From 3e90f5907c4ba80560c81e8d2a4773db69f22d94 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 7 Oct 2026 11:54:02 +1100 Subject: [PATCH 1/3] Add consul mesh gateway on consul servers --- hieradata/roles/infra/storage/consul.yaml | 12 +++++ .../profiles/manifests/consul/mesh_gateway.pp | 48 +++++++++++++++++++ site/roles/manifests/infra/storage/consul.pp | 1 + 3 files changed, 61 insertions(+) create mode 100644 site/profiles/manifests/consul/mesh_gateway.pp diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml index 390e082..ff7c2ea 100644 --- a/hieradata/roles/infra/storage/consul.yaml +++ b/hieradata/roles/infra/storage/consul.yaml @@ -57,6 +57,18 @@ profiles::consul::client::node_rules: - resource: service segment: frr_exporter disposition: write + - resource: service + segment: mesh-gateway + disposition: write + - resource: service_prefix + segment: '' + disposition: read + - resource: node_prefix + segment: '' + disposition: read + - resource: agent_prefix + segment: '' + disposition: read profiles::consul::prepared_query::rules: vault: ensure: 'present' diff --git a/site/profiles/manifests/consul/mesh_gateway.pp b/site/profiles/manifests/consul/mesh_gateway.pp new file mode 100644 index 0000000..d8e9cf4 --- /dev/null +++ b/site/profiles/manifests/consul/mesh_gateway.pp @@ -0,0 +1,48 @@ +# profiles::consul::mesh_gateway +class profiles::consul::mesh_gateway ( + Stdlib::IP::Address $address = $facts['networking']['ip'], + Stdlib::Port $port = 8443, + Stdlib::Port $http_port = 8500, + Stdlib::Port $grpc_port = 8502, + Stdlib::Absolutepath $token_file = '/etc/consul.d/mesh-gateway.token', +) { + include profiles::consul::client + + package { 'envoy': + ensure => installed, + } + + file { $token_file: + ensure => file, + owner => 'consul', + group => 'consul', + mode => '0600', + content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")), + } + + systemd::unit_file { 'consul-mesh-gateway.service': + enable => true, + active => true, + content => @("UNIT"), + [Unit] + Description=Consul mesh gateway (envoy) + Requires=consul.service + After=consul.service + + [Service] + User=consul + Group=consul + ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \ + -address=${address}:${port} -wan-address=${address}:${port} \ + -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \ + -token-file=${token_file} + Restart=on-failure + RestartSec=5 + + [Install] + WantedBy=multi-user.target + | UNIT + require => Package['envoy'], + subscribe => File[$token_file], + } +} diff --git a/site/roles/manifests/infra/storage/consul.pp b/site/roles/manifests/infra/storage/consul.pp index 143b167..0ea9474 100644 --- a/site/roles/manifests/infra/storage/consul.pp +++ b/site/roles/manifests/infra/storage/consul.pp @@ -8,5 +8,6 @@ class roles::infra::storage::consul { include profiles::base include profiles::base::datavol include profiles::consul::server + include profiles::consul::mesh_gateway } } -- 2.47.3 From 20a65dafcd3633c0966935968d36335d8d30c5c9 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 9 Oct 2026 19:31:57 +1100 Subject: [PATCH 2/3] Enable mesh gateway WAN federation on consul servers --- site/profiles/manifests/consul/server.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/profiles/manifests/consul/server.pp b/site/profiles/manifests/consul/server.pp index 9e4b90c..28f144b 100644 --- a/site/profiles/manifests/consul/server.pp +++ b/site/profiles/manifests/consul/server.pp @@ -132,7 +132,7 @@ class profiles::consul::server ( 'advertise_addr' => $advertise_addr, 'retry_join' => $servers_array, 'retry_join_wan' => $remote_servers_array, - 'connect' => { 'enabled' => true }, + 'connect' => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true }, 'recursors' => ['198.18.19.16'], }, } -- 2.47.3 From f6a429bdf107f341c35afd8011a4af6931c83a45 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 9 Oct 2026 19:31:58 +1100 Subject: [PATCH 3/3] Gate mesh gateway resources on the consul class --- .../profiles/manifests/consul/mesh_gateway.pp | 68 ++++++++++--------- 1 file changed, 36 insertions(+), 32 deletions(-) diff --git a/site/profiles/manifests/consul/mesh_gateway.pp b/site/profiles/manifests/consul/mesh_gateway.pp index d8e9cf4..07869be 100644 --- a/site/profiles/manifests/consul/mesh_gateway.pp +++ b/site/profiles/manifests/consul/mesh_gateway.pp @@ -8,41 +8,45 @@ class profiles::consul::mesh_gateway ( ) { include profiles::consul::client - package { 'envoy': - ensure => installed, - } + # include after profiles::consul::server, which declares Class['consul'] only once /data is mounted + if defined(Class['consul']) { + package { 'envoy': + ensure => installed, + } - file { $token_file: - ensure => file, - owner => 'consul', - group => 'consul', - mode => '0600', - content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")), - } + file { $token_file: + ensure => file, + owner => 'consul', + group => 'consul', + mode => '0600', + require => Class['consul'], + content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")), + } - systemd::unit_file { 'consul-mesh-gateway.service': - enable => true, - active => true, - content => @("UNIT"), - [Unit] - Description=Consul mesh gateway (envoy) - Requires=consul.service - After=consul.service + systemd::unit_file { 'consul-mesh-gateway.service': + enable => true, + active => true, + content => @("UNIT"), + [Unit] + Description=Consul mesh gateway (envoy) + Requires=consul.service + After=consul.service - [Service] - User=consul - Group=consul - ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \ - -address=${address}:${port} -wan-address=${address}:${port} \ - -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \ - -token-file=${token_file} - Restart=on-failure - RestartSec=5 + [Service] + User=consul + Group=consul + ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \ + -address=${address}:${port} -wan-address=${address}:${port} \ + -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \ + -token-file=${token_file} + Restart=on-failure + RestartSec=5 - [Install] - WantedBy=multi-user.target - | UNIT - require => Package['envoy'], - subscribe => File[$token_file], + [Install] + WantedBy=multi-user.target + | UNIT + require => [Package['envoy'], Class['consul']], + subscribe => File[$token_file], + } } } -- 2.47.3