Consul

This role deploys a new Consul instance. It can deploy Consul as a server or client, depending on the host's group name.

Prerequisites

  • An existing Vault instance to save gossip key and provision TLS certs
  • An existing consul-template instance to rotate TLS certs
  • Consul installed
  • Ansible auth certificate on localhost to access Vault

Setup

For encryption, the role creates consul-template templates for:

  • Consul's gossip key. A new key is added with consul keygen if it does not already exist
  • Consul TLS certs from Vault PKI

Variables

VariableDescriptionTypeDefault
consul_config_dirConfiguration directorystring/etc/consul.d
consul_data_dirData directorystring/opt/consul
consul_tls_dirTLS files directorystring${consul_data_dir}/tls
consul_template_config_dirconsul-template configuration filestring/etc/consul-template
consul_upstream_dns_addressList of upstream DNS servers for dnsmasq["1.1.1.1"]
consul_serverStart Consul in server modebooltrue
consul_bootstrap_expect(server only) The expected number of servers in a clusternumber1
consul_clientStart Consul in client modeboolfalse
consul_server_ip(client only) Server's IP addressstring-
consul_vault_addrVault server API address to usestringhttps://localhost:8200
consul_common_nameConsul node certificate common_namestringSee below
consul_alt_namesConsul's TLS certificate alt namesstringconsul.service.consul
consul_ip_sansConsul's TLS certificate IP SANsstring127.0.0.1
setup_consul_watchesSet up Consul watches for healthchecksboolfalse
consul_gotify_urlGotify URL for sending webhookstring""
consul_gotify_tokenGotify token for sending webhookstring""

Notes

  • consul_server and consul_agent are mutually exclusive and cannot be both true.
  • consul_bootstrap_expect must be the same value in all Consul servers. If the key is not present in the server, that server instance will not attempt to bootstrap the cluster.
  • An existing Consul server must be running and reachable at consul_server_ip when consul_agent is true.
  • The default value of consul_common_name is server.dc1.consul or client.dc1.consul depending on whether Consul is started in server or client mode.