Update to 2022-09-06 18:00

roles/consul/templates/agent.token.tpl.j2

@@ -0,0 +1,3 @@
+[[ with secret "{{ consul_vault_secrets.tokens.path }}/creds/{{ consul_vault_secrets.tokens.role }}" ]]
+[[ .Data.token ]]
+[[ end ]]

roles/consul/templates/agent_cert.tpl.j2

@@ -1,14 +1,14 @@
 {% if consul_conf.server %}
-[[ with secret "{{ consul_vault_tls.pki.path }}/issue/{{ consul_vault_tls.pki.role }}" "common_name=server-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "ttl={{ consul_vault_tls.pki.ttl }}" "alt_names=localhost,consul.service.{{ consul_conf.domain | default('consul') }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ with secret "{{ consul_vault_secrets.pki.path }}/issue/{{ consul_vault_secrets.pki.role }}" "common_name=server-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "alt_names=localhost,consul.service.{{ consul_conf.domain | default('consul') }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
 [[ .Data.{{ item.what }} ]]
 [[ end ]]
 {% if item.what == 'certificate' %}
-[[ with secret "{{ consul_vault_tls.pki.path }}/cert/ca" ]]
+[[ with secret "{{ consul_vault_secrets.pki.path }}/cert/ca" ]]
 [[ .Data.certificate ]]
 [[ end ]]
 {% endif %}
 {% else %}
-[[ with secret "{{ consul_vault_tls.pki.path }}/cert/ca" ]]
+[[ with secret "{{ consul_vault_secrets.pki.path }}/cert/ca" ]]
 [[ .Data.certificate ]]
 [[ end ]]
 {% endif %}

roles/consul/templates/cli_cert.tpl.j2

@@ -1,3 +1,3 @@
-[[ with secret "{{ consul_vault_tls.pki.path }}/issue/{{ consul_vault_tls.pki.role }}" "ttl={{ consul_vault_tls.pki.ttl }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ with secret "{{ consul_vault_secrets.pki.path }}/issue/{{ consul_vault_secrets.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
 [[ .Data.{{ item.what }} ]]
 [[ end ]]

roles/consul/templates/consul-template-consul.service.j2

@@ -8,6 +8,7 @@ ConditionFileNotEmpty={{ consul_root_dir }}/consul-template/consul-template.hcl
 [Service]
 Type=simple
 ExecStart=/usr/local/bin/consul-template -config={{ consul_root_dir }}/consul-template/consul-template.hcl
+SuccessExitStatus=12
 ExecReload=/bin/kill --signal HUP $MAINPID
 KillSignal=SIGINT
 Restart=on-failure

roles/consul/templates/consul-template.hcl.j2

@@ -1,6 +1,6 @@
 vault {
-  address      = "{{ consul_vault_tls.address }}"
-  token        = "{{ consul_vault_tls.token }}"
+  address      = "{{ consul_vault_secrets.vault_address }}"
+  token        = "{{ consul_vault_secrets.vault_token }}"
   unwrap_token = false
 }
 
@@ -11,10 +11,11 @@ template {
   destination     = "{{ consul_conf.tls.defaults.ca_file }}"
   perms           = 0644
   exec {
-    command = "systemctl reload consul"
+    command = "sh -c 'systemctl reload consul || true'"
   }
 }
 
+{% if consul_vault_secrets.pki.enabled %}
 {% if consul_conf.server %}
 template {
   source          = "{{ consul_root_dir }}/consul-template/agent.crt.tpl"
@@ -23,7 +24,7 @@ template {
   destination     = "{{ consul_conf.tls.defaults.cert_file }}"
   perms           = 0644
   exec {
-    command = "systemctl reload consul"
+    command = "sh -c 'systemctl reload consul || true'"
   }
 }
 
@@ -34,7 +35,7 @@ template {
   destination     = "{{ consul_conf.tls.defaults.key_file }}"
   perms           = 0640
   exec {
-    command = ["sh", "-c", "chgrp {{ consul_user }} {{ consul_conf.tls.defaults.key_file }} && systemctl reload consul"]
+    command = "sh -c 'chgrp {{ consul_user }} {{ consul_conf.tls.defaults.key_file }} && systemctl reload consul || true'"
   }
 }
 
@@ -53,3 +54,17 @@ template {
   perms           = 0640
 }
 {% endif %}
+{% endif %}
+
+{% if consul_vault_secrets.tokens.enabled %}
+template {
+  source          = "{{ consul_root_dir }}/consul-template/agent.token.tpl"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  destination     = "{{ consul_root_dir }}/tmp/agent.token"
+  perms           = 0600
+  exec {
+    command = "sh -c 'consul acl set-agent-token default $(grep -P \'^[^\s]\' {{ consul_root_dir }}/tmp/agent.token)'"
+  }
+}
+{% endif %}

roles/consul/templates/consul.hcl.j2

@@ -73,8 +73,19 @@ connect {
 {% endif %}
 
 acl {
-  enabled = {{ consul_conf.acl.enabled | ternary('true', 'false') }}
+{% for key in ['enabled', 'enable_token_persistence'] %}
+{% if consul_conf.acl[key] is defined %}
+  {{ key }} = {{ consul_conf.acl[key] | ternary('true', 'false') }}
+{% endif %}
+{% endfor %}
   default_policy = "{{ consul_conf.acl.default_policy }}"
+  tokens {
+{% for key in ['initial_management', 'default', 'agent', 'agent_recovery', 'replication'] %}
+{% if consul_conf.acl.tokens[key] is defined %}
+    {{ key }} = "{{ consul_conf.acl.tokens[key] }}"
+{% endif %}
+{% endfor %}
+  }
 }
 
 {% if consul_conf.tls.enabled %}
@@ -108,5 +119,4 @@ auto_encrypt {
   tls = true
 }
 {% endif %}
-
 {% endif %}

roles/consul/templates/profile.sh.j2

@@ -2,7 +2,7 @@
 export CONSUL_HTTP_ADDR=https://localhost:{{ consul_services.https.port }}
 export CONSUL_HTTP_SSL=true
 export CONSUL_CACERT={{ consul_conf.tls.defaults.ca_file }}
-{% if consul_vault_tls.enabled %}
+{% if consul_vault_secrets.pki.enabled %}
 export CONSUL_CLIENT_CERT={{ consul_root_dir }}/tls/cli.crt
 export CONSUL_CLIENT_KEY={{ consul_root_dir }}/tls/cli.key
 export CONSUL_TLS_SERVER_NAME=server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}