Skip to content
This repository has been archived by the owner on Aug 25, 2023. It is now read-only.

basisai/terraform-kubernetes-consul

BranchesTags

Repository files navigation

Terraform Consul on Kubernetes

Deploys a Consul cluster on Kubernetes cluster running on any cloud provider. This module makes use of the official Hashicorp Helm Chart.

For more information regarding Consul's integration with Kubernetes, see the documentation.

This module is published on Terraform Registry.

Requirements

You will need to have the following resources available:

  • A Kubernetes cluster, managed by your cloud provider, or not
  • Helm with Tiller running on the Cluster or you can opt to run Tiller locally

You will need to have the following configured on your machine:

  • Credentials for your Cloud Provider
  • Credentials for Kubernetes configured for kubectl

Usage

Consul Server Persistent Volumes

The Consul servers are deployed with persistent volumes in a StatefulSet.

If you are running your own cluster in your cloud provider, you will have to define your own set of storage classes.

If you are using your cloud provider's managed Kubernetes service such as GKE or EKS, they would have defined their own set of default storage class.

You can use the kubernetes_storage_class Terraform resource to create a new StorageClass.

Consul Server Resources

You might want to refer to HashiCorp's guide and summary on considering the resources needed for your Consul servers.

Configuring Consul DNS for kube-dns

You can configure Consul to act as the DNS resolver for .consul domains. By default, this module does not attempt to do so manually because there is no good way to append to any existing kube-dns or CoreDNS configuration. If you would like to do so, you can set the configure_kube_dns to true to overwrite any existing kube-dns configuration.

Error Configuring kube-dns

If you get the error:

1 error(s) occurred:

* module.consul.kubernetes_config_map.consul_dns: 1 error(s) occurred:

* kubernetes_config_map.consul_dns: configmaps "kube-dns" already exists

You have an existing kube-dns configuration. Use kubectl describe configMap -n kube-system kube-dns to see the existing configuration. You can append to it using the documentation here.

Alternatively, if the configuration is empty, you can delete it with kubectl delete configMap -n kube-system kube-dns, set variable configure_kube_dns to true and let this module manage the configuration.

Configuring Consul DNS for CoreDNS

You can configure Consul to act as the DNS resolver for .consul domains. By default, this module does not attempt to do so manually because there is no good way to append to any existing kube-dns or CoreDNS configuration. If you would like to do so, you can set the configure_kube_dns to true to overwrite any existing CoreDNS configuration.

However, you should probably get any existing CoreDNS settings and set it to the core_dns_base variable.

You can do so by running kubectl get configmap/coredns -n kube-system -o yaml.

Requirements

Name Version
terraform >= 0.15
helm >= 2.0

Providers

Name Version
helm >= 2.0
kubernetes n/a
null n/a
template n/a

Modules

Name Source Version
esm ./modules/esm
prometheus_exporter ./modules/prometheus_exporter

Resources

Name Type
helm_release.consul resource
kubernetes_config_map.consul_core_dns resource
kubernetes_config_map.consul_kube_dns resource
kubernetes_secret.secrets resource
null_resource.consul_values resource
kubernetes_service.consul_dns data source
template_file.consul_core_dns data source

Inputs

Name Description Type Default Required
acl_bootstrap_token Use an existing bootstrap token and the consul-k8s will not bootstrap anything 
object({
    secret_name = string
    secret_key  = string
  })
 
