Thanks Lukas, that’s correct. We’re using the statefulset for the PVC that gives us a persistent disk for the Consul servers.
The Helm chart is not using auto encrypt right now because of a bug in auto encrypt that cause the certificates to not have the right IP SAN. This meant we had to generate the certificates ourselves with the IP SAN. This bug was fixed in Consul 1.7.0 and we are now working on auto encrypt support.
I recently answered a question about Consul servers and durable storage here: Do Consul servers need durable storage?. Consul server IPs can change without issue as long as the join urls are still routable.