Merge remote-tracking branch 'origin/benvin/consul-server-tls-fed' into benvin/consul-mesh-gateway

Move the k8s roles to the puppet-on-k8s compilers. Their role code (rke2, frrouting, ceph) has no exported resources or PuppetDB queries; the base consul lookup is covered by the static syd1 server list.

- enable profiles::puppet::migrate in the shared roles::infra::k8s hieradata (compute, control, node)

Reviewed-on: #545
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/country/au/region/drw1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: true
+profiles::consul::server::join_remote_regions: false
 profiles::consul::server::remote_regions:
   - syd1

hieradata/country/au/region/syd1.yaml

@@ -7,3 +7,11 @@ profiles_dns_upstream_forwarder_consul:
   - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
   - 198.18.19.20
+profiles::consul::client::members_lookup: false
+# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
+profiles::consul::client::consul_servers:
+  - ausyd1nxvm2005.main.unkin.net
+  - ausyd1nxvm2006.main.unkin.net
+  - ausyd1nxvm2007.main.unkin.net
+  - ausyd1nxvm2008.main.unkin.net
+  - ausyd1nxvm2009.main.unkin.net

hieradata/country/au/region/syd1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: true
+profiles::consul::server::join_remote_regions: false
 profiles::consul::server::remote_regions:
   - drw1

hieradata/roles/apps/media.yaml

@@ -2,6 +2,8 @@
 hiera_include:
   - profiles::nginx::simpleproxy
 
+profiles::puppet::migrate::enabled: true
+
 profiles::yum::global::repos:
   ceph:
     ensure: present

hieradata/roles/infra/incus/node.yaml

@@ -14,6 +14,8 @@ hiera_include:
   - profiles::storage::cephfsvols
   - exporters::frr_exporter
 
+profiles::puppet::migrate::enabled: true
+
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false
 

hieradata/roles/infra/k8s.yaml

@@ -8,6 +8,8 @@ hiera_include:
   - frrouting
   - rke2
 
+profiles::puppet::migrate::enabled: true
+
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345

hieradata/roles/infra/storage/consul.yaml

@@ -13,9 +13,19 @@ profiles::consul::server::addresses:
   grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
   grpc: 8502
+  grpc_tls: 8503
   dns: 8600
   http: 8500
   https: -1
+profiles::consul::server::tls:
+  defaults:
+    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
+    cert_file: /etc/pki/tls/vault/full_chain.crt
+    key_file: /etc/pki/tls/vault/private.key
+  internal_rpc:
+    verify_incoming: false
+    verify_outgoing: false
+    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'
@@ -31,6 +41,8 @@ profiles::pki::vault::alt_names:
   - consul.service.consul
   - "consul.service.%{facts.country}-%{facts.region}.consul"
   - consul
+  - "server.%{facts.country}-%{facts.region}.consul"
+  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
 
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'
@@ -46,6 +58,18 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: frr_exporter
     disposition: write
+  - resource: service
+    segment: mesh-gateway
+    disposition: write
+  - resource: service_prefix
+    segment: ''
+    disposition: read
+  - resource: node_prefix
+    segment: ''
+    disposition: read
+  - resource: agent_prefix
+    segment: ''
+    disposition: read
 profiles::consul::prepared_query::rules:
   vault:
     ensure: 'present'

modules/nzbget/manifests/init.pp

@@ -6,8 +6,8 @@ class nzbget (
   $manage_group       = $nzbget::params::manage_group,
   $service_enable     = $nzbget::params::service_enable,
   $service_name       = $nzbget::params::service_name,
-  $bind_address       = $sonarr::params::bind_address,
-  $port               = $sonarr::params::port,
+  $bind_address       = $nzbget::params::bind_address,
+  $port               = $nzbget::params::port,
 ) inherits nzbget::params {
 
   include nzbget::install

site/profiles/manifests/consul/mesh_gateway.pp

@@ -0,0 +1,48 @@
+# profiles::consul::mesh_gateway
+class profiles::consul::mesh_gateway (
+  Stdlib::IP::Address $address    = $facts['networking']['ip'],
+  Stdlib::Port        $port       = 8443,
+  Stdlib::Port        $http_port  = 8500,
+  Stdlib::Port        $grpc_port  = 8502,
+  Stdlib::Absolutepath $token_file = '/etc/consul.d/mesh-gateway.token',
+) {
+  include profiles::consul::client
+
+  package { 'envoy':
+    ensure => installed,
+  }
+
+  file { $token_file:
+    ensure  => file,
+    owner   => 'consul',
+    group   => 'consul',
+    mode    => '0600',
+    content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
+  }
+
+  systemd::unit_file { 'consul-mesh-gateway.service':
+    enable    => true,
+    active    => true,
+    content   => @("UNIT"),
+      [Unit]
+      Description=Consul mesh gateway (envoy)
+      Requires=consul.service
+      After=consul.service
+
+      [Service]
+      User=consul
+      Group=consul
+      ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
+        -address=${address}:${port} -wan-address=${address}:${port} \
+        -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
+        -token-file=${token_file}
+      Restart=on-failure
+      RestartSec=5
+
+      [Install]
+      WantedBy=multi-user.target
+      | UNIT
+    require   => Package['envoy'],
+    subscribe => File[$token_file],
+  }
+}

site/profiles/manifests/consul/server.pp

@@ -11,6 +11,7 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
+  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -112,6 +113,8 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
+          'tls'                  => $tls,
+          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,
@@ -129,7 +132,7 @@ class profiles::consul::server (
           'advertise_addr'       => $advertise_addr,
           'retry_join'           => $servers_array,
           'retry_join_wan'       => $remote_servers_array,
-          'connect'              => { 'enabled' => true },
+          'connect'              => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true },
           'recursors'            => ['198.18.19.16'],
         },
       }

site/roles/manifests/infra/storage/consul.pp

@@ -8,5 +8,6 @@ class roles::infra::storage::consul {
     include profiles::base
     include profiles::base::datavol
     include profiles::consul::server
+    include profiles::consul::mesh_gateway
   }
 }