apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: consul
rules:
  - apiGroups: [ "" ]
    resources: [ pods ]
    verbs:     [ get, list ]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: consul
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: consul
subjects:
  - kind: ServiceAccount
    name: consul
    namespace: orange
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: consul
---
apiVersion: v1
kind: Service
metadata:
  name: consul
spec:
  ports:
  - port: 8500
    name: http
  selector:
    app: consul
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: consul
spec:
  serviceName: consul
  replicas: 3
  selector:
    matchLabels:
      app: consul
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
  template:
    metadata:
      labels:
        app: consul
    spec:
      serviceAccountName: consul
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app
                    operator: In
                    values:
                      - consul
              topologyKey: kubernetes.io/hostname
      terminationGracePeriodSeconds: 10
      containers:
        - name: consul
          image: "consul:1.4.4"
          volumeMounts:
            - name: data
              mountPath: /consul/data
          args:
            - "agent"
            - "-bootstrap-expect=3"
            - "-retry-join=provider=k8s namespace=orange label_selector=\"app=consul\""
            - "-client=0.0.0.0"
            - "-data-dir=/consul/data"
            - "-server"
            - "-ui"
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/sh
                - -c
                - consul leave