Update to 2023-07-05 19:00

roles/consul/templates/agent.token.tpl.j2

@@ -1,3 +0,0 @@
-[[ with secret "{{ consul_vault_secrets.tokens.path }}/creds/{{ consul_vault_secrets.tokens.role }}" ]]
-[[ .Data.token ]]
-[[ end ]]

roles/consul/templates/agent_bundle.pem.tpl.j2

@@ -1,18 +0,0 @@
-{% if consul_conf.server %}
-[[ with pkiCert "{{ consul_vault_secrets.pki.path }}/issue/{{ consul_vault_secrets.pki.role }}" "common_name=server-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "alt_names=localhost,consul.service.{{ consul_conf.domain | default('consul') }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}{% if consul_conf.alt_domain is defined %}consul.service.{{ consul_conf.alt_domain }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.alt_domain }}{% endif %}" ]]
-[[ .CA ]]
-[[ .Cert ]]
-[[ .Key ]]
-[[ .CA | writeToFile "{{ consul_conf.tls.defaults.ca_file }}" "root" "root" "0644" ]]
-[[ .Cert | writeToFile "{{ consul_conf.tls.defaults.cert_file }}" "root" "root" "0644" ]]
-[[ .Key | writeToFile "{{ consul_conf.tls.defaults.key_file }}" "root" "{{ consul_user }}" "0640" ]]
-[[ end ]]
-[[ with secret "{{ consul_vault_secrets.pki.path }}/cert/ca" ]]
-[[ .Data.certificate | writeToFile "{{ consul_conf.tls.defaults.cert_file }}" "root" "root" "0644" "append,newline" ]]
-[[ end ]]
-{% else %}
-[[ with secret "{{ consul_vault_secrets.pki.path }}/cert/ca" ]]
-[[ .Data.certificate | writeToFile "{{ consul_conf.tls.defaults.ca_file }}" "root" "root" "0644" ]]
-[[ end ]]
-{% endif %}
-

roles/consul/templates/agent_token.tpl.j2

@@ -0,0 +1,3 @@
+[[ with secret "{{ consul_vault_agent.tokens.path }}/creds/{{ consul_vault_agent.tokens.role }}" ]]
+[[ .Data.token ]]
+[[ end ]]

roles/consul/templates/cli_bundle.pem.tpl.j2

@@ -1,7 +0,0 @@
-[[ with pkiCert "{{ consul_vault_secrets.pki.path }}/issue/{{ consul_vault_secrets.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
-[[ .CA ]]
-[[ .Cert ]]
-[[ .Key ]]
-[[ .Cert | writeToFile "{{ consul_root_dir }}/tls/cli.crt" "root" "root" "0644" ]]
-[[ .Key | writeToFile "{{ consul_root_dir }}/tls/cli.key" "root" "root" "0640" ]]
-[[ end ]]

roles/consul/templates/consul-template-consul.service.j2

@@ -1,18 +0,0 @@
-[Unit]
-Description="HashiCorp consul-template"
-Documentation=https://github.com/hashicorp/consul-template
-Requires=network-online.target
-After=network-online.target
-ConditionFileNotEmpty={{ consul_root_dir }}/consul-template/consul-template.hcl
-
-[Service]
-Type=simple
-ExecStart=/usr/local/bin/consul-template -config={{ consul_root_dir }}/consul-template/consul-template.hcl
-SuccessExitStatus=12
-ExecReload=/bin/kill --signal HUP $MAINPID
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=2
-
-[Install]
-WantedBy=multi-user.target

roles/consul/templates/consul-template.hcl.j2

@@ -1,42 +0,0 @@
-vault {
-  address      = "{{ consul_vault_secrets.vault_address }}"
-  token        = "{{ consul_vault_secrets.vault_token }}"
-  unwrap_token = false
-}
-
-template {
-  source          = "{{ consul_root_dir }}/consul-template/agent_bundle.pem.tpl"
-  left_delimiter  = "[["
-  right_delimiter = "]]"
-  destination     = "{{ consul_root_dir }}/tls/agent_bundle.pem"
-  perms           = 0640
-  exec {
-    command = "sh -c 'systemctl reload consul || true'"
-  }
-}
-
-{% if consul_conf.server %}
-template {
-  source          = "{{ consul_root_dir }}/consul-template/cli_bundle.pem.tpl"
-  left_delimiter  = "[["
-  right_delimiter = "]]"
-  destination     = "{{ consul_root_dir }}/tls/cli_bundle.pem"
-  perms           = 0640
-  exec {
-    command = "sh -c 'systemctl reload consul || true'"
-  }
-}
-{% endif %}
-
-{% if consul_vault_secrets.tokens.enabled %}
-template {
-  source          = "{{ consul_root_dir }}/consul-template/agent.token.tpl"
-  left_delimiter  = "[["
-  right_delimiter = "]]"
-  destination     = "{{ consul_root_dir }}/tmp/agent.token"
-  perms           = 0600
-  exec {
-    command = "sh -c 'consul acl set-agent-token default $(grep -P \'^[^\s]\' {{ consul_root_dir }}/tmp/agent.token)'"
-  }
-}
-{% endif %}

