Multi-cluster applications with Consul Enterprise admin partitions

1 2 3 4 5 6 7 8 9 10111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758global:
  # If you are using the sample repository, do not change the global.name values in the consul-values files.
  name: server
  image: 'hashicorp/consul-enterprise:1.11.4-ent'
  enableConsulNamespaces: true
  # The name of the datacenter. Admin partitions are only supported in the same datacenter today.
  datacenter: galaxy
  enterpriseLicense:
    # The Kubernetes secret key/value pair for your Consul Enterprise license. If using the terraform project provided with this tutorial
    # this license is automatically uploaded for you as a secret if you place the license inside the `consul_enterprise` folder before deploying.
    secretName: 'consul-ent-license'
    secretKey: 'key'
  # The stanza that sets up Admins Partitions and the reason you are reading this tutorial :)
  adminPartitions:
    enabled: true
    service:
      annotations: |
        "service.beta.kubernetes.io/aws-load-balancer-scheme": "internal"
  acls:
    manageSystemACLs: true
  logLevel: 'debug'
  gossipEncryption:
    autoGenerate: true
  tls:
    enableAutoEncrypt: true
    enabled: true
    verify: false
    serverAdditionalDNSSANs:
      # Subject Alternative Names that the TLS certificate will validate. In this case,
      # these are wildcard values for Amazon EKS and Elastic Load Balancer services suppporting this tutorial.
      # Note that wildcard values are not recommended for use in production environments.
      - '*.us-east-1.elb.amazonaws.com'
      - '*.gr7.us-east-1.eks.amazonaws.com'
server:
  exposeGossipAndRpcPorts: true
  replicas: 1
ui:
  enabled: true
connectInject:
  aclBindingRuleSelector: ''
  consulNamepaces:
    mirroringK8S: true
  transparentProxy:
    defaultEnabled: false
  # inject an envoy sidecar into every new pod, except for those with annotations that prevent injection
  enabled: true
  # these settings enable L7 metrics collection and are new in 1.5
  centralConfig:
    enabled: true
    # proxyDefaults is a raw json string that will be applied to all Connect
    # proxy sidecar pods that can include any valid configuration for the
    # configured proxy.
    # proxyDefaults: |
    #   {
    #     "envoy_prometheus_bind_addr": "0.0.0.0:9102"
    #   }
controller:
  enabled: true

1 2 3 4 5 6 7 8 9 10111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758global:
  name: client
  enabled: false
  image: hashicorp/consul-enterprise:1.11.4-ent
  enableConsulNamespaces: true
  # Must match consul-values-server.yaml
  datacenter: galaxy
  enterpriseLicense:
    secretName: 'consul-ent-license'
    secretKey: 'key'
  adminPartitions:
    enabled: true
    # The name of the admin partition for the client partition. This can be any value. An admin partition typically represents a single Consul Enterprise cluster on one Kubernetes cluster.
    name: 'tereknor'
  acls:
    manageSystemACLs: true
    bootstrapToken:
      # Copy from server
      secretName: server-partitions-acl-token
      secretKey: token
  gossipEncryption:
    # copy from server
    secretName: server-gossip-encryption-key
    secretKey: key
  tls:
    verify: false
    enabled: true
    enableAutoEncrypt: true
    caKey:
      # copy from server
      secretName: server-ca-key
      secretKey: tls.key
    caCert:
      # copy from server
      secretName: server-ca-cert
      secretKey: tls.crt
externalServers:
  enabled: true
  hosts:
    # The hostname of the admin-partition `LoadBalancer` service Running on the server cluster
    - YourValueGoesHere
  useSystemRoots: false
  # The client cluster's hostname for the Kubernetes control plane. Obtained by running `kubectl --cluster-info` for that cluster.
  k8sAuthMethodHost: YourValueGoesHere
client:
  enabled: true
  join:
    # The hostname of the admin-partition `LoadBalancer` service Running on the server cluster
    - YourValueGoesHere
connectInject:
  aclBindingRuleSelector: ''
  enabled: true
  transparentProxy:
    defaultEnabled: false
  consulNamespaces:
    mirroringK8S: true
controller:
  enabled: true