{
  "secret_key": null,
  "secret_name": null
}
 no
additional_chart_values Additional values for the Consul Helm Chart in YAML list(string) [] no
agent_metrics_retention_time Configures the retention time for metrics in Consul clients and servers. This must be greater than 0 for Consul clients and servers to expose any metrics at all. string "1m" no
chart_name Helm chart name to provision string "consul" no
chart_namespace Namespace to install the chart into string "default" no
chart_repository Helm repository for the chart string "https://helm.releases.hashicorp.com" no
chart_timeout Timeout to wait for the Chart to be deployed. The chart waits for all Daemonset pods to be healthy before ending. Increase this for larger clusers to avoid timeout number 1800 no
chart_version Version of Chart to install. Set to empty to install the latest version string "0.36.0" no
client_affinity affinity Settings for Client pods, formatted as a multi-line YAML string. any null no
client_annotations A YAML string for client pods string "" no
client_enabled Enable running Consul client agents on every Kubernetes node string "-" no
client_extra_config Additional configuration to include for client agents map {} no
client_extra_volumes List of map of extra volumes specification. See https://www.consul.io/docs/platform/k8s/helm.html#v-client-extravolumes for the keys list [] no
client_grpc Enable GRPC port for clients. Required for Connect Inject bool true no
client_labels Additional labels for client pods map {} no
client_priority_class Priority class for clients string "" no
client_resources Resources for clients map 
{
  "limits": {
    "cpu": "100m",
    "memory": "100Mi"
  },
  "requests": {
    "cpu": "100m",
    "memory": "100Mi"
  }
}
 no
client_security_context Pod security context for client pods map 
{
  "fsGroup": 1000,
  "runAsGroup": 1000,
  "runAsNonRoot": true,
  "runAsUser": 100
}
 no
client_service_account_annotations YAML string for annotations for client service account string "" no
client_tolerations A YAML string that can be templated via helm specifying the tolerations for client pods string "" no
configure_core_dns Configure core-dns and OVERWRITE it to resolve .consul domains with Consul DNS bool false no
configure_kube_dns Configure kube-dns and OVERWRITE it to resolve .consul domains with Consul DNS bool false no
connect_enable Enable consul connect. When enabled, the bootstrap will configure a default CA which can be tweaked using the Consul API later bool false no
connect_inject_acl_binding_rule_selector Query that defines which Service Accounts
can authenticate to Consul and receive an ACL token during Connect injection.
The default setting, i.e. serviceaccount.name!=default, prevents the
'default' Service Account from logging in.
If set to an empty string all service accounts can log in.
This only has effect if ACLs are enabled.

See https://www.consul.io/docs/acl/acl-auth-methods.html#binding-rules
and https://www.consul.io/docs/acl/auth-methods/kubernetes.html#trusted-identity-attributes
for more details.		 string "serviceaccount.name!=default" no
connect_inject_acl_token Secret containing ACL token if ACL is enabled and manage_system_acls is not enabled 
object({
    secret_name = string
    secret_key  = string
  })
 
