Integrate Consul with Kubernetes service discovery and automatic configuration

#!/usr/bin/env bash
set -euo pipefail

# Consul + Kubernetes Integration Install Script
# Installs Consul server and prepares Kubernetes integration

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
CONSUL_VERSION="1.17.0"
CONSUL_USER="consul"
CONSUL_CONFIG_DIR="/etc/consul.d"
CONSUL_DATA_DIR="/opt/consul"
CONSUL_BINARY="/usr/local/bin/consul"
CLUSTER_SIZE=3
ENCRYPTION_KEY=""

# Usage function
usage() {
    cat << EOF
Usage: $0 [OPTIONS]
Install Consul server for Kubernetes integration

OPTIONS:
    -s, --server-ip     Primary server IP address (required)
    -j, --join-ips      Comma-separated list of cluster IPs (required)
    -n, --node-name     Consul node name (default: consul-server-1)
    -d, --datacenter    Datacenter name (default: k8s-dc1)
    -h, --help          Show this help

Example:
    $0 -s 203.0.113.10 -j 203.0.113.10,203.0.113.11,203.0.113.12
EOF
    exit 1
}

# Cleanup function
cleanup() {
    if [[ $? -ne 0 ]]; then
        echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
        systemctl stop consul 2>/dev/null || true
        systemctl disable consul 2>/dev/null || true
        rm -f /etc/systemd/system/consul.service
        rm -rf $CONSUL_CONFIG_DIR $CONSUL_DATA_DIR
        userdel $CONSUL_USER 2>/dev/null || true
        rm -f $CONSUL_BINARY
    fi
}
trap cleanup ERR

# Detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_UPDATE="apt update && apt upgrade -y"
                PKG_INSTALL="apt install -y"
                UNZIP_PKG="unzip"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                UNZIP_PKG="unzip"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                UNZIP_PKG="unzip"
                ;;
            *)
                echo -e "${RED}Unsupported distribution: $ID${NC}"
                exit 1
                ;;
        esac
    else
        echo -e "${RED}Cannot detect distribution${NC}"
        exit 1
    fi
}

# Check prerequisites
check_prerequisites() {
    echo -e "${YELLOW}[1/10] Checking prerequisites...${NC}"
    
    if [[ $EUID -ne 0 ]]; then
        echo -e "${RED}This script must be run as root${NC}"
        exit 1
    fi
    
    if ! command -v wget &> /dev/null; then
        $PKG_INSTALL wget
    fi
    
    if ! command -v curl &> /dev/null; then
        $PKG_INSTALL curl
    fi
}

# Parse arguments
parse_args() {
    SERVER_IP=""
    JOIN_IPS=""
    NODE_NAME="consul-server-1"
    DATACENTER="k8s-dc1"
    
    while [[ $# -gt 0 ]]; do
        case $1 in
            -s|--server-ip)
                SERVER_IP="$2"
                shift 2
                ;;
            -j|--join-ips)
                JOIN_IPS="$2"
                shift 2
                ;;
            -n|--node-name)
                NODE_NAME="$2"
                shift 2
                ;;
            -d|--datacenter)
                DATACENTER="$2"
                shift 2
                ;;
            -h|--help)
                usage
                ;;
            *)
                echo -e "${RED}Unknown option: $1${NC}"
                usage
                ;;
        esac
    done
    
    if [[ -z "$SERVER_IP" ]] || [[ -z "$JOIN_IPS" ]]; then
        echo -e "${RED}Server IP and join IPs are required${NC}"
        usage
    fi
}

# Update system packages
update_system() {
    echo -e "${YELLOW}[2/10] Updating system packages...${NC}"
    $PKG_UPDATE
}

# Install Consul
install_consul() {
    echo -e "${YELLOW}[3/10] Installing Consul...${NC}"
    
    cd /tmp
    wget -q "https://releases.hashicorp.com/consul/${CONSUL_VERSION}/consul_${CONSUL_VERSION}_linux_amd64.zip"
    
    $PKG_INSTALL $UNZIP_PKG
    unzip -q "consul_${CONSUL_VERSION}_linux_amd64.zip"
    
    mv consul $CONSUL_BINARY
    chmod 755 $CONSUL_BINARY
    
    rm -f "consul_${CONSUL_VERSION}_linux_amd64.zip"
    
    echo -e "${GREEN}Consul installed successfully${NC}"
}

# Create Consul user and directories
setup_consul_user() {
    echo -e "${YELLOW}[4/10] Creating Consul user and directories...${NC}"
    
    if ! id $CONSUL_USER &>/dev/null; then
        useradd --system --home $CONSUL_CONFIG_DIR --shell /bin/false $CONSUL_USER
    fi
    
    mkdir -p $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR
    chown $CONSUL_USER:$CONSUL_USER $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR
    chmod 755 $CONSUL_DATA_DIR $CONSUL_CONFIG_DIR
}