---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  type: ClusterIP
  ports:
    - port: 5432
      targetPort: 5432
  selector:
    app: postgres

---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: postgres
spec:
  protocol: 'tcp'

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: postgres
automountServiceAccountToken: true

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      service: postgres
      app: postgres
  template:
    metadata:
      labels:
        service: postgres
        app: postgres
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
    spec:
      serviceAccountName: postgres
      containers:
        - name: postgres
          image: hashicorpdemoapp/product-api-db:v0.0.13
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: products
            - name: POSTGRES_USER
              value: postgres
            - name: POSTGRES_PASSWORD
              value: password
          # only listen on loopback so only access is via connect proxy
          args: ['-c', 'listen_addresses=127.0.0.1']
          volumeMounts:
            - mountPath: '/var/lib/postgresql/data'
              name: 'pgdata'
      volumes:
        - name: pgdata
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  type: ClusterIP
  ports:
    - port: 5432
      targetPort: 5432
  selector:
    app: postgres

---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: postgres
spec:
  protocol: 'tcp'
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: postgres
automountServiceAccountToken: true

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      service: postgres
      app: postgres
  template:
    metadata:
      labels:
        service: postgres
        app: postgres
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
    spec:
      serviceAccountName: postgres
      containers:
        - name: postgres
          image: hashicorpdemoapp/product-api-db:v0.0.13
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: products
            - name: POSTGRES_USER
              value: postgres
            - name: POSTGRES_PASSWORD
              value: password
          # only listen on loopback so only access is via connect proxy
          args: ['-c', 'listen_addresses=127.0.0.1']
          volumeMounts:
            - mountPath: '/var/lib/postgresql/data'
              name: 'pgdata'
      volumes:
        - name: pgdata
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: products-api
  labels:
    app: products-api
spec:
  selector:
    app: products-api
  ports:
    - name: http
      protocol: TCP
      port: 9090
      targetPort: 9090

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: products-api
automountServiceAccountToken: true

---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: products-api
spec:
  protocol: 'tcp'

apiVersion: v1
kind: ConfigMap
metadata:
  name: db-configmap
data:
  config: |
    {
      "db_connection": "host=127.0.0.1 port=5432 user=postgres password=password dbname=products sslmode=disable",
      "bind_address": ":9090",
      "metrics_address": ":9103"
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: products-api
  labels:
    app: products-api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: products-api
  template:
    metadata:
      labels:
        app: products-api
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
        # This value is the name of the service, the name of the namespace, and the name of the partition in that order.
        consul.hashicorp.com/connect-service-upstreams: 'postgres.default.default:5432'
    spec:
      serviceAccountName: products-api
      volumes:
        - name: config
          configMap:
            name: db-configmap
            items:
              - key: config
                path: conf.json
      containers:
        - name: products-api
          image: hashicorpdemoapp/product-api:v0.0.19
          imagePullPolicy: Always
          ports:
            - containerPort: 9090
            - containerPort: 9103
          env:
            - name: 'CONFIG_FILE'
              value: '/config/conf.json'
          livenessProbe:
            httpGet:
              path: /health
              port: 9090
            initialDelaySeconds: 15
            timeoutSeconds: 1
            periodSeconds: 10
            failureThreshold: 30
          volumeMounts:
            - name: config
              mountPath: /config
              readOnly: true

---
apiVersion: v1
kind: Service
metadata:
  name: products-api
  # new
  labels:
    app: products-api
spec:
  selector:
    app: products-api
  ports:
    - name: http
      protocol: TCP
      port: 9090
      targetPort: 9090
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: products-api
automountServiceAccountToken: true
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: products-api
spec:
  protocol: 'tcp'
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: db-configmap
data:
  config: |
    {
      "db_connection": "host=127.0.0.1 port=5432 user=postgres password=password dbname=products sslmode=disable",
      "bind_address": ":9090",
      "metrics_address": ":9103"
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: products-api
  labels:
    app: products-api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: products-api
  template:
    metadata:
      labels:
        app: products-api
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
        # This value is the name of the service, the name of the namespace, and the name of the partition in that order.
        consul.hashicorp.com/connect-service-upstreams: 'postgres.default.default:5432'
    spec:
      serviceAccountName: products-api
      volumes:
        - name: config
          configMap:
            name: db-configmap
            items:
              - key: config
                path: conf.json
      containers:
        - name: products-api
          image: hashicorpdemoapp/product-api:v0.0.19
          imagePullPolicy: Always
          ports:
            - containerPort: 9090
            - containerPort: 9103
          env:
            - name: 'CONFIG_FILE'
              value: '/config/conf.json'
          livenessProbe:
            httpGet:
              path: /health
              port: 9090
            initialDelaySeconds: 15
            timeoutSeconds: 1
            periodSeconds: 10
            failureThreshold: 30
          volumeMounts:
            - name: config
              mountPath: /config
              readOnly: true

---
apiVersion: v1
kind: Service
metadata:
  name: public-api
  labels:
    app: public-api
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: 8080
  selector:
    app: public-api

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: public-api
automountServiceAccountToken: true

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: public-api
spec:
  replicas: 1
  selector:
    matchLabels:
      service: public-api
      app: public-api
  template:
    metadata:
      labels:
        service: public-api
        app: public-api
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
        consul.hashicorp.com/connect-service-upstreams: 'products-api:9090, payments:1800'
    spec:
      serviceAccountName: public-api
      containers:
        - name: public-api
          image: hashicorpdemoapp/public-api:v0.0.5
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          env:
            - name: BIND_ADDRESS
              value: ':8080'
            - name: PRODUCT_API_URI
              value: 'http://localhost:9090'
            - name: PAYMENT_API_URI
              value: 'http://localhost:1800'
        - name: jaeger-agent
          image: jaegertracing/jaeger-agent:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 5775
              name: zk-compact-trft
              protocol: UDP
            - containerPort: 5778
              name: config-rest
              protocol: TCP
            - containerPort: 6831
              name: jg-compact-trft
              protocol: UDP
            - containerPort: 6832
              name: jg-binary-trft
              protocol: UDP
            - containerPort: 14271
              name: admin-http
              protocol: TCP
          args:
            - --reporter.grpc.host-port=dns:///jaeger-collector-headless.default:14250
            - --reporter.type=grpc

---
apiVersion: v1
kind: Service
metadata:
  name: public-api
  labels:
    app: public-api
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: 8080
  selector:
    app: public-api
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: public-api
automountServiceAccountToken: true
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: public-api
spec:
  replicas: 1
  selector:
    matchLabels:
      service: public-api
      app: public-api
  template:
    metadata:
      labels:
        service: public-api
        app: public-api
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
        consul.hashicorp.com/connect-service-upstreams: 'products-api:9090, payments:1800'
    spec:
      serviceAccountName: public-api
      containers:
        - name: public-api
          image: hashicorpdemoapp/public-api:v0.0.5
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          env:
            - name: BIND_ADDRESS
              value: ':8080'
            - name: PRODUCT_API_URI
              value: 'http://localhost:9090'
            - name: PAYMENT_API_URI
              value: 'http://localhost:1800'
        - name: jaeger-agent
          image: jaegertracing/jaeger-agent:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 5775
              name: zk-compact-trft
              protocol: UDP
            - containerPort: 5778
              name: config-rest
              protocol: TCP
            - containerPort: 6831
              name: jg-compact-trft
              protocol: UDP
            - containerPort: 6832
              name: jg-binary-trft
              protocol: UDP
            - containerPort: 14271
              name: admin-http
              protocol: TCP
          args:
            - --reporter.grpc.host-port=dns:///jaeger-collector-headless.default:14250
            - --reporter.type=grpc

---
apiVersion: v1
kind: Service
metadata:
  name: payments
  labels:
    app: payments
spec:
  selector:
    app: payments
  ports:
    - name: http
      protocol: TCP
      port: 1800
      targetPort: 8080

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: payments
automountServiceAccountToken: true

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: payments
automountServiceAccountToken: true

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payments
  labels:
    app: payments
spec:
  replicas: 1
  selector:
    matchLabels:
      app: payments
  template:
    metadata:
      labels:
        app: payments
      annotations:
        consul.hashicorp.com/connect-inject: 'true'
    spec:
      serviceAccountName: payments
      containers:
        - name: payments
          image: hashicorpdemoapp/payments:v0.0.12
          imagePullPolicy: Always
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: payments
  labels:
    app: payments
spec:
  selector:
    app: payments
  ports:
    - name: http
      protocol: TCP
      port: 1800
      targetPort: 8080
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: payments
automountServiceAccountToken: true
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: payments
spec:
  protocol: 'http'
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payments
  labels:
    app: payments
spec:
  replicas: 1
  selector:
    matchLabels:
      app: payments
  template:
    metadata:
      labels:
        app: payments
      annotations:
        consul.hashicorp.com/connect-inject: 'true'
    spec:
      serviceAccountName: payments
      containers:
        - name: payments
          image: hashicorpdemoapp/payments:v0.0.12
          imagePullPolicy: Always
          ports:
            - containerPort: 8080

apiVersion: v1
kind: Service
metadata:
  name: frontend
  labels:
    app: frontend
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 80
  selector:
    app: frontend

apiVersion: v1
kind: ServiceAccount
metadata:
  name: frontend
automountServiceAccountToken: true

---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: frontend
spec:
  protocol: http

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configmap
data:
  config: |
    # /etc/nginx/conf.d/default.conf
    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;
        #access_log  /var/log/nginx/host.access.log  main;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }

        # Proxy pass the api location to save CORS
        # Use location exposed by Consul connect
        location /api {
            proxy_pass http://localhost:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  replicas: 1
  selector:
    matchLabels:
      service: frontend
      app: frontend
  template:
    metadata:
      labels:
        service: frontend
        app: frontend
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
        consul.hashicorp.com/connect-service-upstreams: 'public-api:8080'
    spec:
      serviceAccountName: frontend
      volumes:
        - name: config
          configMap:
            name: nginx-configmap
            items:
              - key: config
                path: default.conf
      containers:
        - name: frontend
          image: hashicorpdemoapp/frontend:v0.0.7
          imagePullPolicy: Always
          ports:
            - containerPort: 80
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/conf.d
              readOnly: true

apiVersion: v1
kind: Service
metadata:
  name: frontend
  labels:
    app: frontend
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 80
  selector:
    app: frontend
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: frontend
automountServiceAccountToken: true
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
  name: frontend
spec:
  protocol: http
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configmap
data:
  config: |
    # /etc/nginx/conf.d/default.conf
    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;
        #access_log  /var/log/nginx/host.access.log  main;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }

        # Proxy pass the api location to save CORS
        # Use location exposed by Consul connect
        location /api {
            proxy_pass http://localhost:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  replicas: 1
  selector:
    matchLabels:
      service: frontend
      app: frontend
  template:
    metadata:
      labels:
        service: frontend
        app: frontend
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9102'
        consul.hashicorp.com/connect-inject: 'true'
        consul.hashicorp.com/connect-service-upstreams: 'public-api:8080'
    spec:
      serviceAccountName: frontend
      volumes:
        - name: config
          configMap:
            name: nginx-configmap
            items:
              - key: config
                path: default.conf
      containers:
        - name: frontend
          image: hashicorpdemoapp/frontend:v0.0.7
          imagePullPolicy: Always
          ports:
            - containerPort: 80
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/conf.d
              readOnly: true