consul: ACL, policies, tokens

seb4itik/byow/roles/consul/tasks/main.yml

@@ -3,13 +3,6 @@
     name:
       - "unzip"
 
- # Not required for Ubuntu 24, was a test for Debian 13
-- name: Disable IPv6 on all interfaces
-  ansible.posix.sysctl:
-    name: "net.ipv6.conf.all.disable_ipv6"
-    value: "1"
-    sysctl_set: true
-
 - name: Create Consul directory
   ansible.builtin.file:
     path: "/usr/local/consul-{{ consul_version }}"
@@ -25,20 +18,12 @@
   notify:
     - "Restart Consul"
 
-- name: Link Consul
-  ansible.builtin.file:
-    src: "/usr/local/consul-{{ consul_version }}/consul"
-    dest: "/usr/local/bin/consul"
-    state: "link"
-  notify:
-    - "Restart Consul"
-
-- name: Create consul system group
+- name: Create Consul system group
   ansible.builtin.group:
     name: "consul"
     system: true
 
-- name: Create consul system user
+- name: Create Consul system user
   ansible.builtin.user:
     name: "consul"
     group: "consul"
@@ -47,14 +32,14 @@
     system: true
     home: "/opt/consul"
 
-- name: Create consul config directory
+- name: Create Consul config directory
   ansible.builtin.file:
     path: "/etc/consul"
     state: "directory"
     group: "consul"
     mode: "0750"
 
-- name: Create consul log dir
+- name: Create Consul log dir
   ansible.builtin.file:
     path: "/var/log/consul"
     state: "directory"
@@ -85,35 +70,162 @@
     enabled: true
     daemon_reload: true
 
