hashicorp / hashicorp/consul-dataplane
Support for short-lived tokens (non-static)
- Dominant language
- Go
- Stars
- 35
- Forks
- 10
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 39
Description
If using an authmethod with a bearertoken to generate short-lived tokens rather than using static tokens, there is no logic to reauthenticate/rotate this token. Once the TTL passes, the connection manager fails with ACL errors:
```
2025-12-03T17:40:14.005Z [INFO] consul-dataplane.server-connection-manager: ACL auth method login succeeded: accessorID=...3c
... <10 minute TTL>...
2025-12-03T17:50:14.209Z [ERROR] consul-dataplane.server-connection-manager: connection error: error="rpc error: code = Unauthenticated desc = ACL system must be bootstrapped before making any requests that require authorization: ACL not found"
```
Since the mesh-init process writes data to the shared volume (/consul/consul-dataplane.json), it would make sense that the dataplane (and healt-sync) containers re-use that data to re-auth. As a workaround on the health-sync, a modified entrypoint to run a loop works..
```
entryPoint = ["sh", "-c"]
command = ["while true; do timeout -s HUP 5m /bin/consul-ecs health-sync; done"]
```
but on the dataplane, this will cause unacceptable interruptions.
It look like the token is origially generated in the [Run method](https://github.com/mlinde201_comcast/consul-dataplane/blob/main/pkg/consuldp/consul_dataplane.go#L129) on line [179](https://github.com/mlinde201_comcast/consul-dataplane/blob/main/pkg/consuldp/consul_dataplane.go#L179C6-L179C14) ..
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.