roles/consul/templates/consul.hcl.j2

@@ -69,6 +69,28 @@ telemetry {
 {% if consul_conf.connect.enabled %}
 connect {
   enabled = true
+{% if consul_conf.connect.ca_provider is defined %}
+  ca_provider = "{{ consul_conf.connect.ca_provider }}"
+  ca_config {
+{% for key in ['address', 'token', 'root_pki_path', 'intermediate_pki_path'] %}
+{% if consul_conf.connect.ca_config[key] is defined %}
+    {{ key }} = "{{ consul_conf.connect.ca_config[key] }}"
+{% endif %}
+{% endfor %}
+{% if consul_conf.connect.ca_config.auth_method is defined %}
+    auth_method {
+{% if consul_conf.connect.ca_config.auth_method.approle is defined %}
+      type = "approle"
+      params {
+{% for key in ['role_id', 'secret_id'] %}
+        {{ key }} = "{{ consul_conf.connect.ca_config.auth_method.approle[key] }}"
+{% endfor %}
+      }
+{% endif %}
+    }
+{% endif %}
+  }
+{% endif %}
 }
 {% endif %}
 

roles/consul/templates/consul.service.j2

@@ -3,6 +3,10 @@ Description="HashiCorp Consul - A service mesh solution"
 Documentation=https://www.consul.io/
 Requires=network-online.target
 After=network-online.target
+After=consul-vault-agent.service
+{% if consul_vault_agent.vault_address is defined and consul_vault_agent.pki.enabled %}
+Requires=consul-vault-agent.service
+{% endif %}
 ConditionFileNotEmpty={{ consul_root_dir }}/etc/consul.hcl
 
 # Consul version {{ consul_current_version }}
@@ -11,7 +15,7 @@ Type=notify
 EnvironmentFile=-{{ consul_root_dir }}/etc/consul.env
 User={{ consul_user }}
 Group={{ consul_user }}
-ExecStart=/usr/local/bin/consul agent -config-dir={{ consul_root_dir }}/etc/
+ExecStart={{ consul_root_dir }}/bin/consul
 ExecReload=/bin/kill --signal HUP $MAINPID
 SuccessExitStatus=1
 Restart=on-failure

roles/consul/templates/consul.sh.j2

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+{% if consul_vault_agent.vault_address is defined and consul_vault_agent.pki.enabled %}
+if [ -f /run/consul/vault_token ]; then
+  exec env VAULT_TOKEN=$(vault unwrap -field=token $(jq -r '.token' /run/consul/vault_token)) \
+    /usr/local/bin/consul \
+      agent \
+      -config-dir={{ consul_root_dir }}/etc/ \
+      -pid-file /run/consul/consul_agent.pid
+else
+  echo "Consul service failed due to missing Vault token"
+  exit 1
+fi
+{% else %}
+exec /usr/local/bin/consul \
+  agent \
+  -config-dir={{ consul_root_dir }}/etc/ \
+  -pid-file /run/consul/consul_agent.pid
+{% endif %}

roles/consul/templates/profile.sh.j2

@@ -1,12 +1,5 @@
-{% if consul_conf.tls.enabled and consul_conf.server %}
-export CONSUL_HTTP_ADDR=https://localhost:{{ consul_services.https.port }}
-export CONSUL_HTTP_SSL=true
-export CONSUL_CACERT={{ consul_conf.tls.defaults.ca_file }}
-{% if consul_vault_secrets.pki.enabled %}
-export CONSUL_CLIENT_CERT={{ consul_root_dir }}/tls/cli.crt
-export CONSUL_CLIENT_KEY={{ consul_root_dir }}/tls/cli.key
-export CONSUL_TLS_SERVER_NAME=server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}
-{% endif %}
+{% if consul_conf.server %}
+export CONSUL_HTTP_ADDR=http://localhost:{{ consul_services.http.port }}
 {% else %}
-# TLS not enabled or not running in server mode
+# not running in server mode
 {% endif %}

