dev: refactor embedded config into separate yaml files

dev/config/consul/acl-policy.hcl

@@ -0,0 +1,9 @@
+node_prefix "" { policy = "write" }
+service_prefix "" { policy = "write" }
+agent_prefix "" { policy = "write" }
+event_prefix "" { policy = "write" }
+query_prefix "" { policy = "write" }
+session_prefix "" { policy = "write" }
+operator = "write"
+acl = "write"
+keyring = "write"

dev/config/helm/consul.yaml

@@ -0,0 +1,41 @@
+global:
+  name: consul
+  image: "hashicorpdev/consul:581357c32"
+  tls:
+    enabled: true
+    serverAdditionalDNSSANs:
+    - host.docker.internal
+    - localhost
+    - consul-server.default.svc.cluster.local
+connectInject:
+  enabled: true
+controller:
+  enabled: true
+server:
+  replicas: 1
+  extraConfig: |
+    {
+      "log_level": "trace",
+      "acl": {
+        "enabled": true,
+        "default_policy": "allow",
+        "enable_token_persistence": true
+      },
+      "connect": {
+        "enabled": true
+      }
+    }
+ui:
+  enabled: true
+  ingress:
+    enabled: true
+    hosts:
+    - host: "host.docker.internal"
+      paths:
+      - "/"
+    - host: "localhost"
+      paths:
+      - "/"
+    annotations: |
+      "kubernetes.io/ingress.class": "nginx"
+      "nginx.ingress.kubernetes.io/ssl-passthrough": "true"

dev/config/k8s/consul-api-gateway.yaml

@@ -0,0 +1,120 @@
+apiVersion: api-gateway.consul.hashicorp.com/v1alpha1
+kind: GatewayClassConfig
+metadata:
+  name: test-gateway-class-config
+spec:
+  useHostPorts: true
+  logLevel: trace
+  image:
+    consulAPIGateway: "consul-api-gateway:1"
+  consul:
+    scheme: https
+    caSecret: consul-ca-cert
+    ports:
+      http: 8501
+      grpc: 8502
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GatewayClass
+metadata:
+  name: test-gateway-class
+spec:
+  controllerName: "hashicorp.com/consul-api-gateway-controller"
+  parametersRef:
+    group: api-gateway.consul.hashicorp.com
+    kind: GatewayClassConfig
+    name: test-gateway-class-config
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: Gateway
+metadata:
+  name: test-gateway
+spec:
+  gatewayClassName: test-gateway-class
+  listeners:
+  - protocol: HTTPS
+    hostname: localhost
+    port: 8443
+    name: https
+    allowedRoutes:
+      namespaces:
+        from: Same
+    tls:
+      certificateRefs:
+        - name: consul-server-cert
+---
+apiVersion: consul.hashicorp.com/v1alpha1
+kind: ServiceDefaults
+metadata:
+  name: echo
+spec:
+  protocol: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: echo
+  name: echo
+spec:
+  ports:
+  - port: 8080
+    name: high
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: echo
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: echo
+  name: echo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: echo
+  template:
+    metadata:
+      labels:
+        app: echo
+      annotations:
+        'consul.hashicorp.com/connect-inject': 'true'
+    spec:
+      containers:
+      - image: gcr.io/kubernetes-e2e-test-images/echoserver:2.2
+        name: echo
+        ports:
+        - containerPort: 8080
+        env:
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.nodeName
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          - name: POD_IP
+            valueFrom:
+              fieldRef:
+                fieldPath: status.podIP
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: HTTPRoute
+metadata:
+  name: test-route
+spec:
+  parentRefs:
+  - name: test-gateway
+  rules:
+  - backendRefs:
+    - kind: Service
+      name: echo
+      port: 8080

dev/config/k8s/consul-ui/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - https://github.com/kubernetes/ingress-nginx/deploy/static/provider/kind
+patchesJSON6902:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: ingress-nginx-controller
+  patch: |-
+    - op: add
+      path: "/spec/template/spec/containers/0/args/-"
+      value: "--enable-ssl-passthrough"

dev/config/k8s/rbac.yaml

@@ -0,0 +1,53 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: consul-api-gateway-tokenreview-binding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: consul-api-gateway
+    namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  namespace: default
+  name: consul-api-gateway-auth
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: consul-api-gateway-auth-binding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: consul-api-gateway-auth
+subjects:
+  - kind: ServiceAccount
+    name: consul-api-gateway
+    namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: consul-auth-binding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: consul-api-gateway-auth
+subjects:
+  - kind: ServiceAccount
+    name: consul-server
+    namespace: default

dev/config/kind/cluster.yaml

@@ -0,0 +1,23 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+  kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        node-labels: "ingress-ready=true"
+  extraPortMappings:
+  - containerPort: 443
+    hostPort: 443
+    protocol: TCP
+  - containerPort: 8501
+    hostPort: 8501
+    protocol: TCP
+  - containerPort: 8502
+    hostPort: 8502
+    protocol: TCP
+  - containerPort: 8443
+    hostPort: 8443
+    protocol: TCP