hieradata/roles/infra/storage/consul.yaml

@@ -58,6 +58,18 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: frr_exporter
     disposition: write
+  - resource: service
+    segment: mesh-gateway
+    disposition: write
+  - resource: service_prefix
+    segment: ''
+    disposition: read
+  - resource: node_prefix
+    segment: ''
+    disposition: read
+  - resource: agent_prefix
+    segment: ''
+    disposition: read
 profiles::consul::prepared_query::rules:
   vault:
     ensure: 'present'

site/profiles/manifests/consul/mesh_gateway.pp

@@ -0,0 +1,52 @@
+# profiles::consul::mesh_gateway
+class profiles::consul::mesh_gateway (
+  Stdlib::IP::Address $address    = $facts['networking']['ip'],
+  Stdlib::Port        $port       = 8443,
+  Stdlib::Port        $http_port  = 8500,
+  Stdlib::Port        $grpc_port  = 8502,
+  Stdlib::Absolutepath $token_file = '/etc/consul.d/mesh-gateway.token',
+) {
+  include profiles::consul::client
+
+  # include after profiles::consul::server, which declares Class['consul'] only once /data is mounted
+  if defined(Class['consul']) {
+    package { 'envoy':
+      ensure => installed,
+    }
+
+    file { $token_file:
+      ensure  => file,
+      owner   => 'consul',
+      group   => 'consul',
+      mode    => '0600',
+      require => Class['consul'],
+      content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
+    }
+
+    systemd::unit_file { 'consul-mesh-gateway.service':
+      enable    => true,
+      active    => true,
+      content   => @("UNIT"),
+        [Unit]
+        Description=Consul mesh gateway (envoy)
+        Requires=consul.service
+        After=consul.service
+
+        [Service]
+        User=consul
+        Group=consul
+        ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
+          -address=${address}:${port} -wan-address=${address}:${port} \
+          -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
+          -token-file=${token_file}
+        Restart=on-failure
+        RestartSec=5
+
+        [Install]
+        WantedBy=multi-user.target
+        | UNIT
+      require   => [Package['envoy'], Class['consul']],
+      subscribe => File[$token_file],
+    }
+  }
+}

site/profiles/manifests/consul/server.pp

@@ -132,7 +132,7 @@ class profiles::consul::server (
           'advertise_addr'       => $advertise_addr,
           'retry_join'           => $servers_array,
           'retry_join_wan'       => $remote_servers_array,
-          'connect'              => { 'enabled' => true },
+          'connect'              => { 'enabled' => true, 'enable_mesh_gateway_wan_federation' => true },
           'recursors'            => ['198.18.19.16'],
         },
       }

site/roles/manifests/infra/storage/consul.pp

@@ -8,5 +8,6 @@ class roles::infra::storage::consul {
     include profiles::base
     include profiles::base::datavol
     include profiles::consul::server
+    include profiles::consul::mesh_gateway
   }
 }