bug: exec'ing into consul server container no longer works when tls is enabled

acceptance/tests/vault/vault_test.go

@@ -1,6 +1,8 @@
 package vault
 
 import (
+	"context"
+	"fmt"
 	"testing"
 
 	"github.com/hashicorp/consul-k8s/acceptance/framework/consul"
@@ -9,6 +11,7 @@ import (
 	"github.com/hashicorp/consul-k8s/acceptance/framework/logger"
 	"github.com/hashicorp/consul-k8s/acceptance/framework/vault"
 	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 const staticClientName = "static-client"
@@ -111,6 +114,20 @@ func TestVault(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, caConfig.Provider, "vault")
 
+	// Validate that tls.crt is not set to the default value
+	logger.Log(t, "Validating that CONSUL_CACERT has been set correctly")
+	serverPod, err := ctx.KubernetesClient(t).CoreV1().Pods(ns).Get(context.Background(), fmt.Sprintf("%s-consul-server-0", consulReleaseName), metav1.GetOptions{})
+	require.NoError(t, err)
+
+	// Environment variables are buried in the pod spec
+	containerVars := serverPod.Spec.Containers[0].Env
+	for k := range containerVars {
+		if containerVars[k].Name == "CONSUL_CACERT" {
+			require.NotEqual(t, containerVars[k].Value, "/consul/tls/ca/tls.crt")
+			require.Equal(t, containerVars[k].Value, "/vault/secrets/serverca.crt")
+		}
+	}
+
 	if cfg.EnableEnterprise {
 		// Validate that the enterprise license is set correctly.
 		logger.Log(t, "Validating the enterprise license has been set correctly.")

charts/consul/templates/client-daemonset.yaml

@@ -231,13 +231,16 @@ spec:
             {{- if .Values.global.tls.enabled }}
             - name: CONSUL_HTTP_ADDR
               value: https://localhost:8501
-            {{- if .Values.global.tls.enableAutoEncrypt }}
+              {{- if .Values.global.tls.enableAutoEncrypt }}
             - name: CONSUL_HTTP_SSL_VERIFY
               value: "false"
-            {{- else }}
+              {{- end }}
             - name: CONSUL_CACERT
+              {{- if .Values.global.secretsBackend.vault.enabled }}
+              value: /vault/secrets/serverca.crt
+              {{- else }}
               value: /consul/tls/ca/tls.crt
-            {{- end }}
+              {{- end }}
             {{- end }}
             {{- include "consul.extraEnvironmentVars" .Values.client | nindent 12 }}
           command:

charts/consul/templates/server-statefulset.yaml

@@ -223,7 +223,11 @@ spec:
             - name: CONSUL_HTTP_ADDR
               value: https://localhost:8501
             - name: CONSUL_CACERT
+              {{- if .Values.global.secretsBackend.vault.enabled }}
+              value: /vault/secrets/serverca.crt
+              {{- else }}
               value: /consul/tls/ca/tls.crt
+              {{- end }}
             {{- end }}
             {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.enableLicenseAutoload) }}
             - name: CONSUL_LICENSE_PATH

charts/consul/test/unit/client-daemonset.bats

@@ -841,6 +841,25 @@ load _helpers
     [ "${actual}" = "/consul/tls/ca/tls.crt" ]
 }
 
+@test "client/DaemonSet: sets Consul environment variables when global.tls.enabled and global.secretsBackend.vault.enabled " {
+  cd `chart_dir`
+  local env=$(helm template \
+      -s templates/client-daemonset.yaml  \
+      --set 'global.tls.enabled=true' \
+      --set 'global.tls.enableAutoEncrypt=true' \
+      --set 'global.secretsBackend.vault.enabled=true'  \
+      --set 'global.secretsBackend.vault.consulClientRole=foo' \
+      --set 'global.secretsBackend.vault.consulServerRole=test' \
+      --set 'global.secretsBackend.vault.consulCARole=test' \
+      --set 'global.tls.caCert.secretName=pki_int/cert/ca' \
+      . | tee /dev/stderr |
+      yq -r '.spec.template.spec.containers[0].env[]' | tee /dev/stderr)
+
+  local actual
+  actual=$(echo $env | jq -r '. | select(.name == "CONSUL_CACERT") | .value' | tee /dev/stderr)
+    [ "${actual}" = "/vault/secrets/serverca.crt" ]
+}
+
 @test "client/DaemonSet: sets verify_* flags to true by default when global.tls.enabled" {
   cd `chart_dir`
   local command=$(helm template \
@@ -1966,4 +1985,4 @@ rollingUpdate:
 
   [ "$status" -eq 1 ]
   [[ "$output" =~ "global.imageK8s is not a valid key, use global.imageK8S (note the capital 'S')" ]]
-}
+}

charts/consul/test/unit/server-statefulset.bats

@@ -1113,6 +1113,25 @@ load _helpers
     [ "${actual}" = "/consul/tls/ca/tls.crt" ]
 }
 
+@test "server/StatefulSet: sets Consul environment variables when global.tls.enabled and global.secretsBackend.vault.enabled" {
+  cd `chart_dir`
+  local env=$(helm template \
+      -s templates/server-statefulset.yaml  \
+      --set 'global.tls.enabled=true' \
+      --set 'global.tls.enableAutoEncrypt=true' \
+      --set 'global.secretsBackend.vault.enabled=true'  \
+      --set 'global.secretsBackend.vault.consulClientRole=foo' \
+      --set 'global.secretsBackend.vault.consulServerRole=test' \
+      --set 'global.secretsBackend.vault.consulCARole=test' \
+      --set 'global.tls.caCert.secretName=pki_int/cert/ca' \
+      . | tee /dev/stderr |
+      yq -r '.spec.template.spec.containers[0].env[]' | tee /dev/stderr)
+
+  local actual
+  actual=$(echo $env | jq -r '. | select(.name == "CONSUL_CACERT") | .value' | tee /dev/stderr)
+    [ "${actual}" = "/vault/secrets/serverca.crt" ]
+}
+
 @test "server/StatefulSet: sets verify_* flags to true by default when global.tls.enabled" {
   cd `chart_dir`
   local command=$(helm template \