{
  "secret_key": null,
  "secret_name": null
}
 no
connect_inject_affinity Template string for Connect Inject Affinity string "" no
connect_inject_allowed_namespaces List of allowed namespaces to inject. list 
[
  "*"
]
 no
connect_inject_by_default If true, the injector will inject the Connect sidecar into all pods by default. Otherwise, pods must specify the injection annotation to opt-in to Connect injection. If this is true, pods can use the same annotation to explicitly opt-out of injection. bool false no
connect_inject_default_enable_merging Configures the Consul sidecar to run a merged metrics server to combine and serve both Envoy and Connect service metrics. This feature is available only in Consul v1.10-alpha or greater. bool false no
connect_inject_default_merged_metrics_port Configures the port at which the Consul sidecar will listen on to return combined metrics. This port only needs to be changed if it conflicts with the application's ports. number 20100 no
connect_inject_default_prometheus_scrape_path Configures the path Prometheus will scrape metrics from, by configuring the pod
annotation prometheus.io/path and the corresponding handler in the Envoy
sidecar.
NOTE: This is not the path that your application exposes metrics on.
That can be configured with the
consul.hashicorp.com/service-metrics-path annotation.		 string "/metrics" no
connect_inject_default_prometheus_scrape_port Configures the port Prometheus will scrape metrics from, by configuring
the Pod annotation prometheus.io/port and the corresponding listener in
the Envoy sidecar.
NOTE: This is not the port that your application exposes metrics on.
That can be configured with the
consul.hashicorp.com/service-metrics-port annotation.		 number 20200 no
connect_inject_denied_namespaces List of denied namespaces to inject. list [] no
connect_inject_failure_policy Sets the failurePolicy for the mutating webhook. By default this will cause pods not part of the consul installation to fail scheduling while the webhook
is offline. This prevents a pod from skipping mutation if the webhook were to be momentarily offline.
Once the webhook is back online the pod will be scheduled.
In some environments such as Kind this may have an undesirable effect as it may prevent volume provisioner pods from running
which can lead to hangs. In these environments it is recommend to use "Ignore" instead.
This setting can be safely disabled by setting to "Ignore".		 string "Fail" no
connect_inject_init_resources Resource settings for the Connect injected init container. map 
{
  "limits": {
    "cpu": "50m",
    "memory": "50Mi"
  },
  "requests": {
    "cpu": "50m",
    "memory": "50Mi"
  }
}
 no
connect_inject_log_level Log verbosity level. One of debug, info, warn, or error. string "" no
connect_inject_metrics_default_enabled If true, the connect-injector will automatically
add prometheus annotations to connect-injected pods. It will also
add a listener on the Envoy sidecar to expose metrics. The exposed
metrics will depend on whether metrics merging is enabled:
- If metrics merging is enabled:
the Consul sidecar will run a merged metrics server
combining Envoy sidecar and Connect service metrics,
i.e. if your service exposes its own Prometheus metrics.
- If metrics merging is disabled:
the listener will just expose Envoy sidecar metrics.
Defaults to var.metrics_enabled		 string "-" no
connect_inject_namespace_selector A YAML string selector for restricting injection to only matching namespaces. By default all namespaces except the system namespace will have injection enabled. string "matchExpressions:\n - key: \"kubernetes.io/metadata.name\"\n operator: \"NotIn\"\n values: [\"kube-system\",\"local-path-storage\"]\n" no
connect_inject_override_auth_method_name If you are not using global.acls.manageSystemACLs and instead manually setting up an auth method for Connect inject, set this to the name of your auth method. string "" no
connect_inject_priority_class Pod Priority Class for Connect Inject string "" no
connect_inject_replicas Number of replicas for Connect Inject deployment number 2 no
connect_inject_resources Resources for connect inject pod map 
{
  "limits": {
    "cpu": "50m",
    "memory": "50Mi"
  },
  "requests": {
    "cpu": "50m",
    "memory": "50Mi"
  }
}
 no
connect_inject_service_account_annotations YAML string with annotations for the Connect Inject service account string "" no
connect_inject_sidecar_proxy_resources Set default resources for sidecar proxy. If null, that resource won't be set. map 
{
  "limits": {
    "cpu": "100m",
    "memory": "100Mi"
  },
  "requests": {
    "cpu": "100m",
    "memory": "100Mi"
  }
}
 no
connect_inject_tolerations Template string for Connect Inject Tolerations string "" no
consul_domain Top level Consul domain for DNS queries string "consul" no
consul_image_name Docker Image of Consul to run string "consul" no
consul_image_tag Docker image tag of Consul to run string "1.10.4" no
consul_k8s_image Docker image of the consul-k8s binary to run string "hashicorp/consul-k8s-control-plane" no
consul_k8s_tag Image tag of the consul-k8s binary to run string "0.36.0" no
consul_raw_values Create a null_resource with the raw values passed in to render the YAML values file. Useful for observing diffs. bool true no
consul_recursors A list of addresses of upstream DNS servers that are used to recursively resolve DNS queries. list(string) [] no
consul_sidecar_container_resources Resource settings for consul -sidecar containers.
The consul sidecar ensures the Consul services are always registered with
their local consul clients and is used by the ingress/terminating/mesh gateways
as well as with every connect-injected service.		 map 
{
  "limits": {
    "cpu": "20m",
    "memory": "50Mi"
  },
  "requests": {
    "cpu": "20m",
    "memory": "50Mi"
  }
}
 no
consul_template_image Image for Consul Template string "hashicorp/consul-template:0.26.0" no
controller_acl_token Secret containing ACL token if ACL is enabled and manage_system_acls is not enabled 
object({
    secret_name = string
    secret_key  = string
  })
 
