Envoy proxy getting error after enabled ACL on consul cluster
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
Envoy proxy getting error after enabled ACL on consul cluster.
### Consul info for both Client and Server
"consul":
connectInject:
default: true
enabled: true
controller:
enabled: true
global:
name: consul
ingressGateways:
enabled: true
gateways:
- name: ingress-gateway
service:
ports:
- nodePort: 30225
port: 80
- nodePort: 31577
port: 443
- nodePort: 30253
port: 8080
type: NodePort
server:
bootstrapExpect: null
replicas: 3
resources:
requests:
memory: "100Mi"
cpu: "100m"
limits:
memory: "1000Mi"
cpu: "1000m"
extraConfig: |
{
"primary_datacenter": "dc1",
"acl": { "enabled": true, "default_policy": "deny" },
"performance": {"raft_multiplier": 1}
}
client:
enabled: true
grpc: true
extraConfig: |
{
"primary_datacenter": "dc1",
"acl": { "enabled": true, "default_policy": "deny", "tokens": { "agent": "xxxxxxxxxx", "default": "xxxxxxxx"} },
"ui_config": { "enabled": true },
"limits": { "http_max_conns_per_client": 4000},
"performance": {"raft_multiplier": 1}
}
syncCatalog:
enabled: true
ui:
enabled: true
service:
enabled: true
type: null
port:
http: 80
https: 443
nodePort:
http: null
https: null
annotations: null
additionalSpec: null
ingress:
enabled: false
```
output from client 'consul info' command here
```
hashicorp/consul:1.11.2
```
output from server 'consul info' command here
```
hashicorp/consul:1.11.2
### Operating system and Environment details
EKS
### Log Fragments
[2023-02-15 06:25:43.214][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
[2023-02-15 06:26:09.486][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
[2023-02-15 06:26:21.499][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
[2023-02-15 06:26:40.489][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
Contributor guide
Research direction
Start with the Consul client and server extraConfig blocks and the Envoy warning at source/common/config/grpc_stream.h:160. Compare the ACL settings and tokens in the provided EKS configuration, then use consul info and the repeated permission-denied logs to narrow down the failing stream. Done means the Envoy DeltaAggregatedResources stream remains connected after ACLs are enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100