Bootstrapping ACL's without a fully setup cluster?
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 43
Description
Hello!
I was wondering if there is a method to bootstrap tokens _before_ cluster initialization. Namely the token could be distributed to the `consul-agent-proxies`, and `consul-agent-servers` before initialization.
The current process is a bit messy at it requires a _partial_ bootstrap of the system, then a rolling restart while configurations are re-generated as the ACL system is brought online. At least this my take away from [this section](https://learn.hashicorp.com/consul/day-0/acl-guide#step-5-add-the-agent-token-to-all-the-servers).
This is a large amount of fiction, which seems unnecessary as the existing [`ServiceDefination`](https://github.com/hashicorp/consul/blob/5e1c6e907ba36b4eb68a8c62fa318abb28b08709/agent/config/config.go#L382) structure has fields for these values, and [`-token`](https://www.consul.io/docs/commands/connect/proxy.html#token-lt-value-gt-) allow for them to readily passed through.
But to my surprise when I try to create a bootstrap token
```sh
valarauca@valarauca:~/Documents/consul$ ./consul acl bootstrap
Failed ACL bootstrapping: Put http://127.0.0.1:8500/v1/acl/bootstrap: dial tcp 127.0.0.1:8500: connect: connection refused
```
_sigh_
---
Short of a full feature request, what code would need to be duplicated, or studied to simply provide "_valid tokens_" initially during bootstrap?
Where would these tokens need to be provided (so `consul-server` will store them in its "_pool_" during initialization)?
I'm aware this process isn't likely untested, unproven, and unstable. But I am nevertheless interested in making this work, and possibly assisting by contributing patches to ensure it works.
Contributor guide
Assessment
This issue has not been assessed yet.