Provide latest ACL index on an unprivileged API endpoint
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
### `consul version` for both Client and Server
Server: 0.7.2, present in current version based on docs
### Description of the Issue (and unexpected/desired result)
When running ACL replication the /acl/replication endpoint in the DCs replicating the master return the latest index they have replicated. However, this index is only available on the master at /acl/list, which is a privileged endpoint that returns sensitive data. Furthermore, the /acl/list endpoint returns far more data than is needed to get the current master index, and it is required that the system consuming the endpoint iterate over a list to find the highest index.
I'd like to have my monitoring check my non-master DCs for lag, however I do not want the monitoring system to access a management token for security reasons. Furthermore, I'd prefer my monitoring check not have to parse all the ACLs in the system to get the current master index, as I foresee potential performance issues with that as my list of ACLs grow.
Please create an acl endpoint that simply returns the current ACL index and which does not require a privileged token. As the /acl/replication endpoint doesn't require a token, and as the index isn't privileged information, no auth would be preferred. This will be very useful for monitoring ACL replication with monitoring systems. Thanks.
Contributor guide
Assessment
This issue has not been assessed yet.