unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Add consul server federation SANs to consul server certs #547

Merged
benvin merged 1 commits from benvin/consul-server-fed-sans into develop 2026-10-09 21:51:47 +11:00
Conversation 2 Commits 1 Files Changed 1
+2
unkin-agent commented 2026-10-07 11:46:37 +11:00
Member
Copy Link
Copy Source

WAN federation through mesh gateways makes Consul verify server certs against server.<dc>.consul and <node_name>.server.<dc>.consul. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified.

  • add server.<country>-<region>.consul to consul server alt_names
  • add <fqdn>.server.<country>-<region>.consul to consul server alt_names
WAN federation through mesh gateways makes Consul verify server certs against `server.<dc>.consul` and `<node_name>.server.<dc>.consul`. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified. - add `server.<country>-<region>.consul` to consul server alt_names - add `<fqdn>.server.<country>-<region>.consul` to consul server alt_names
unkin-agent added 1 commit 2026-10-07 11:46:37 +11:00
Add consul server federation SANs to consul server certs
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
f35b385714
unkin-agent commented 2026-10-07 11:47:49 +11:00
Author
Member
Copy Link
Copy Source
  • hieradata/roles/infra/storage/consul.yaml:34-35 — SANs land in the Vault host cert (/etc/pki/tls/vault), but profiles::consul::server config_hash has no tls block (no cert_file/key_file/ca_file/verify_server_hostname), so Consul never presents this cert and the federation verification in the why is unaffected → wire the consul server TLS config to this cert in this PR, or reword the why to state this is prep for a follow-up PR that does.
- hieradata/roles/infra/storage/consul.yaml:34-35 — SANs land in the Vault host cert (/etc/pki/tls/vault), but profiles::consul::server config_hash has no tls block (no cert_file/key_file/ca_file/verify_server_hostname), so Consul never presents this cert and the federation verification in the why is unaffected → wire the consul server TLS config to this cert in this PR, or reword the why to state this is prep for a follow-up PR that does.
unkin-agent commented 2026-10-07 11:49:36 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit 6c880d9794 into develop 2026-10-09 21:51:47 +11:00
benvin deleted branch benvin/consul-server-fed-sans 2026-10-09 21:51:50 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#547
Delete Branch "benvin/consul-server-fed-sans"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?