roles/consul/templates/vault/agent.hcl.j2

@@ -0,0 +1,44 @@
+vault {
+  address = "{{ consul_vault_agent.vault_address }}"
+}
+
+auto_auth {
+{% if  consul_vault_agent.auth.approle is defined %}
+  method {
+    type = "approle"
+    config {
+      role_id_file_path   = "{{ consul_root_dir }}/vault/role_id"
+      secret_id_file_path = "{{ consul_root_dir }}/vault/secret_id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+{% elif consul_vault_agent.auth.token is defined %}
+  method {
+    type = "token_file"
+    config {
+      token_file_path = "{{ consul_root_dir }}/vault/token"
+    }
+  }
+{% endif %}
+
+  sink {
+    type = "file"
+    wrap_ttl = "30s"
+    config = {
+      path = "/run/consul/vault_token"
+      mode = 640
+    }
+  }
+}
+
+template {
+  source = "{{ consul_root_dir }}/vault/templates/agent_bundle.pem.tpl"
+  destination = "{{ consul_root_dir }}/tls/agent_bundle.pem"
+  left_delimiter  = "[["
+  right_delimiter = "]]"
+  perms           = 0640
+  exec {
+    command = ["sh", "-c", "kill -USR1 $(cat /run/consul/consul_agent.pid)"]
+  }
+}
+

roles/consul/templates/vault/agent.service.j2

@@ -0,0 +1,34 @@
+[Unit]
+Description="HashiCorp Vault Agent for Consul"
+Documentation=https://www.vaultproject.io/docs/
+Requires=network-online.target
+After=network-online.target
+ConditionFileNotEmpty={{ consul_root_dir }}/vault/agent.hcl
+StartLimitIntervalSec=60
+StartLimitBurst=3
+PartOf=consul.service
+
+[Service]
+Type=notify
+User={{ consul_user }}
+Group={{ consul_user }}
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=yes
+PrivateDevices=yes
+SecureBits=keep-caps
+AmbientCapabilities=CAP_IPC_LOCK
+CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
+NoNewPrivileges=yes
+ExecStart=/usr/local/bin/vault agent -config={{ consul_root_dir }}/vault/agent.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillMode=process
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+LimitNOFILE=65536
+LimitMEMLOCK=infinity
+
+[Install]
+WantedBy=multi-user.target

roles/consul/templates/vault/agent_bundle.pem.tpl.j2

@@ -0,0 +1,17 @@
+{% if consul_conf.server %}
+[[ with pkiCert "{{ consul_vault_agent.pki.path }}/issue/{{ consul_vault_agent.pki.role }}" "common_name=server-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "alt_names=consul.service.{{ consul_conf.domain | default('consul') }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}{% if consul_conf.alt_domain is defined %},consul.service.{{ consul_conf.alt_domain }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.alt_domain }}{% endif %}" "ttl=72h" ]]
+[[ .CA ]]
+[[ .Cert ]]
+[[ .Key ]]
+[[ .CA | writeToFile "{{ consul_conf.tls.defaults.ca_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
+[[ .Cert | writeToFile "{{ consul_conf.tls.defaults.cert_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
+[[ .Key | writeToFile "{{ consul_conf.tls.defaults.key_file }}" "{{ consul_user }}" "{{ consul_user }}" "0640" ]]
+[[ end ]]
+[[ with secret "{{ consul_vault_agent.pki.path }}/cert/ca" ]]
+[[ .Data.certificate | writeToFile "{{ consul_conf.tls.defaults.cert_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" "append,newline" ]]
+[[ end ]]
+{% else %}
+[[ with secret "{{ consul_vault_agent.pki.path }}/cert/ca" ]]
+[[ .Data.certificate | writeToFile "{{ consul_conf.tls.defaults.ca_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
+[[ end ]]
+{% endif %}

roles/consul/templates/vault/agent_token.tpl.j2

@@ -0,0 +1,3 @@
+[[ with secret "{{ consul_vault_agent.tokens.path }}/creds/{{ consul_vault_agent.tokens.role }}" ]]
+[[ .Data.token ]]
+[[ end ]]

roles/consul/templates/vault/cli_bundle.pem.tpl.j2

@@ -0,0 +1,7 @@
+[[ with pkiCert "{{ consul_vault_agent.pki.path }}/issue/{{ consul_vault_agent.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
+[[ .CA ]]
+[[ .Cert ]]
+[[ .Key ]]
+[[ .Cert | writeToFile "{{ consul_root_dir }}/tls/cli.crt" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
+[[ .Key | writeToFile "{{ consul_root_dir }}/tls/cli.key" "{{ consul_user }}" "{{ consul_user }}" "0640" ]]
+[[ end ]]