Infra: Backend infra upgrade

Signed-off-by: pmikus <pmikus@cisco.com>
Change-Id: If1e659339f0d25ebcaab4388745c62aa0852abb3

6 files changed, 64 insertions, 50 deletions

diff --git a/fdio.infra.ansible/roles/consul/defaults/main.yaml b/fdio.infra.ansible/roles/consul/defaults/main.yaml
index 786554eb58..b875c88c74 100644
--- a/fdio.infra.ansible/roles/consul/defaults/main.yaml
+++ b/fdio.infra.ansible/roles/consul/defaults/main.yaml
@@ -3,14 +3,9 @@
 
 # Inst - Prerequisites.
 packages: "{{ packages_base + packages_by_distro[ansible_distribution | lower] + packages_by_arch[ansible_machine] }}"
-
 packages_base:
-  - "cgroup-bin"
   - "curl"
-  - "git"
-  - "libcgroup1"
   - "unzip"
-  - "htop"
 packages_by_distro:
   ubuntu:
     - []
@@ -20,7 +15,7 @@ packages_by_arch:
   x86_64:
     - []
 
-# Inst - Download Consul.
+# Inst - Consul Map.
 consul_architecture_map:
   amd64: "amd64"
   x86_64: "amd64"
@@ -29,7 +24,7 @@ consul_architecture_map:
   32-bit: "386"
   64-bit: "amd64"
 consul_architecture: "{{ consul_architecture_map[ansible_architecture] }}"
-consul_version: "1.8.6"
+consul_version: "1.9.5"
 consul_pkg: "consul_{{ consul_version }}_linux_{{ consul_architecture }}.zip"
 consul_zip_url: "https://releases.hashicorp.com/consul/{{ consul_version }}/{{ consul_pkg }}"
 
@@ -52,20 +47,17 @@ systemd_resolved_state: "stopped"
 # Conf - User and group.
 consul_group: "consul"
 consul_group_state: "present"
-consul_manage_group: true
-consul_manage_user: true
 consul_user: "consul"
-consul_user_groups: [ docker, nomad, consul, root ]
 consul_user_state: "present"
 
 # Conf - nomad.d/consul.hcl
 consul_nomad_integration: true
 consul_certificates:
-  - src: "{{ vault_consul_v1_ca_file }}"
+  - src: "{{ file_consul_ca_pem }}"
     dest: "{{ consul_ca_file }}"
-  - src: "{{ vault_consul_v1_cert_file }}"
+  - src: "{{ file_consul_server_0_pem }}"
     dest: "{{ consul_cert_file }}"
-  - src: "{{ vault_consul_v1_key_file }}"
+  - src: "{{ file_consul_server_0_key_pem }}"
     dest: "{{ consul_key_file }}"
 
 consul_auto_advertise: true
@@ -92,7 +84,8 @@ consul_encrypt: ""
 consul_ca_file: "{{ consul_ssl_dir }}/ca.pem"
 consul_cert_file: "{{ consul_ssl_dir }}/consul.pem"
 consul_key_file: "{{ consul_ssl_dir }}/consul-key.pem"
-consul_ui: true
+consul_ui_config:
+  enabled: true
 consul_recursors:
   - 1.1.1.1
   - 8.8.8.8
@@ -107,4 +100,4 @@ consul_port_serf_wan: 8302
 consul_port_server: 8300
 
 # Conf - services.json
-consul_services: false
\ No newline at end of file
+consul_services: false
diff --git a/fdio.infra.ansible/roles/consul/handlers/main.yaml b/fdio.infra.ansible/roles/consul/handlers/main.yaml
index 338baea74e..d0e0c598a9 100644
--- a/fdio.infra.ansible/roles/consul/handlers/main.yaml
+++ b/fdio.infra.ansible/roles/consul/handlers/main.yaml
@@ -14,10 +14,3 @@
     enabled: true
     name: "consul"
     state: "{{ consul_restart_handler_state }}"
-
-- name: Stop Systemd-resolved
-  systemd:
-    daemon_reload: true
-    enabled: false
-    name: "systemd-resolved"
-    state: "{{ systemd_resolved_state }}"
\ No newline at end of file
diff --git a/fdio.infra.ansible/roles/consul/meta/main.yaml b/fdio.infra.ansible/roles/consul/meta/main.yaml
index 4ada8efad6..5fb7e185c0 100644
--- a/fdio.infra.ansible/roles/consul/meta/main.yaml
+++ b/fdio.infra.ansible/roles/consul/meta/main.yaml
@@ -7,3 +7,16 @@
 # info: 1.0 - added role
 
 dependencies: [ ]
+galaxy_info:
+  role_name: consul
+  author: fd.io
+  description: Hashicrop Consul.
+  company: none
+  license: "license (Apache)"
+  min_ansible_version: 2.9
+  platforms:
+    - name: Ubuntu
+      versions:
+        - focal
+  galaxy_tags:
+    - consul
diff --git a/fdio.infra.ansible/roles/consul/tasks/main.yaml b/fdio.infra.ansible/roles/consul/tasks/main.yaml
index 99ac52da44..834d7f1798 100644
--- a/fdio.infra.ansible/roles/consul/tasks/main.yaml
+++ b/fdio.infra.ansible/roles/consul/tasks/main.yaml
@@ -3,7 +3,7 @@
 
