hashicorp / hashicorp/consul

Bootstrapping ACL's without a fully setup cluster?

Open
#6,706 1 comment 2 reactions 0 assignees View on GitHub
theme/acls type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

Hello!

I was wondering if there is a method to bootstrap tokens _before_ cluster initialization. Namely the token could be distributed to the `consul-agent-proxies`, and `consul-agent-servers` before initialization.

The current process is a bit messy at it requires a _partial_ bootstrap of the system, then a rolling restart while configurations are re-generated as the ACL system is brought online. At least this my take away from [this section](https://learn.hashicorp.com/consul/day-0/acl-guide#step-5-add-the-agent-token-to-all-the-servers).

This is a large amount of fiction, which seems unnecessary as the existing [`ServiceDefination`](https://github.com/hashicorp/consul/blob/5e1c6e907ba36b4eb68a8c62fa318abb28b08709/agent/config/config.go#L382) structure has fields for these values, and [`-token`](https://www.consul.io/docs/commands/connect/proxy.html#token-lt-value-gt-) allow for them to readily passed through.

But to my surprise when I try to create a bootstrap token

```sh
valarauca@valarauca:~/Documents/consul$ ./consul acl bootstrap
Failed ACL bootstrapping: Put http://127.0.0.1:8500/v1/acl/bootstrap: dial tcp 127.0.0.1:8500: connect: connection refused
```

_sigh_

---

Short of a full feature request, what code would need to be duplicated, or studied to simply provide "_valid tokens_" initially during bootstrap?

Where would these tokens need to be provided (so `consul-server` will store them in its "_pool_" during initialization)?

I'm aware this process isn't likely untested, unproven, and unstable. But I am nevertheless interested in making this work, and possibly assisting by contributing patches to ensure it works.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.