Initial commit

.gitignore

@@ -0,0 +1,3 @@
+/consul-cloud
+/cache
+/.env

Dockerfile-envoy

@@ -0,0 +1,3 @@
+FROM consul:1.4.0
+FROM envoyproxy/envoy:v1.8.0
+COPY --from=0 /bin/consul /bin/consul

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 R.B. Boyer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,41 @@
+SHELL := /bin/bash
+
+.PHONY: all
+all: init
+
+.PHONY: gomod
+gomod:
+	GO111MODULE=on go mod tidy
+	GO111MODULE=on go mod vendor
+	GO111MODULE=on go mod download
+
+.PHONY: init
+init: docker
+	@mkdir -p cache
+
+.PHONY: docker
+docker:
+	docker build -t local/consul-envoy -f Dockerfile-envoy .
+
+.PHONY: up
+up:
+	docker-compose up -d
+	go run main.go
+
+.PHONY: down
+down:
+	docker-compose down -v --remove-orphans
+	rm -f cache/*.val
+
+.PHONY: members
+members:
+	@./consul.sh members
+
+.PHONY: services
+services:
+	@./consul.sh catalog services
+
+.PHONY: use-dev
+use-dev:
+	$(info switching to dev builds)
+	echo "CONSUL_IMAGE=consul-dev:latest" > .env

README.md

@@ -0,0 +1,48 @@
+# consul-cloud
+
+This project helps bring up a local Consul Connect cluster using Docker.
+
+## Prerequisites
+
+* `go v1.11.4` or newer
+* `docker`
+* `docker-compose`
+* `automake`
+* `bash4`
+
+## Getting Started
+
+1. Run `make`. This will create any necessary docker containers that you may
+   lack.
+2. Run `make up`. This will bring up the containers with docker-compose, and
+   then use `main.go` to bootstrap ACLs.
+3. If you wish to destroy everything, run `make down`.
+
+## Topology
+
+Three "machines" are simulated in the manner of a Kubernetes Pod by
+anchoring a network namespace to a single placeholder container (running
+`google/pause:latest`) and then attaching any additional containers to it that
+should be colocated
+and share network things such as `127.0.0.1` and the `lo0` adapter.
+
+This brings up a single consul cluster with 1 Server and 2 Client Agents
+configured.  They are running on fixed IP addresses to make configuration
+simple:
+
+| Container                | IP        | Image              |
+| ----------------         | --------- | ------------------ |
+| dc1-server1-pod          | 10.0.1.11 | google/pause       |
+| dc1-server1              | ^^^       | consul:1.4.0       |
+| dc1-client1-pod          | 10.0.1.12 | google/pause       |
+| dc1-client1              | ^^^       | consul:1.4.0       |
+| dc1-client1-ping         | ^^^       | rboyer/pingpong    |
+| dc1-client1-ping-sidecar | ^^^       | local/consul-envoy |
+| dc1-client2-pod          | 10.0.1.13 | google/pause       |
+| dc1-client2              | ^^^       | consul:1.4.0       |
+| dc1-client2-pong         | ^^^       | rboyer/pingpong    |
+| dc1-client2-pong-sidecar | ^^^       | local/consul-envoy |
+
+The copies of pingpong running in the two pods are configured to dial each
+other using Connect and exchange simple RPCs to showcase all of the plumbing in
+action.

consul.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+readonly master_token_file=./cache/master-token.val
+
+master_token() {
+    if [[ ! -f "${master_token_file}" ]]; then
+        echo "no master token defined in ${master_token_file}" >&2
+        exit 1
+    fi
+
+    local token
+    read -r token < "${master_token_file}"
+
+    # trim any whitespace; this overdoes it in the middle, but tokens don't have
+    # whitespace in the middle so :shrug:
+    echo "${token//[[:space:]]}"
+}
+
+exec docker-compose exec -e CONSUL_HTTP_TOKEN="$(master_token)" dc1-server1 consul "$@"

docker-compose.override.yml

@@ -0,0 +1,80 @@
+# this sets up the Connect layer
+version: '3.7'
+
+# admin-bind is set to 0.0.0.0 to make control from the host easier
+# it should be disabled for real topologies
+
+services:
+  dc1-client1-ping:
+    network_mode: 'service:dc1-client1-pod'
+    depends_on:
+      - dc1-client1
+    image: rboyer/pingpong:latest
+    init: true
+    command:
+      - '-bind'
+      - '127.0.0.1:8080'
+      - '-dial'
+      - '127.0.0.1:9090'
+
+  dc1-client1-ping-sidecar:
+    network_mode: 'service:dc1-client1-pod'
+    depends_on:
+      - dc1-client1-ping
+    image: local/consul-envoy
+    init: true
+    restart: on-failure
+    volumes:
+      - './cache:/secrets:ro'
+      - './sidecar-boot.sh:/bin/sidecar-boot.sh:ro'
+    command:
+      - '/bin/sidecar-boot.sh'
+      - '-boot-token-file'
+      - '/secrets/service-token--ping.val'
+      #################
+      - '-sidecar-for'
+      - 'ping'
+      - '-admin-bind'
+      # for demo purposes
+      - '0.0.0.0:19000'
+      # debug
+      - '--'
+      - '-l'
+      - 'trace'
+
+  dc1-client2-pong:
+    network_mode: 'service:dc1-client2-pod'
+    depends_on:
+      - dc1-client2
+    image: rboyer/pingpong:latest
+    init: true
+    command:
+      - '-bind'
+      - '127.0.0.1:8080'
+      - '-dial'
+      - '127.0.0.1:9090'
+
+  dc1-client2-pong-sidecar:
+    network_mode: 'service:dc1-client2-pod'
+    depends_on:
+      - dc1-client2-pong
+    image: local/consul-envoy
+    init: true
+    restart: on-failure
+    volumes:
+      - './cache:/secrets:ro'
+      - './sidecar-boot.sh:/bin/sidecar-boot.sh:ro'
+    command:
+      - '/bin/sidecar-boot.sh'
+      - '-boot-token-file'
+      - '/secrets/service-token--pong.val'
+      #################
+      - '-sidecar-for'
+      - 'pong'
+      - '-admin-bind'
+      # for demo purposes
+      - '0.0.0.0:19000'
+      # debug
+      - '--'
+      - '-l'
+      - 'trace'