{
  "secret_key": null,
  "secret_name": null
}
 no
controller_enable Enable Consul Configuration Entries CRD Controller bool false no
controller_log_level CRD Controller Log level. string "" no
controller_node_affinity YAML string for Controller affinity any null no
controller_node_selector YAML string for Controller Node Selector any null no
controller_node_tolerations YAML string for Controller tolerations any null no
controller_priority_class Priority class for Controller pods string "" no
controller_replicas Number of replicas for the CRD controller number 1 no
controller_resources CRD Controller resources map 
{
  "limits": {
    "cpu": "100m",
    "memory": "50Mi"
  },
  "requests": {
    "cpu": "100m",
    "memory": "50Mi"
  }
}
 no
controller_service_account_annotations YAML string with annotations for CRD Controller service account string "" no
core_dns_labels Labels for CoreDNS ConfigMap map 
{
  "addonmanager.kubernetes.io/mode": "EnsureExists",
  "eks.amazonaws.com/component": "coredns",
  "k8s-app": "kube-dns"
}
 no
core_dns_template Template for CoreDNS CoreFile configuration. Use Terraform string interpolation format with the variable consul_dns_address for Consul DNS endpoint. See Default for an example string ".:53 {\n errors\n health\n kubernetes cluster.local in-addr.arpa ip6.arpa {\n pods insecure\n fallthrough in-addr.arpa ip6.arpa\n }\n prometheus :9153\n forward . /etc/resolv.conf\n cache 30\n loop\n reload\n loadbalance\n}\n\nconsul {\n errors\n cache 30\n forward . ${consul_dns_address}\n}\n" no
create_replication_token If true, an ACL token will be created that can be used in secondary datacenters for replication. This should only be set to true in the primary datacenter since the replication token must be created from that datacenter. In secondary datacenters, the secret needs to be imported from the primary datacenter bool false no
enable_agent_metrics Configures consul agent metrics. bool false no
enable_connect_inject Enable Connect Injector process bool false no
enable_esm Enable Consul ESM deployment bool false no
enable_exporter Enable Consul Exporter deployment bool false no
enable_gateway_metrics If true, mesh, terminating, and ingress gateways will expose their Envoy metrics on port 20200 at the /metrics path and all gateway pods will have Prometheus scrape annotations. bool true no
enable_sync_catalog Enable Service catalog sync: https://www.consul.io/docs/platform/k8s/service-sync.html bool true no
enable_ui Enable Consul UI bool false no
envoy_extra_args Pass arguments to the injected envoy sidecar. Valid arguments to pass to envoy can be found here: https://www.envoyproxy.io/docs/envoy/latest/operations/cli any null no
esm_affinity Affinity for ESM any {} no
esm_chart_name Name of the ESM Chart name string "consul-esm" no
esm_chart_repository ESM Chart repository string "https://basisai.github.io/charts/" no
esm_chart_version ESM Chart version string "0.3.1" no
esm_container_security_context securityContext for ESM containers any {} no
esm_env Environment variables for Consul ESM any [] no
esm_external_node_meta The node metadata values used for the ESM to qualify a node in the catalog as an "external node". map(string) 
{
  "external-node": "true"
}
 no
esm_http_addr HTTP address of the local Consul agent string "" no
esm_image Docker image for ESM string "hashicorp/consul-esm" no
esm_init_container_set_sysctl Enable setting sysctl settings via a privileged container to allow pings bool false no
esm_kv_path The directory in the Consul KV store to use for storing ESM runtime data. string "consul-esm/" no
esm_log_level Log level for ESM string "INFO" no
esm_node_agent_port Override port for Consul agent Daemonset number null no
esm_node_probe_interval The interval to ping and update coordinates for external nodes that have 'external-probe' set to true. By default, ESM will attempt to ping and update the coordinates for all nodes it is watching every 10 seconds. string "10s" no
esm_node_reconnect_timeout The length of time to wait before reaping an external node due to failed pings. string "72h" no
esm_ping_type The method to use for pinging external nodes. string "udp" no
esm_pod_annotations Annotations for Consul ESM Pods map(string) {} no
esm_pod_security_context securityContext for ESM pods any {} no
esm_release_name Name of the ESM Chart Release string "consul-esm" no
esm_replica Number of ESM replica number 3 no
esm_resources Resources for ESM any 
{
  "limits": {
    "memory": "256Mi"
  },
  "requests": {
    "cpu": "200m"
  }
}
 no
esm_server_address Override Consul Server address for TLS when using Auto Encrypt string null no
esm_server_port Override Consul Server port for TLS when using Auto Encrypt number null no
esm_service_name ESM service name in Consul string "consul-esm" no
esm_service_tag Service tag for ESM string "" no
esm_tag Docker Image tag for ESM string "0.6.0" no
esm_tolerations Toleration for ESM any [] no
esm_use_node_agent Use Consul agent Daemonset bool true no
exporter_affinity Affinity for Consul Exporter map {} no
exporter_chart_name Name of the Consul Exporter Chart name string "prometheus-consul-exporter" no
exporter_chart_repository Consul Exporter Chart repository string "https://prometheus-community.github.io/helm-charts" no
exporter_chart_version Consul Exporter Chart version string "0.4.0" no
exporter_env Additional Environment Variables for Exporter list [] no
exporter_extra_containers Extra extra Containers list [] no
exporter_extra_volume_mounts Extra volume mounts for Exporter list [] no
exporter_extra_volumes Extra volumes for Exporter list [] no
exporter_image Docker image for Consul Exporter string "prom/consul-exporter" no
exporter_init_containers Extra Init Containers list [] no
exporter_options Arguments for Exporter. See https://github.com/prometheus/consul_exporter#flags map {} no
exporter_pod_annotations Annotations for Exporter Pods map(string) {} no
exporter_psp Create PSP resources for Exporter bool true no
exporter_rbac_enabled Create RBAC resources for Exporter bool true no
exporter_release_name Name of the Consul Exporter Chart Release string "consul-exporter" no
exporter_replica Number of Consul Exporter replicas number 1 no
exporter_resources Resources for Consul Exporter map 
{
  "limits": {
    "memory": "256Mi"
  },
  "requests": {
    "cpu": "200m"
  }
}
 no
exporter_service_annotations Consul Exporter service's annotations map {} no
exporter_service_monitor Create a ServiceMonitor to configure scraping bool false no
exporter_tag Docker Image tag for Consul Exporter string "v0.7.1" no
exporter_tolerations Tolerations for Consul Exporter list [] no
fullname_override Fullname Override of Helm resources string "" no
gossip_encryption_key 32 Bytes Base64 Encoded Consul Gossip Encryption Key. Set to null to disable any null no
image_envoy Image and tag for Envoy Docker image to use for sidecar proxies, mesh, terminating and ingress gateways string "envoyproxy/envoy-alpine:v1.18.4" no
log_json_enable Enable all component logs to be output in JSON format bool false no
manage_system_acls Manager ACL Tokens for Consul and consul-k8s components bool false no
max_history Max History for Helm number 20 no
metrics_enabled Configures the Helm chart’s components to expose Prometheus metrics for the Consul service mesh. bool false no
name Sets the prefix used for all resources in the helm chart. If not set, the prefix will be "-consul". any null no
pod_security_policy_enable Create PodSecurityPolicy Resources bool true no
release_name Helm release name for Consul string "consul" no
replication_token A secret containing the replication ACL token. 
object({
    secret_name = string
    secret_key  = string
  })
 
