hashicorp / hashicorp/consul

Envoy proxy getting error after enabled ACL on consul cluster

Open
#16,267 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

Envoy proxy getting error after enabled ACL on consul cluster.

### Consul info for both Client and Server

"consul":
connectInject:
default: true
enabled: true
controller:
enabled: true
global:
name: consul
ingressGateways:
enabled: true
gateways:
- name: ingress-gateway
service:
ports:
- nodePort: 30225
port: 80
- nodePort: 31577
port: 443
- nodePort: 30253
port: 8080
type: NodePort
server:
bootstrapExpect: null
replicas: 3
resources:
requests:
memory: "100Mi"
cpu: "100m"
limits:
memory: "1000Mi"
cpu: "1000m"
extraConfig: |
{
"primary_datacenter": "dc1",
"acl": { "enabled": true, "default_policy": "deny" },
"performance": {"raft_multiplier": 1}
}
client:
enabled: true
grpc: true
extraConfig: |
{
"primary_datacenter": "dc1",
"acl": { "enabled": true, "default_policy": "deny", "tokens": { "agent": "xxxxxxxxxx", "default": "xxxxxxxx"} },
"ui_config": { "enabled": true },
"limits": { "http_max_conns_per_client": 4000},
"performance": {"raft_multiplier": 1}
}
syncCatalog:
enabled: true
ui:
enabled: true
service:
enabled: true
type: null
port:
http: 80
https: 443
nodePort:
http: null
https: null
annotations: null
additionalSpec: null
ingress:
enabled: false

```
output from client 'consul info' command here
```
hashicorp/consul:1.11.2

```
output from server 'consul info' command here
```

hashicorp/consul:1.11.2

### Operating system and Environment details

EKS

### Log Fragments
[2023-02-15 06:25:43.214][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
[2023-02-15 06:26:09.486][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
[2023-02-15 06:26:21.499][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied
[2023-02-15 06:26:40.489][1][warning][config] [./source/common/config/grpc_stream.h:160] DeltaAggregatedResources gRPC config stream closed: 7, permission denied

Contributor guide

Open the contributing guide

Research direction

Start with the Consul client and server extraConfig blocks and the Envoy warning at source/common/config/grpc_stream.h:160. Compare the ACL settings and tokens in the provided EKS configuration, then use consul info and the repeated permission-denied logs to narrow down the failing stream. Done means the Envoy DeltaAggregatedResources stream remains connected after ACLs are enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.