Update to 2023-07-08 16:00

roles/consul/templates/agent_token.tpl.j2

@@ -1,3 +0,0 @@
-[[ with secret "{{ consul_vault_agent.tokens.path }}/creds/{{ consul_vault_agent.tokens.role }}" ]]
-[[ .Data.token ]]
-[[ end ]]

roles/consul/templates/consul.service.j2

@@ -3,10 +3,6 @@ Description="HashiCorp Consul - A service mesh solution"
 Documentation=https://www.consul.io/
 Requires=network-online.target
 After=network-online.target
-After=consul-vault-agent.service
-{% if consul_vault_agent.vault_address is defined and consul_vault_agent.pki.enabled %}
-Requires=consul-vault-agent.service
-{% endif %}
 ConditionFileNotEmpty={{ consul_root_dir }}/etc/consul.hcl
 
 # Consul version {{ consul_current_version }}
@@ -15,7 +11,7 @@ Type=notify
 EnvironmentFile=-{{ consul_root_dir }}/etc/consul.env
 User={{ consul_user }}
 Group={{ consul_user }}
-ExecStart={{ consul_root_dir }}/bin/consul
+ExecStart=/usr/local/bin/consul agent -config-dir {{ consul_root_dir }}/etc/
 ExecReload=/bin/kill --signal HUP $MAINPID
 SuccessExitStatus=1
 Restart=on-failure

roles/consul/templates/consul.sh.j2

@@ -1,19 +0,0 @@
-#!/bin/sh
-
-{% if consul_vault_agent.vault_address is defined and consul_vault_agent.pki.enabled %}
-if [ -f /run/consul/vault_token ]; then
-  exec env VAULT_TOKEN=$(vault unwrap -field=token $(jq -r '.token' /run/consul/vault_token)) \
-    /usr/local/bin/consul \
-      agent \
-      -config-dir={{ consul_root_dir }}/etc/ \
-      -pid-file /run/consul/consul_agent.pid
-else
-  echo "Consul service failed due to missing Vault token"
-  exit 1
-fi
-{% else %}
-exec /usr/local/bin/consul \
-  agent \
-  -config-dir={{ consul_root_dir }}/etc/ \
-  -pid-file /run/consul/consul_agent.pid
-{% endif %}

roles/consul/templates/vault/agent.hcl.j2

@@ -1,44 +0,0 @@
-vault {
-  address = "{{ consul_vault_agent.vault_address }}"
-}
-
-auto_auth {
-{% if  consul_vault_agent.auth.approle is defined %}
-  method {
-    type = "approle"
-    config {
-      role_id_file_path   = "{{ consul_root_dir }}/vault/role_id"
-      secret_id_file_path = "{{ consul_root_dir }}/vault/secret_id"
-      remove_secret_id_file_after_reading = false
-    }
-  }
-{% elif consul_vault_agent.auth.token is defined %}
-  method {
-    type = "token_file"
-    config {
-      token_file_path = "{{ consul_root_dir }}/vault/token"
-    }
-  }
-{% endif %}
-
-  sink {
-    type = "file"
-    wrap_ttl = "30s"
-    config = {
-      path = "/run/consul/vault_token"
-      mode = 640
-    }
-  }
-}
-
-template {
-  source = "{{ consul_root_dir }}/vault/templates/agent_bundle.pem.tpl"
-  destination = "{{ consul_root_dir }}/tls/agent_bundle.pem"
-  left_delimiter  = "[["
-  right_delimiter = "]]"
-  perms           = 0640
-  exec {
-    command = ["sh", "-c", "kill -USR1 $(cat /run/consul/consul_agent.pid)"]
-  }
-}
-

roles/consul/templates/vault/agent.service.j2

@@ -1,34 +0,0 @@
-[Unit]
-Description="HashiCorp Vault Agent for Consul"
-Documentation=https://www.vaultproject.io/docs/
-Requires=network-online.target
-After=network-online.target
-ConditionFileNotEmpty={{ consul_root_dir }}/vault/agent.hcl
-StartLimitIntervalSec=60
-StartLimitBurst=3
-PartOf=consul.service
-
-[Service]
-Type=notify
-User={{ consul_user }}
-Group={{ consul_user }}
-ProtectSystem=full
-ProtectHome=read-only
-PrivateTmp=yes
-PrivateDevices=yes
-SecureBits=keep-caps
-AmbientCapabilities=CAP_IPC_LOCK
-CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
-NoNewPrivileges=yes
-ExecStart=/usr/local/bin/vault agent -config={{ consul_root_dir }}/vault/agent.hcl
-ExecReload=/bin/kill --signal HUP $MAINPID
-KillMode=process
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=5
-TimeoutStopSec=30
-LimitNOFILE=65536
-LimitMEMLOCK=infinity
-
-[Install]
-WantedBy=multi-user.target

roles/consul/templates/vault/agent_bundle.pem.tpl.j2

@@ -1,17 +0,0 @@
-{% if consul_conf.server %}
-[[ with pkiCert "{{ consul_vault_agent.pki.path }}/issue/{{ consul_vault_agent.pki.role }}" "common_name=server-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" "alt_names=consul.service.{{ consul_conf.domain | default('consul') }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}{% if consul_conf.alt_domain is defined %},consul.service.{{ consul_conf.alt_domain }},server.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.alt_domain }}{% endif %}" "ttl=72h" ]]
-[[ .CA ]]
-[[ .Cert ]]
-[[ .Key ]]
-[[ .CA | writeToFile "{{ consul_conf.tls.defaults.ca_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
-[[ .Cert | writeToFile "{{ consul_conf.tls.defaults.cert_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
-[[ .Key | writeToFile "{{ consul_conf.tls.defaults.key_file }}" "{{ consul_user }}" "{{ consul_user }}" "0640" ]]
-[[ end ]]
-[[ with secret "{{ consul_vault_agent.pki.path }}/cert/ca" ]]
-[[ .Data.certificate | writeToFile "{{ consul_conf.tls.defaults.cert_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" "append,newline" ]]
-[[ end ]]
-{% else %}
-[[ with secret "{{ consul_vault_agent.pki.path }}/cert/ca" ]]
-[[ .Data.certificate | writeToFile "{{ consul_conf.tls.defaults.ca_file }}" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
-[[ end ]]
-{% endif %}

roles/consul/templates/vault/agent_token.tpl.j2

@@ -1,3 +0,0 @@
-[[ with secret "{{ consul_vault_agent.tokens.path }}/creds/{{ consul_vault_agent.tokens.role }}" ]]
-[[ .Data.token ]]
-[[ end ]]

roles/consul/templates/vault/cli_bundle.pem.tpl.j2

@@ -1,7 +0,0 @@
-[[ with pkiCert "{{ consul_vault_agent.pki.path }}/issue/{{ consul_vault_agent.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ consul_conf.datacenter | default('dc1') }}.{{ consul_conf.domain | default('consul') }}" ]]
-[[ .CA ]]
-[[ .Cert ]]
-[[ .Key ]]
-[[ .Cert | writeToFile "{{ consul_root_dir }}/tls/cli.crt" "{{ consul_user }}" "{{ consul_user }}" "0644" ]]
-[[ .Key | writeToFile "{{ consul_root_dir }}/tls/cli.key" "{{ consul_user }}" "{{ consul_user }}" "0640" ]]
-[[ end ]]