diff options
Diffstat (limited to 'fdio.infra.ansible/roles/consul')
6 files changed, 64 insertions, 50 deletions
diff --git a/fdio.infra.ansible/roles/consul/defaults/main.yaml b/fdio.infra.ansible/roles/consul/defaults/main.yaml index 786554eb58..b875c88c74 100644 --- a/fdio.infra.ansible/roles/consul/defaults/main.yaml +++ b/fdio.infra.ansible/roles/consul/defaults/main.yaml @@ -3,14 +3,9 @@ # Inst - Prerequisites. packages: "{{ packages_base + packages_by_distro[ansible_distribution | lower] + packages_by_arch[ansible_machine] }}" - packages_base: - - "cgroup-bin" - "curl" - - "git" - - "libcgroup1" - "unzip" - - "htop" packages_by_distro: ubuntu: - [] @@ -20,7 +15,7 @@ packages_by_arch: x86_64: - [] -# Inst - Download Consul. +# Inst - Consul Map. consul_architecture_map: amd64: "amd64" x86_64: "amd64" @@ -29,7 +24,7 @@ consul_architecture_map: 32-bit: "386" 64-bit: "amd64" consul_architecture: "{{ consul_architecture_map[ansible_architecture] }}" -consul_version: "1.8.6" +consul_version: "1.9.5" consul_pkg: "consul_{{ consul_version }}_linux_{{ consul_architecture }}.zip" consul_zip_url: "https://releases.hashicorp.com/consul/{{ consul_version }}/{{ consul_pkg }}" @@ -52,20 +47,17 @@ systemd_resolved_state: "stopped" # Conf - User and group. consul_group: "consul" consul_group_state: "present" -consul_manage_group: true -consul_manage_user: true consul_user: "consul" -consul_user_groups: [ docker, nomad, consul, root ] consul_user_state: "present" # Conf - nomad.d/consul.hcl consul_nomad_integration: true consul_certificates: - - src: "{{ vault_consul_v1_ca_file }}" + - src: "{{ file_consul_ca_pem }}" dest: "{{ consul_ca_file }}" - - src: "{{ vault_consul_v1_cert_file }}" + - src: "{{ file_consul_server_0_pem }}" dest: "{{ consul_cert_file }}" - - src: "{{ vault_consul_v1_key_file }}" + - src: "{{ file_consul_server_0_key_pem }}" dest: "{{ consul_key_file }}" consul_auto_advertise: true @@ -92,7 +84,8 @@ consul_encrypt: "" consul_ca_file: "{{ consul_ssl_dir }}/ca.pem" consul_cert_file: "{{ consul_ssl_dir }}/consul.pem" consul_key_file: "{{ consul_ssl_dir }}/consul-key.pem" -consul_ui: true +consul_ui_config: + enabled: true consul_recursors: - 1.1.1.1 - 8.8.8.8 @@ -107,4 +100,4 @@ consul_port_serf_wan: 8302 consul_port_server: 8300 # Conf - services.json -consul_services: false
\ No newline at end of file +consul_services: false diff --git a/fdio.infra.ansible/roles/consul/handlers/main.yaml b/fdio.infra.ansible/roles/consul/handlers/main.yaml index 338baea74e..d0e0c598a9 100644 --- a/fdio.infra.ansible/roles/consul/handlers/main.yaml +++ b/fdio.infra.ansible/roles/consul/handlers/main.yaml @@ -14,10 +14,3 @@ enabled: true name: "consul" state: "{{ consul_restart_handler_state }}" - -- name: Stop Systemd-resolved - systemd: - daemon_reload: true - enabled: false - name: "systemd-resolved" - state: "{{ systemd_resolved_state }}"
\ No newline at end of file diff --git a/fdio.infra.ansible/roles/consul/meta/main.yaml b/fdio.infra.ansible/roles/consul/meta/main.yaml index 4ada8efad6..5fb7e185c0 100644 --- a/fdio.infra.ansible/roles/consul/meta/main.yaml +++ b/fdio.infra.ansible/roles/consul/meta/main.yaml @@ -7,3 +7,16 @@ # info: 1.0 - added role dependencies: [ ] +galaxy_info: + role_name: consul + author: fd.io + description: Hashicrop Consul. + company: none + license: "license (Apache)" + min_ansible_version: 2.9 + platforms: + - name: Ubuntu + versions: + - focal + galaxy_tags: + - consul diff --git a/fdio.infra.ansible/roles/consul/tasks/main.yaml b/fdio.infra.ansible/roles/consul/tasks/main.yaml index 99ac52da44..834d7f1798 100644 --- a/fdio.infra.ansible/roles/consul/tasks/main.yaml +++ b/fdio.infra.ansible/roles/consul/tasks/main.yaml @@ -3,7 +3,7 @@ - name: Inst - Update Package Cache (APT) apt: - update_cache: yes + update_cache: true cache_valid_time: 3600 when: - ansible_distribution|lower == 'ubuntu' @@ -21,8 +21,6 @@ group: name: "{{ consul_group }}" state: "{{ consul_group_state }}" - when: - - consul_manage_group | bool tags: - consul-conf-user @@ -30,11 +28,8 @@ user: name: "{{ consul_user }}" group: "{{ consul_group }}" - groups: "{{ consul_user_groups }}" state: "{{ consul_user_state }}" system: true - when: - - consul_manage_user | bool tags: - consul-conf-user @@ -167,6 +162,15 @@ tags: - consul-conf +- name: Conf - Stop Systemd-resolved + systemd: + daemon_reload: true + enabled: false + name: "systemd-resolved" + state: "{{ systemd_resolved_state }}" + tags: + - consul-conf + - name: Conf - System.d Script template: src: "consul_systemd.service.j2" @@ -174,9 +178,10 @@ owner: "root" group: "root" mode: 0644 -# notify: -# - "Restart Consul" -# - "Stop Systemd-resolved" -# - "Restart Nomad" + notify: + - "Restart Consul" + - "Restart Nomad" tags: - consul-conf + +- meta: flush_handlers diff --git a/fdio.infra.ansible/roles/consul/templates/base.hcl.j2 b/fdio.infra.ansible/roles/consul/templates/base.hcl.j2 index 536c48d847..dab43fb3fc 100644 --- a/fdio.infra.ansible/roles/consul/templates/base.hcl.j2 +++ b/fdio.infra.ansible/roles/consul/templates/base.hcl.j2 @@ -14,14 +14,14 @@ server = {{ consul_node_server | bool | lower }} encrypt = "{{ consul_encrypt }}" {% if consul_node_server | bool == True %} bootstrap_expect = {{ consul_bootstrap_expect }} -verify_incoming = true -verify_outgoing = true -verify_server_hostname = true +verify_incoming = false +verify_outgoing = false +verify_server_hostname = false ca_file = "{{ consul_ca_file }}" cert_file = "{{ consul_cert_file }}" key_file = "{{ consul_key_file }}" auto_encrypt { - allow_tls = true + allow_tls = false } {% else %} verify_incoming = false @@ -36,7 +36,20 @@ auto_encrypt { retry_join = [ {% for ip_port in consul_retry_servers -%} "{{ ip_port }}"{% if not loop.last %}, {% endif %}{%- endfor -%} ] {%- endif %} -ui = {{ consul_ui | bool | lower }} +{% if consul_ui_config -%} +ui_config { +{% for key, value in consul_ui_config.items() %} + {%- if value|bool %} + {{ key }} = {{ value | bool | lower }} + {%- elif value|string or value == "" %} + {{ key }} = "{{ value }}" + {%- else %} + {{ key }} = {{ value }} + {%- endif %} +{% endfor %} + +} +{%- endif %} {% if consul_recursors -%} recursors = [ {% for server in consul_recursors -%} "{{ server }}"{% if not loop.last %}, {% endif %}{%- endfor -%} ] diff --git a/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2 b/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2 index 8e1ef1310d..16874f213e 100644 --- a/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2 +++ b/fdio.infra.ansible/roles/consul/templates/consul_systemd.service.j2 @@ -1,21 +1,18 @@ [Unit] -Description=Consul Service -Documentation=https://www.nomadproject.io/docs/ -Wants=network-online.target +Description="HashiCorp Consul - A service mesh solution" +Documentation=https://www.consul.io/ +Requires=network-online.target After=network-online.target [Service] -# TODO: Decrease privilege -ExecReload=/bin/kill -SIGHUP $MAINPID -ExecStart={{ consul_bin_dir }}/consul agent -config-dir {{ consul_config_dir }} -KillSignal=SIGTERM -LimitNOFILE=infinity -LimitNPROC=infinity -Restart=on-failure -RestartSec=1 User=root Group=root -Environment="GOMAXPROCS=2" +ExecStart={{ consul_bin_dir }}/consul agent -config-dir={{ consul_config_dir }} +ExecReload=/bin/kill --signal HUP $MAINPID +KillMode=process +KillSignal=SIGTERM +Restart=on-failure +LimitNOFILE=infinity [Install] -WantedBy=multi-user.target +WantedBy=multi-user.target
\ No newline at end of file |