 - name: Inst - Update Package Cache (APT)
   apt:
-    update_cache: yes
+    update_cache: true
     cache_valid_time: 3600
   when:
     - ansible_distribution|lower == 'ubuntu'
@@ -21,8 +21,6 @@
   group:
     name: "{{ consul_group }}"
     state: "{{ consul_group_state }}"
-  when:
-    - consul_manage_group | bool
   tags:
     - consul-conf-user
 
@@ -30,11 +28,8 @@
   user:
     name: "{{ consul_user }}"
     group: "{{ consul_group }}"
-    groups: "{{ consul_user_groups }}"
     state: "{{ consul_user_state }}"
     system: true
-  when:
-    - consul_manage_user | bool
   tags:
     - consul-conf-user
 
@@ -167,6 +162,15 @@
   tags:
     - consul-conf
 
+- name: Conf - Stop Systemd-resolved
+  systemd:
+    daemon_reload: true
+    enabled: false
+    name: "systemd-resolved"
+    state: "{{ systemd_resolved_state }}"
+  tags:
+    - consul-conf
+
 - name: Conf - System.d Script
   template:
     src: "consul_systemd.service.j2"
@@ -174,9 +178,10 @@
     owner: "root"
     group: "root"
     mode: 0644
-#  notify:
-#    - "Restart Consul"
-#    - "Stop Systemd-resolved"
-#    - "Restart Nomad"
+  notify:
+    - "Restart Consul"
+    - "Restart Nomad"
   tags:
     - consul-conf
+
+- meta: flush_handlers
diff --git a/fdio.infra.ansible/roles/consul/templates/base.hcl.j2 b/fdio.infra.ansible/roles/consul/templates/base.hcl.j2
index 536c48d847..dab43fb3fc 100644
--- a/fdio.infra.ansible/roles/consul/templates/base.hcl.j2
+++ b/fdio.infra.ansible/roles/consul/templates/base.hcl.j2
@@ -14,14 +14,14 @@ server = {{ consul_node_server | bool | lower }}
 encrypt = "{{ consul_encrypt }}"
 {% if consul_node_server | bool == True %}
 bootstrap_expect = {{ consul_bootstrap_expect }}
-verify_incoming = true
-verify_outgoing = true
-verify_server_hostname = true
+verify_incoming = false
+verify_outgoing = false
+verify_server_hostname = false
 ca_file = "{{ consul_ca_file }}"
 cert_file = "{{ consul_cert_file }}"
 key_file = "{{ consul_key_file }}"
 auto_encrypt {
-  allow_tls = true
+  allow_tls = false
 }
 {% else %}
 verify_incoming = false
@@ -36,7 +36,20 @@ auto_encrypt {
 retry_join = [ {% for ip_port in consul_retry_servers -%} "{{ ip_port }}"{% if not loop.last %}, {% endif %}{%- endfor -%} ]
 {%- endif %}
 
-ui = {{ consul_ui | bool | lower }}
+{% if consul_ui_config -%}
+ui_config {
+{% for key, value in consul_ui_config.items() %}
+  {%- if value|bool %}
+  {{ key }} = {{ value | bool | lower }}
+  {%- elif value|string or value == "" %}
+  {{ key }} = "{{ value }}"
+  {%- else %}
+  {{ key }} = {{ value }}
+  {%- endif %}
+{% endfor %}
+
+}
+{%- endif %}
 
 {% if consul_recursors -%}
 recursors = [ {% for server in consul_recursors -%} "{{ server }}"{% if not loop.last %}, {% endif %}{%- endfor -%} ]
diff --git a/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2 b/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2
index 8e1ef1310d..16874f213e 100644
--- a/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2
+++ b/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2
@@ -1,21 +1,18 @@
 [Unit]
-Description=Consul Service
-Documentation=https://www.nomadproject.io/docs/
-Wants=network-online.target
+Description="HashiCorp Consul - A service mesh solution"
+Documentation=https://www.consul.io/
+Requires=network-online.target
 After=network-online.target
 
 [Service]
-# TODO: Decrease privilege
-ExecReload=/bin/kill -SIGHUP $MAINPID
-ExecStart={{ consul_bin_dir }}/consul agent -config-dir {{ consul_config_dir }}
-KillSignal=SIGTERM
-LimitNOFILE=infinity
-LimitNPROC=infinity
-Restart=on-failure
-RestartSec=1
 User=root
 Group=root
-Environment="GOMAXPROCS=2"
+ExecStart={{ consul_bin_dir }}/consul agent -config-dir={{ consul_config_dir }}
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillMode=process
+KillSignal=SIGTERM
+Restart=on-failure
+LimitNOFILE=infinity
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target
\ No newline at end of file