Support acl style auth_methods for auto_config
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
#### Feature Description
Consul currently has a number of tokens to manage between servers and agents (gossip encryption, tls, acl tokens), this is mitigated by [auto_config](https://developer.hashicorp.com/consul/docs/agent/config/config-files#auto_config). Unlike acl token management which has support for multiple auth methods auto_config supports only one [static](https://developer.hashicorp.com/consul/docs/agent/config/config-files#static) auth method.
In each of our environments we run one set of consul servers and connect agents from a variety of clusters, and raw instances. This makes using a static auto_config difficult, we need to share another static token, and can’t make use of service account tokens for instance in clusters, or aws-iam for raw instances.
Ideally each agent could auto_config in different ways: for agents running in different clusters authenticate using service account jwt’s validated against that cluster’s provider, for agents running on raw instances use cloud aws-iam auth.
Supporting multiple authentication methods in a manner to acl [auth_methods](https://developer.hashicorp.com/consul/docs/security/acl/auth-methods), would have a side effect of more closely unifying the acl auth framework and auto_config, and allow for future expansion in supported auth methods for auto_config.
#### Use Case(s)
This would enable auto_config in more varied environments (K8s, various cloud VMs etc).
Contributor guide
Assessment
This issue has not been assessed yet.