-# consul acl bootstrap -format=json
-# {
-#     "CreateIndex": 1042,
-#     "ModifyIndex": 1042,
-#     "AccessorID": "50f8bfb6-b259-4c08-f9aa-2dc0eeb08e99",
-#     "SecretID": "b7f16a8a-0b4f-4661-fea2-f79d95dd011b",
-#     "Description": "Bootstrap Token (Global Management)",
-#     "Policies": [
-#         {
-#             "ID": "00000000-0000-0000-0000-000000000001",
-#             "Name": "global-management"
-#         }
-#     ],
-#     "Local": false,
-#     "CreateTime": "2026-01-19T18:41:13.294800712+03:00",
-#     "Hash": "X2AgaFhnQGRhSSF/h0m6qpX1wj/HJWbyXcxkEM/5GrY="
-# }
+- name: Generate Consul ACL config
+  when: "consul_server"
+  ansible.builtin.template:
+    src: "templates/acl.json"
+    dest: "/etc/consul/acl.json"
+    group: "consul"
+    mode: "0640"
+  notify:
+    - "Restart Consul"
+
+- name: Running handlers for restarting Consul if required
+  ansible.builtin.meta: "flush_handlers"
+
+- name: Bootstrap Consul ACL system
+  when: "consul_server"
+  run_once: true
+  community.general.consul_acl_bootstrap:
+    bootstrap_secret: "{{ consul_bootstrap_secret }}"
+
+- name: Create/retrieve Consul node agent accessor_id
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      if test -f /root/.consul_agent_accessor_id; then
+        echo OK
+      else
+        uuidgen > /root/.consul_agent_accessor_id
+        echo CHANGED
+      fi
+      cat /root/.consul_agent_accessor_id
+  register: "consul_out_agent_accessor_id"
+  changed_when: "consul_out_agent_accessor_id.stdout_lines[0] == 'CHANGED'"
+
+- name: Create/retrieve Consul node agent token
+  community.general.consul_token:
+    token: "{{ consul_bootstrap_secret }}"
+    accessor_id: "{{ consul_out_agent_accessor_id.stdout_lines[1] }}"
+    description: "Node {{ ansible_fqdn }}"
+    node_identities:
+      - datacenter: "{{ consul_datacenter }}"
+        node_name: "{{ ansible_hostname }}"
+  register: "consul_out_agent_token"
+
+- name: Create Consul policy for DNS agent
+  when: "consul_server"
+  run_once: true
+  community.general.consul_policy:
+    token: "{{ consul_bootstrap_secret }}"
+    name: "dns-access"
+    rules: |
+      node_prefix "" {
+        policy = "read"
+      }
+      {% for service in consul_services %}
+      service "{{ service.name }}" {
+        policy = "read"
+      }
+      {% endfor %}
+
+- name: Create/retrieve Consul DNS agent accessor_id
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      if test -f /root/.consul_dns_accessor_id; then
+        echo OK
+      else
+        uuidgen > /root/.consul_dns_accessor_id
+        echo CHANGED
+      fi
+      cat /root/.consul_dns_accessor_id
+  register: "consul_out_dns_accessor_id"
+  changed_when: "consul_out_dns_accessor_id.stdout_lines[0] == 'CHANGED'"
+
+- name: Create/retrieve Consul DNS agent token
+  when: "consul_server"
+  community.general.consul_token:
+    token: "{{ consul_bootstrap_secret }}"
+    accessor_id: "{{ consul_out_dns_accessor_id.stdout_lines[1] }}"
+    description: "DNS {{ ansible_fqdn }}"
+    policies:
+      - name: "dns-access"
+  register: "consul_out_dns_token"
+
+- name: Generate Consul agent tokens config
+  ansible.builtin.template:
+    src: "templates/tokens.json"
+    dest: "/etc/consul/tokens.json"
+    group: "consul"
+    mode: "0640"
+  notify:
+    - "Restart Consul"
+
+- name: Running handlers for restarting Consul if required
+  ansible.builtin.meta: "flush_handlers"
+
+- name: Create Consul policy for UI
+  when: "consul_server and consul_ui_secret_id != None"
+  run_once: true
+  community.general.consul_policy:
+    token: "{{ consul_bootstrap_secret }}"
+    name: "ui-access"
+    rules: |
+      key_prefix "" {
+        policy = "write"
+      }
+      node_prefix "" {
+        policy = "read"
+      }
+      service_prefix "" {
+        policy = "read"
+      }
+
+- name: Create/retrieve Consul UI accessor_id
+  when: "consul_server and consul_ui_secret_id != None and consul_servers[0] == ansible_hostname"
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      if test -f /root/.consul_ui_accessor_id; then
+        echo OK
+      else
+        uuidgen > /root/.consul_ui_accessor_id
+        echo CHANGED
+      fi
+      cat /root/.consul_ui_accessor_id
+  register: "consul_out_ui_accessor_id"
+  changed_when: "consul_out_ui_accessor_id.stdout_lines[0] == 'CHANGED'"
+
+- name: Create/retrieve Consul UI token
+  when: "consul_server and consul_ui_secret_id != None and consul_servers[0] == ansible_hostname"
+  community.general.consul_token:
+    token: "{{ consul_bootstrap_secret }}"
+    accessor_id: "{{ consul_out_ui_accessor_id.stdout_lines[1] }}"
+    secret_id: "{{ consul_ui_secret_id }}"
+    description: "UI"
+    policies:
+      - name: "ui-access"
 
 - name: Register services to consul
   loop: "{{ consul_services }}"
   community.general.consul_agent_service:
+    token: "{{ consul_bootstrap_secret }}"
     name: "{{ item.name }}"
+    address: "{{ item.address | default(ansible_default_ipv4.address) }}"
     service_port: "{{ item.port }}"
     tags: "{{ item.tags | default([]) }}"
+  # Because community.general.consul_agent_check is not idempotent:
+  register: "consul_out_register_services"
 
 - name: Register HTTP checks to consul
   loop: "{{ consul_services }}"
-  when: "item.check_http | default(None) != None"
+  when: "consul_out_register_services.changed and (item.check_http | default(None) != None)"
   community.general.consul_agent_check:
+    token: "{{ consul_bootstrap_secret }}"
     name: "{{ item.name }}_check"
     service_id: "{{ item.name }}"
     interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
@@ -123,8 +235,9 @@
 
 - name: Register TCP checks to consul
   loop: "{{ consul_services }}"
-  when: "item.check_tcp | default(None) != None"
+  when: "consul_out_register_services and (item.check_tcp | default(None) != None)"
   community.general.consul_agent_check:
+    token: "{{ consul_bootstrap_secret }}"
     name: "{{ item.name }}_check"
     service_id: "{{ item.name }}"
     interval: "{{ item.check_interval | default(consul_default_check_interval) }}"