Automatically Generate and Use Gossip Encryption Key

[t-eckert]

Changes proposed in this PR:

• Add global.gossipEncryption.autoGenerate to values.yaml
• Change client-daemonset.yaml and server-statefulset.yaml to pickup the generated gossip encryption key
• Add gossip-encryption-autogeneration-job.yaml to generate and set up the gossip encryption key
• Add gossip-encryption-autogeneration...
  • -podsecuritypolicy.yaml
  • -role.yaml
  • -rolebinding.yaml
  • -serviceaccount.yaml
• Add bats tests for the client-daemonset, server-statefulset, and gossip-encryption-autogen-*

How I've tested this PR:

• Running the new bats tests and confirming that no current bats tests are broken
• Deployed the new templates using Helm and verified that gossip encryption is working correctly

How I expect reviewers to test this PR:

• Testing bats for the relevant changes.
• Testing gossip encryption:
  On a fresh Kubernetes instance, from charts/consul/ directory

  helm install consul . --set global.gossipEncryption.autoGenerate=true

  Wait for install to complete. Check that the gossip encryption secret has been created:

   kubectl get secrets consul-consul-gossip-encryption-key

  Exec into a server pod to check gossip encryption:

  kubectl exec consul-consul-server-0 -it -- /bin/sh

  Check if Consul is using the secret:

  curl http://127.0.0.1:8500/v1/operator/keyring | jq

  If successful, the gossip encryption key should be listed in the key ring.

Checklist:

• Tests added
• CHANGELOG entry added

  HashiCorp engineers only, community PRs should not add a changelog entry.
  Entries should use present tense (e.g. Add support for...)

[thisisnotashwin]

Hey @t-eckert !! This is looking really good. I left some more comments but this is looking close to done!! 👍

[ishustava]

Great work Thomas. I left some minor comments and also agree with Ashwin's comments. I'm approving though, assuming those get resolved.

[thisisnotashwin]

This looks good. Added the suggestion that should fix the tests. Nice job on the PR!

reminder to squash and merge the PR 😅