docker-compose.yml

@@ -0,0 +1,142 @@
+# this just sets up the consul layer
+version: '3.7'
+
+# client_addr is set to 0.0.0.0 to make control from the host easier
+# it should be disabled for real topologies
+
+networks:
+  dc1:
+    ipam:
+      driver: default
+      config:
+        - subnet: '10.0.1.0/24'
+
+# https://yipee.io/2017/06/getting-kubernetes-pod-features-using-native-docker-commands/
+services:
+  dc1-server1-pod:
+    container_name: 'dc1-server1-pod'
+    image: gcr.io/google_containers/pause:1.0
+    restart: always
+    hostname: dc1-server1-pod
+    networks:
+      dc1:
+        ipv4_address: '10.0.1.11'
+
+  dc1-server1:
+    network_mode: 'service:dc1-server1-pod'
+    depends_on:
+      - dc1-server1-pod
+    volumes:
+      - 'dc1-server1:/consul/data'
+    image: '${CONSUL_IMAGE:-consul:1.4.0}'
+    command:
+      - 'agent'
+      - '-hcl'
+      - |
+        server = true
+        client_addr = "0.0.0.0"
+        bootstrap_expect = 1
+        datacenter = "dc1"
+        disable_update_check = true
+        log_level = "debug"
+        primary_datacenter = "dc1"
+        encrypt = "g4TjOaAg+RUxVzv/dY7dfw=="
+        connect {
+            enabled = true
+        }
+        acl {
+            enabled = true
+            default_policy = "deny"
+            down_policy = "async-cache"
+        }
+
+########################################################
+  dc1-client1-pod:
+    container_name: 'dc1-client1-pod'
+    image: gcr.io/google_containers/pause:1.0
+    restart: always
+    hostname: dc1-client1-pod
+    networks:
+      dc1:
+        ipv4_address: '10.0.1.12'
+
+  dc1-client1:
+    network_mode: 'service:dc1-client1-pod'
+    depends_on:
+      - dc1-client1-pod
+      - dc1-server1
+    volumes:
+      - 'dc1-client1:/consul/data'
+    image: '${CONSUL_IMAGE:-consul:1.4.0}'
+    command:
+      - 'agent'
+      - '-hcl'
+      - |
+        server = false
+        client_addr = "0.0.0.0"
+        retry_join = [ "10.0.1.11" ]
+        ui = true
+        datacenter = "dc1"
+        disable_update_check = true
+        log_level = "debug"
+        primary_datacenter = "dc1"
+        encrypt = "g4TjOaAg+RUxVzv/dY7dfw=="
+        connect {
+            enabled = true
+        }
+        ports {
+          grpc = 8502
+        }
+        acl {
+            enabled = true
+            default_policy = "deny"
+            down_policy = "async-cache"
+        }
+
+########################################################
+  dc1-client2-pod:
+    container_name: 'dc1-client2-pod'
+    image: gcr.io/google_containers/pause:1.0
+    restart: always
+    hostname: dc1-client2-pod
+    networks:
+      dc1:
+        ipv4_address: '10.0.1.13'
+
+  dc1-client2:
+    network_mode: 'service:dc1-client2-pod'
+    depends_on:
+      - dc1-client2-pod
+      - dc1-server1
+    volumes:
+      - 'dc1-client2:/consul/data'
+    image: '${CONSUL_IMAGE:-consul:1.4.0}'
+    command:
+      - 'agent'
+      - '-hcl'
+      - |
+        server = false
+        client_addr = "0.0.0.0"
+        retry_join = [ "10.0.1.11" ]
+        ui = true
+        datacenter = "dc1"
+        disable_update_check = true
+        log_level = "debug"
+        primary_datacenter = "dc1"
+        encrypt = "g4TjOaAg+RUxVzv/dY7dfw=="
+        connect {
+            enabled = true
+        }
+        ports {
+          grpc = 8502
+        }
+        acl {
+            enabled = true
+            default_policy = "deny"
+            down_policy = "async-cache"
+        }
+
+volumes:
+  dc1-server1:
+  dc1-client1:
+  dc1-client2: