configurable max_ttl for auto_config generated ACL tokens
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Feature Description
Currently consul agents are provisioned with auto_config, and the ACL system is enabled, ACL tokens generated by auto_config have no max-ttl set. In an ideal world the associated ACL created by auto_config would be associated with an ACL auth-method. This would mean that agents would need to periodically refresh their genrated ACL tokens.
Somewhat related issue: https://github.com/hashicorp/consul/issues/20741
#### Use Case(s)
Having tokens with infinite lifetimes, are negative from a security perspective. Presumably unsustainable for the consul server as they last forever, and/or require an operator to eventually clean them up.
Contributor guide
Research direction
The issue concerns ACL tokens generated while Consul agents are provisioned with auto_config, but it names no files, tests, or entry points. Start by locating the auto_config ACL token generation path and review related issue 20741. Done criteria would include an agreed configuration for max_ttl and defined behavior for token expiration or refresh.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100