# Generate encryption key
generate_encryption_key() {
    echo -e "${YELLOW}[5/10] Generating encryption key...${NC}"
    ENCRYPTION_KEY=$($CONSUL_BINARY keygen)
    echo -e "${GREEN}Encryption key generated: $ENCRYPTION_KEY${NC}"
    echo -e "${YELLOW}Save this key for other cluster nodes!${NC}"
}

# Configure Consul
configure_consul() {
    echo -e "${YELLOW}[6/10] Configuring Consul server...${NC}"
    
    # Convert comma-separated IPs to HCL array format
    IFS=',' read -ra IP_ARRAY <<< "$JOIN_IPS"
    RETRY_JOIN=""
    for ip in "${IP_ARRAY[@]}"; do
        RETRY_JOIN+='"'$(echo $ip | xargs)'",'
    done
    RETRY_JOIN=${RETRY_JOIN%,}
    
    cat > $CONSUL_CONFIG_DIR/consul.hcl << EOF
datacenter = "$DATACENTER"
data_dir = "$CONSUL_DATA_DIR"
log_level = "INFO"
node_name = "$NODE_NAME"
server = true
bootstrap_expect = $CLUSTER_SIZE
bind_addr = "$SERVER_IP"
client_addr = "0.0.0.0"
retry_join = [$RETRY_JOIN]
encrypt = "$ENCRYPTION_KEY"

ui_config {
  enabled = true
}

connect {
  enabled = true
}

ports {
  grpc = 8502
}
EOF
    
    chown $CONSUL_USER:$CONSUL_USER $CONSUL_CONFIG_DIR/consul.hcl
    chmod 640 $CONSUL_CONFIG_DIR/consul.hcl
}

# Create systemd service
create_systemd_service() {
    echo -e "${YELLOW}[7/10] Creating systemd service...${NC}"
    
    cat > /etc/systemd/system/consul.service << EOF
[Unit]
Description=Consul
Documentation=https://www.consul.io/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=$CONSUL_CONFIG_DIR/consul.hcl

[Service]
Type=notify
User=$CONSUL_USER
Group=$CONSUL_USER
ExecStart=$CONSUL_BINARY agent -config-dir=$CONSUL_CONFIG_DIR/
ExecReload=/bin/kill -HUP \$MAINPID
KillMode=process
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
    
    chmod 644 /etc/systemd/system/consul.service
}

# Configure firewall
configure_firewall() {
    echo -e "${YELLOW}[8/10] Configuring firewall...${NC}"
    
    if command -v firewall-cmd &> /dev/null; then
        firewall-cmd --permanent --add-port=8300/tcp  # Server RPC
        firewall-cmd --permanent --add-port=8301/tcp  # Serf LAN
        firewall-cmd --permanent --add-port=8301/udp  # Serf LAN
        firewall-cmd --permanent --add-port=8302/tcp  # Serf WAN
        firewall-cmd --permanent --add-port=8302/udp  # Serf WAN
        firewall-cmd --permanent --add-port=8500/tcp  # HTTP API
        firewall-cmd --permanent --add-port=8502/tcp  # gRPC
        firewall-cmd --reload
    elif command -v ufw &> /dev/null; then
        ufw allow 8300/tcp
        ufw allow 8301
        ufw allow 8302
        ufw allow 8500/tcp
        ufw allow 8502/tcp
    fi
}

# Start Consul service
start_consul() {
    echo -e "${YELLOW}[9/10] Starting Consul service...${NC}"
    
    systemctl daemon-reload
    systemctl enable consul
    systemctl start consul
    
    sleep 5
    
    if systemctl is-active --quiet consul; then
        echo -e "${GREEN}Consul service started successfully${NC}"
    else
        echo -e "${RED}Failed to start Consul service${NC}"
        systemctl status consul
        exit 1
    fi
}

# Verify installation
verify_installation() {
    echo -e "${YELLOW}[10/10] Verifying installation...${NC}"
    
    if $CONSUL_BINARY version &>/dev/null; then
        echo -e "${GREEN}✓ Consul binary is working${NC}"
    else
        echo -e "${RED}✗ Consul binary test failed${NC}"
        exit 1
    fi
    
    if systemctl is-active --quiet consul; then
        echo -e "${GREEN}✓ Consul service is running${NC}"
    else
        echo -e "${RED}✗ Consul service is not running${NC}"
        exit 1
    fi
    
    if $CONSUL_BINARY members &>/dev/null; then
        echo -e "${GREEN}✓ Consul cluster communication working${NC}"
        $CONSUL_BINARY members
    else
        echo -e "${YELLOW}⚠ Consul cluster not fully formed yet${NC}"
    fi
    
    echo -e "${GREEN}Installation completed successfully!${NC}"
    echo -e "${YELLOW}Consul UI available at: http://$SERVER_IP:8500${NC}"
    echo -e "${YELLOW}Encryption key: $ENCRYPTION_KEY${NC}"
}

# Main execution
main() {
    parse_args "$@"
    detect_distro
    check_prerequisites
    update_system
    install_consul
    setup_consul_user
    generate_encryption_key
    configure_consul
    create_systemd_service
    configure_firewall
    start_consul
    verify_installation
}

main "$@"