{
  "secret_key": null,
  "secret_name": null
}
 no
secret_annotation Annotations for the Consul Secret map {} no
secret_name Name of the secret for Consul string "consul" no
server_affinity A YAML string that can be templated via helm specifying the affinity for server pods string "podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n app: {{ template \"consul.name\" . }}\n release: \"{{ .Release.Name }}\"\n component: server\n topologyKey: kubernetes.io/hostname\n" no
server_annotations A YAML string for server pods string "" no
server_datacenter Datacenter to configure Consul as. any n/a yes
server_extra_config Additional configuration to include for servers in JSON/HCL map {} no
server_extra_volumes List of map of extra volumes specification for server pods. See https://www.consul.io/docs/platform/k8s/helm.html#v-server-extravolumes for the keys list [] no
server_priority_class Priority class for servers string "" no
server_replicas Number of server replicas to run number 5 no
server_resources Resources for server map 
{
  "limits": {
    "cpu": "100m",
    "memory": "100Mi"
  },
  "requests": {
    "cpu": "100m",
    "memory": "100Mi"
  }
}
 no
server_security_context Security context for server pods map 
{
  "fsGroup": 1000,
  "runAsGroup": 1000,
  "runAsNonRoot": true,
  "runAsUser": 100
}
 no
server_service_account_annotations YAML string for annotations for server service account string "" no
server_storage This defines the disk size for configuring the servers' StatefulSet storage. For dynamically provisioned storage classes, this is the desired size. For manually defined persistent volumes, this should be set to the disk size of the attached volume. string "10Gi" no
server_storage_class The StorageClass to use for the servers' StatefulSet storage. It must be able to be dynamically provisioned if you want the storage to be automatically created. For example, to use Local storage classes, the PersistentVolumeClaims would need to be manually created. An empty value will use the Kubernetes cluster's default StorageClass. string "" no
server_tolerations A YAML string that can be templated via helm specifying the tolerations for server pods string "" no
server_topology_spread_constraints YAML string for topology spread constraints for server pods string "" no
server_update_partition This value is used to carefully control a rolling update of Consul server agents. This value specifies the partition (https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions) for performing a rolling update. Please read the linked Kubernetes documentation and https://www.consul.io/docs/k8s/upgrade#upgrading-consul-servers for more information. number 0 no
sync_acl_token Secret containing ACL token if ACL is enabled and manage_system_acls is not enabled 
object({
    secret_name = string
    secret_key  = string
  })
 
