hcp-ansible/playbooks/tasks/consul/consul_deploy.yml

---
- name: "Consul"
  block:
    - name: "Include ednz_cloud.hashistack.hashicorp_consul"
      ansible.builtin.include_role:
        name: ednz_cloud.hashistack.hashicorp_consul

    - name: "Wait for consul cluster to initialize" # noqa: run-once[task]
      ansible.builtin.uri:
        url: "{{ consul_api_addr }}"
        validate_certs: no
        return_content: yes
        status_code:
          - 200
      until: uri_output.status == 200
      retries: 24
      delay: 5
      register: uri_output

    - name: "Initialize consul cluster" # noqa: run-once[task]
      community.general.consul_acl_bootstrap:
        bootstrap_secret: "{{ _credentials.consul.root_token.secret_id }}"
        host: "{{ api_interface_address }}"
        port: "{{ consul_api_port[consul_api_scheme] }}"
        scheme: "{{ consul_api_scheme }}"
        state: present
      run_once: true
      delegate_to: "{{ groups['consul_servers'] | first }}"
      register: _consul_init_secret
      when: hashi_consul_configuration.acl.enabled

    - name: "Create consul agents token"
      when:
        - _consul_init_secret.changed
        - consul_acl_configuration.enabled
      block:
        - name: "Create consul agents token" # noqa: run-once[task] no-handler
          run_once: true
          block:
            - name: "Create consul agent policy"
              community.general.consul_policy:
                token: "{{ _credentials.consul.root_token.secret_id }}"
                host: "{{ api_interface_address }}"
                port: "{{ consul_api_port[consul_api_scheme] }}"
                scheme: "{{ consul_api_scheme }}"
                validate_certs: false
                state: present
                name: agents-policy
                rules: "{{ consul_default_agent_policy }}"
              register: _consul_agent_policy

            - name: "Create consul agents token"
              community.general.consul_token:
                token: "{{ _credentials.consul.root_token.secret_id }}"
                host: "{{ api_interface_address }}"
                port: "{{ consul_api_port[consul_api_scheme] }}"
                scheme: "{{ consul_api_scheme }}"
                validate_certs: false
                accessor_id: "{{ _credentials.consul.tokens.agent.accessor_id }}"
                secret_id: "{{ _credentials.consul.tokens.agent.secret_id }}"
                policies:
                  - id: "{{ _consul_agent_policy.policy.ID }}"
                state: present
              register: _consul_agent_token

            - name: "Restart consul service"
              ansible.builtin.service:
                name: "consul_container"
                state: restarted
              throttle: 1
              when: _consul_agent_token.changed