From f35b38571433f8d96002bd6b0f92e133171291f7 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 7 Oct 2026 11:46:32 +1100 Subject: [PATCH 1/4] Add consul server federation SANs to consul server certs --- hieradata/roles/infra/storage/consul.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml index 8741c43..cac2fe4 100644 --- a/hieradata/roles/infra/storage/consul.yaml +++ b/hieradata/roles/infra/storage/consul.yaml @@ -31,6 +31,8 @@ profiles::pki::vault::alt_names: - consul.service.consul - "consul.service.%{facts.country}-%{facts.region}.consul" - consul + - "server.%{facts.country}-%{facts.region}.consul" + - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul" # manage a simple nginx reverse proxy profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul' -- 2.47.3 From 9d25ba1d9a99aeaa3bf7a555d7f262563103d8a3 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 7 Oct 2026 11:48:29 +1100 Subject: [PATCH 2/4] Enable TLS and mesh gateway WAN federation on consul servers --- .../country/au/region/syd1/infra/storage/consul.yaml | 2 +- hieradata/roles/infra/storage/consul.yaml | 9 +++++++++ site/profiles/manifests/consul/server.pp | 5 ++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/hieradata/country/au/region/syd1/infra/storage/consul.yaml b/hieradata/country/au/region/syd1/infra/storage/consul.yaml index 52a084f..2c339f8 100644 --- a/hieradata/country/au/region/syd1/infra/storage/consul.yaml +++ b/hieradata/country/au/region/syd1/infra/storage/consul.yaml @@ -2,6 +2,6 @@ profiles::consul::server::bootstrap_count: 3 profiles::consul::server::raft_multiplier: 10 profiles::consul::server::primary_datacenter: 'au-syd1' -profiles::consul::server::join_remote_regions: true +profiles::consul::server::join_remote_regions: false profiles::consul::server::remote_regions: - drw1 diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml index cac2fe4..390e082 100644 --- a/hieradata/roles/infra/storage/consul.yaml +++ b/hieradata/roles/infra/storage/consul.yaml @@ -16,6 +16,15 @@ profiles::consul::server::ports: dns: 8600 http: 8500 https: -1 +profiles::consul::server::tls: + defaults: + ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem + cert_file: /etc/pki/tls/vault/full_chain.crt + key_file: /etc/pki/tls/vault/private.key + internal_rpc: + verify_incoming: false + verify_outgoing: false + verify_server_hostname: false profiles::consul::server::acl: enabled: true default_policy: 'deny' diff --git a/site/profiles/manifests/consul/server.pp b/site/profiles/manifests/consul/server.pp index 039dea1..28f144b 100644 --- a/site/profiles/manifests/consul/server.pp +++ b/site/profiles/manifests/consul/server.pp @@ -11,6 +11,7 @@ class profiles::consul::server ( Hash $acl = {}, Hash $ports = {}, Hash $addresses = {}, + Hash $tls = {}, Boolean $members_lookup = false, String $members_role = undef, Array $consul_servers = [], @@ -112,6 +113,8 @@ class profiles::consul::server ( 'acl' => $acl, 'ports' => $ports, 'addresses' => $addresses, + 'tls' => $tls, + 'auto_reload_config' => true, 'disable_remote_exec' => $disable_remote_exec, 'disable_update_check' => $disable_update_check, 'domain' => $domain, @@ -129,7 +132,7 @@ class profiles::consul::server ( 'advertise_addr' => $advertise_addr, 'retry_join' => $servers_array, 'retry_join_wan' => $remote_servers_array, - 'connect' => { 'enabled' => true }, + 'connect' => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true }, 'recursors' => ['198.18.19.16'], }, } -- 2.47.3 From 674f51a44bf83236ed9eba14f77169d1fb702165 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 7 Oct 2026 11:54:31 +1100 Subject: [PATCH 3/4] Add consul grpc_tls port and drop drw1 WAN retry join --- hieradata/country/au/region/drw1/infra/storage/consul.yaml | 2 +- hieradata/roles/infra/storage/consul.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/hieradata/country/au/region/drw1/infra/storage/consul.yaml b/hieradata/country/au/region/drw1/infra/storage/consul.yaml index b44e321..6fba403 100644 --- a/hieradata/country/au/region/drw1/infra/storage/consul.yaml +++ b/hieradata/country/au/region/drw1/infra/storage/consul.yaml @@ -2,6 +2,6 @@ profiles::consul::server::bootstrap_count: 3 profiles::consul::server::raft_multiplier: 10 profiles::consul::server::primary_datacenter: 'au-syd1' -profiles::consul::server::join_remote_regions: true +profiles::consul::server::join_remote_regions: false profiles::consul::server::remote_regions: - syd1 diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml index 390e082..d509776 100644 --- a/hieradata/roles/infra/storage/consul.yaml +++ b/hieradata/roles/infra/storage/consul.yaml @@ -13,6 +13,7 @@ profiles::consul::server::addresses: grpc_tls: "%{::networking.ip}" profiles::consul::server::ports: grpc: 8502 + grpc_tls: 8503 dns: 8600 http: 8500 https: -1 -- 2.47.3 From b1ee318394f624c6f134f30b8d480bc958aadfbb Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 9 Oct 2026 19:29:43 +1100 Subject: [PATCH 4/4] Defer mesh gateway WAN federation to the gateway change --- site/profiles/manifests/consul/server.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/profiles/manifests/consul/server.pp b/site/profiles/manifests/consul/server.pp index 28f144b..9e4b90c 100644 --- a/site/profiles/manifests/consul/server.pp +++ b/site/profiles/manifests/consul/server.pp @@ -132,7 +132,7 @@ class profiles::consul::server ( 'advertise_addr' => $advertise_addr, 'retry_join' => $servers_array, 'retry_join_wan' => $remote_servers_array, - 'connect' => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true }, + 'connect' => { 'enabled' => true }, 'recursors' => ['198.18.19.16'], }, } -- 2.47.3