{
  "secret_key": null,
  "secret_name": null
}
 no
sync_add_k8s_namespace_suffix Appends Kubernetes namespace suffix to each service name synced to Consul, separated by a dash. bool true no
sync_affinity YAML template string for Sync Catalog affinity string "" no
sync_by_default If true, all valid services in K8S are synced by default. If false, the service must be annotated properly to sync. In either case an annotation can override the default. bool true no
sync_cluster_ip_services If true, will sync Kubernetes ClusterIP services to Consul. This can be disabled to have the sync ignore ClusterIP-type services. bool true no
sync_k8s_prefix A prefix to prepend to all services registered in Kubernetes from Consul. This defaults to '' where no prefix is prepended; Consul services are synced with the same name to Kubernetes. (Consul -> Kubernetes sync only) string "" no
sync_k8s_tag An optional tag that is applied to all of the Kubernetes services that are synced into Consul. If nothing is set, this defaults to 'k8s'. (Kubernetes -> Consul sync only) string "k8s" no
sync_node_port_type Configures the type of syncing that happens for NodePort services. The only valid options are: ExternalOnly, InternalOnly, and ExternalFirst. ExternalOnly will only use a node's ExternalIP address for the sync, otherwise the service will not be synced. InternalOnly uses the node's InternalIP address. ExternalFirst will preferentially use the node's ExternalIP address, but if it doesn't exist, it will use the node's InternalIP address instead. string "" no
sync_priority_class Priority Class Name for Consul Sync Catalog string "" no
sync_resources Sync Catalog resources map 
{
  "limits": {
    "cpu": "50m",
    "memory": "50Mi"
  },
  "requests": {
    "cpu": "50m",
    "memory": "50Mi"
  }
}
 no
sync_service_account_annotations YAML string for annotations for sync catalog service account string "" no
sync_to_consul If true, will sync Kubernetes services to Consul. This can be disabled to have a one-way sync. bool true no
sync_to_k8s If true, will sync Consul services to Kubernetes. This can be disabled to have a one-way sync. bool true no
sync_tolerations Template string for Sync Catalog Tolerations string "" no
terminating_gateway_defaults Terminating Gateway defaults.
You can override any of these fields under terminating_gateways.
Annotations are concatenated

