-    verify_outgoing: false
-    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'

site/profiles/manifests/consul/server.pp

@@ -11,7 +11,6 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
-  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -113,8 +112,6 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
-          'tls'                  => $tls,
-          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,