hashicorp / hashicorp/consul

Support acl style auth_methods for auto_config

Open
#20,741 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Feature Description

Consul currently has a number of tokens to manage between servers and agents (gossip encryption, tls, acl tokens), this is mitigated by [auto_config](https://developer.hashicorp.com/consul/docs/agent/config/config-files#auto_config). Unlike acl token management which has support for multiple auth methods auto_config supports only one [static](https://developer.hashicorp.com/consul/docs/agent/config/config-files#static) auth method.

In each of our environments we run one set of consul servers and connect agents from a variety of clusters, and raw instances. This makes using a static auto_config difficult, we need to share another static token, and can’t make use of service account tokens for instance in clusters, or aws-iam for raw instances.

Ideally each agent could auto_config in different ways: for agents running in different clusters authenticate using service account jwt’s validated against that cluster’s provider, for agents running on raw instances use cloud aws-iam auth.

Supporting multiple authentication methods in a manner to acl [auth_methods](https://developer.hashicorp.com/consul/docs/security/acl/auth-methods), would have a side effect of more closely unifying the acl auth framework and auto_config, and allow for future expansion in supported auth methods for auto_config.

#### Use Case(s)

This would enable auto_config in more varied environments (K8s, various cloud VMs etc).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.