Note: You do not have to specify all of the fields to override them. If you omit them, they will
fall back to the defaults for the Helm Chart.		 map 
{
  "affinity": "podAntiAffinity:\n  requiredDuringSchedulingIgnoredDuringExecution:\n    - labelSelector:\n        matchLabels:\n          app: {{ template "consul.name" . }}\n          release: "{{ .Release.Name }}"\n          component: terminating-gateway\n      topologyKey: kubernetes.io/hostname\n",
  "annotations": null,
  "consulNamespace": "default",
  "extraVolumes": [],
  "initCopyConsulContainer": {
    "resources": {
      "limits": {
        "cpu": "50m",
        "memory": "25Mi"
      },
      "requests": {
        "cpu": "50m",
        "memory": "25Mi"
      }
    }
  },
  "nodeSelector": null,
  "priorityClassName": "",
  "replicas": 2,
  "resources": {
    "limits": {
      "cpu": "100Mi",
      "memory": "100Mi"
    },
    "requests": {
      "cpu": "100Mi",
      "memory": "100Mi"
    }
  },
  "serviceAccount": {
    "annotations": null
  },
  "tolerations": null
}
 no
terminating_gateway_enable Deploy Terminating Gateways bool false no
terminating_gateways Gateways is a list of gateway objects. The only required field for
each is name, though they can also contain any of the fields in
terminating_gateway_defaults. Values defined here override the defaults except in the
case of annotations where both will be applied.		 list 
[
  {
    "name": "terminating-gateway"
  }
]
 no
tls_ca Self generated CA for Consul Server TLS. Values should be PEM encoded 
object({
    cert = string,
    key  = string,
  })
 null no
tls_enable_auto_encrypt Enable auto encrypt. Uses the connect CA to distribute certificates to clients bool false no
tls_enabled Enable TLS for the cluster bool false no
tls_https_only If true, Consul will disable the HTTP port on both clients and servers and only accept HTTPS connections. bool true no
tls_server_additional_dns_sans List of additional DNS names to set as Subject Alternative Names (SANs) in the server certificate. This is useful when you need to access the Consul server(s) externally, for example, if you're using the UI. list [] no
tls_server_additional_ip_sans List of additional IP addresses to set as Subject Alternative Names (SANs) in the server certificate. This is useful when you need to access Consul server(s) externally, for example, if you're using the UI. list [] no
tls_server_cert_secret A Kubernetes secret containing a certificate & key for the server agents to use for TLS communication within the Consul cluster. Additional SANs are required. string null no
tls_verify If true, 'verify_outgoing', 'verify_server_hostname', and
'verify_incoming_rpc' will be set to true for Consul servers and clients.
Set this to false to incrementally roll out TLS on an existing Consul cluster.
Note: remember to switch it back to true once the rollout is complete.
Please see this guide for more details:
https://learn.hashicorp.com/consul/security-networking/certificates		 bool true no
transparent_proxy_default_enabled Enable transparent proxy by default on all connect injected pods bool true no
transparent_proxy_default_overwrite_probes Overwrite HTTP probes by default when transparent proxy is in use bool true no
ui_additional_spec Additional Spec for the UI service string "" no
ui_annotations UI service annotations string "" no
ui_metrics_base_url URL of the prometheus server, usually the service URL. string "http://prometheus-server" no
ui_metrics_enabled Enable displaying metrics in UI. Defaults to value of var.metrics_enabled string "-" no
ui_metrics_provider Provider for metrics. See https://www.consul.io/docs/agent/options#ui_config_metrics_provider string "prometheus" no
ui_service_type Type of service for Consul UI string "ClusterIP" no

Outputs

Name Description
kube_dns_service_cluster_ip Cluster IP of the Consul DNS service
release Helm Release Object

About

Deploy Consul on Kubernetes using Terraform

registry.terraform.io/modules/basisai/consul/kubernetes/latest

Topics

hacktoberfest

Resources

Readme

License

Apache-2.0 license
Activity
Custom properties

Stars

3 stars

Watchers

4 watching

Forks

6 forks
Report repository

Releases 16

v0.11.0 Latest
Dec 30, 2021
+ 15 releases

Contributors 2

  •  
  •  

Languages