hashicorp / hashicorp/consul

Provide latest ACL index on an unprivileged API endpoint

Open
#3,460 3 comments 0 reactions 0 assignees View on GitHub
theme/acls type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

### `consul version` for both Client and Server
Server: 0.7.2, present in current version based on docs

### Description of the Issue (and unexpected/desired result)

When running ACL replication the /acl/replication endpoint in the DCs replicating the master return the latest index they have replicated. However, this index is only available on the master at /acl/list, which is a privileged endpoint that returns sensitive data. Furthermore, the /acl/list endpoint returns far more data than is needed to get the current master index, and it is required that the system consuming the endpoint iterate over a list to find the highest index.

I'd like to have my monitoring check my non-master DCs for lag, however I do not want the monitoring system to access a management token for security reasons. Furthermore, I'd prefer my monitoring check not have to parse all the ACLs in the system to get the current master index, as I foresee potential performance issues with that as my list of ACLs grow.

Please create an acl endpoint that simply returns the current ACL index and which does not require a privileged token. As the /acl/replication endpoint doesn't require a token, and as the index isn't privileged information, no auth would be preferred. This will be very useful for monitoring ACL replication with monitoring systems. Thanks.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.