Add consul mesh gateways and enable gateway WAN federation #549

Closed

unkin-agent wants to merge 5 commits from benvin/consul-mesh-gateway into benvin/consul-server-tls-fed

pull from: benvin/consul-mesh-gateway

merge into: unkin:benvin/consul-server-tls-fed

unkin:develop

unkin:benvin/wgvpn-role

unkin:benvin/consul-dns-k8s

unkin:benvin/consul-clients-k8s

unkin:benvin/consul-server-tls-fed

unkin:benvin/halb-drop-grafana

unkin:benvin/journald-explicit-port

unkin:benvin/certmanager-k8s-auth

unkin:benvin/openbao-plugin-socket-tmpfiles

unkin:benvin/netbox-facts

unkin:benvin/rke2_upgrade

unkin:benvin/artifactapi_repos

unkin:benvin/backend_dovecot

unkin:benvin/exporter_ip_loopback

unkin:neoloc/ceph

unkin:neoloc/mpls_mpbgp_rr

unkin:neoloc/firewall

unkin:neoloc/includegroups

unkin:neoloc/exportarr

unkin:neoloc/authproxy

unkin:neoloc/openldap

unkin:neoloc/puppetdb_ssl

unkin:master

Conversation 3 Commits 5 Files Changed 4

+66 -1

unkin-agent commented 2026-10-07 11:54:35 +11:00

Member

Copy Link

Copy Source

Federating the datacenters through mesh gateways needs an envoy gateway on each consul server, and the WAN federation flag must ship with the gateways. Requires rpmbuilder #187 (envoy RPM).

• add profiles::consul::mesh_gateway running consul connect envoy -gateway=mesh -expose-servers as a systemd unit with its own ACL token file
• gate the gateway on Class['consul'], which servers only declare once /data is mounted
• include the gateway in the consul server role
• enable enable_mesh_gateway_wan_federation on consul servers

Federating the datacenters through mesh gateways needs an envoy gateway on each consul server, and the WAN federation flag must ship with the gateways. Requires rpmbuilder #187 (envoy RPM). - add profiles::consul::mesh_gateway running `consul connect envoy -gateway=mesh -expose-servers` as a systemd unit with its own ACL token file - gate the gateway on Class['consul'], which servers only declare once /data is mounted - include the gateway in the consul server role - enable `enable_mesh_gateway_wan_federation` on consul servers

unkin-agent added 1 commit 2026-10-07 11:54:35 +11:00

Add consul mesh gateway on consul servers 3e90f5907c

unkin-agent commented 2026-10-07 11:56:32 +11:00

Author

Member

Copy Link

Copy Source

• hieradata/roles/infra/storage/consul.yaml:61 — mesh-gateway token policy lacks mesh = "write", which Consul requires for the gateway leaf cert. puppet-consul 9.1.0 consul_policy cannot encode a top-level mesh rule (only acl/operator/keyring), so it cannot be added to node_rules → give the gateway its own token whose policy includes mesh = "write", managed outside consul_policy rules, or extend the encoder.

- hieradata/roles/infra/storage/consul.yaml:61 — mesh-gateway token policy lacks `mesh = "write"`, which Consul requires for the gateway leaf cert. puppet-consul 9.1.0 `consul_policy` cannot encode a top-level `mesh` rule (only acl/operator/keyring), so it cannot be added to node_rules → give the gateway its own token whose policy includes `mesh = "write"`, managed outside `consul_policy` rules, or extend the encoder.

unkin-agent added 1 commit 2026-10-07 11:58:38 +11:00

Merge remote-tracking branch 'origin/benvin/consul-server-tls-fed' into benvin/consul-mesh-gateway 2651449d57

unkin-agent referenced this pull request 2026-10-07 12:02:14 +11:00

Enable TLS on consul servers and drop WAN retry join #548

unkin-agent commented 2026-10-07 12:02:39 +11:00

Author

Member

Copy Link

Copy Source

• nit: site/profiles/manifests/consul/mesh_gateway.pp:45 — unit/token file have no ordering on Class['consul'] (consul binary, consul.service, consul user); on a fresh server where server.pp skips Class['consul'] (no /data mount yet) the first run fails on owner=>consul and Requires=consul.service → require Class['consul'] or gate the profile on defined(Class['consul']) like server.pp does

- nit: site/profiles/manifests/consul/mesh_gateway.pp:45 — unit/token file have no ordering on Class['consul'] (consul binary, consul.service, consul user); on a fresh server where server.pp skips Class['consul'] (no /data mount yet) the first run fails on owner=>consul and Requires=consul.service → require Class['consul'] or gate the profile on defined(Class['consul']) like server.pp does

unkin-agent added 3 commits 2026-10-09 19:32:01 +11:00

Merge remote-tracking branch 'origin/benvin/consul-server-tls-fed' into benvin/consul-mesh-gateway 368e98f747

Enable mesh gateway WAN federation on consul servers 20a65dafcd

Gate mesh gateway resources on the consul class f6a429bdf1

unkin-agent changed title from Add consul mesh gateway on consul servers to Add consul mesh gateways and enable gateway WAN federation 2026-10-09 19:32:07 +11:00

unkin-agent commented 2026-10-09 19:44:50 +11:00

Author

Member

Copy Link

Copy Source

• site/profiles/manifests/consul/server.pp:135 — enable_mesh_gateway_wan_federation with node_name = fqdn breaks WAN gossip: wanfed SplitNodeName rejects any WAN name not exactly <node>.<dc> (consul v1.22.7 agent/consul/wanfed/wanfed.go:160-166), so every WAN dial/write fails and servers never WAN-join each other or a remote DC → move servers to a dotless node_name (hostname) and matching <hostname>.server.<dc>.consul SANs in an earlier PR of the stack before enabling this flag
• nit: hieradata/roles/infra/storage/consul.yaml:61 — node policy grants (mesh-gateway write, service_prefix/node_prefix/agent_prefix read) are not in the PR body → add them to the change list

- site/profiles/manifests/consul/server.pp:135 — `enable_mesh_gateway_wan_federation` with `node_name` = fqdn breaks WAN gossip: wanfed `SplitNodeName` rejects any WAN name not exactly `<node>.<dc>` (consul v1.22.7 agent/consul/wanfed/wanfed.go:160-166), so every WAN dial/write fails and servers never WAN-join each other or a remote DC → move servers to a dotless `node_name` (hostname) and matching `<hostname>.server.<dc>.consul` SANs in an earlier PR of the stack before enabling this flag - nit: hieradata/roles/infra/storage/consul.yaml:61 — node policy grants (`mesh-gateway` write, `service_prefix`/`node_prefix`/`agent_prefix` read) are not in the PR body → add them to the change list

unkin-agent closed this pull request 2026-10-09 22:18:27 +11:00

Some checks are pending

Hide all checks

ci/woodpecker/pr/bolt-validate Pipeline was successful

Details

ci/woodpecker/pr/yamllint Pipeline was successful

Details

ci/woodpecker/pr/erb-validate Pipeline was successful

Details

ci/woodpecker/pr/puppet-lint Pipeline was successful

Details

ci/woodpecker/pr/ruby-validate Pipeline was successful

Details

ci/woodpecker/pr/epp-validate Pipeline was successful

Details

ci/woodpecker/pr/puppet-validate Pipeline was successful

Details

ci/woodpecker/pr/ruby-check Pipeline was successful

Details

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#549