hashicorp / hashicorp/consul

Set agent tokens on an agent other than itself

Open
#7,972 6 comments 0 reactions 0 assignees View on GitHub
theme/acls type/enhancement type/umbrella-☂️
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Feature Description

Bootstrapping ACL is not an easy task. You must call `consul acl bootstrap`, create a token for all your node and set the agent token on them.
This means you have to call this [endpoint](https://www.consul.io/api-docs/agent#update-acl-tokens) (or `consul acl set-agent-token`) on each node.

It would simplify things if `v1/agent/token` (or maybe a new endpoint, for example `v1/operator/agent/token`) would optionally supports specifying the node on which we want to set the token.
Consul then forwards the request to the target agent.

#### Use Case(s)

- Possibility to improve `terraform-provider-consul` ACL support. See terraform-providers/terraform-provider-consul#197.
That's why I created this feature request. I think with this feature and terraform-providers/terraform-provider-consul#197, bootstrapping (and managing) your node tokens gets much easier and without the need of some manual work or glue scripts.
Extending the provider with node token support is already possible, but if you provision your whole cluster with terraform (for example on AWS), there is the problem that Terraform probably cannot access the API on all nodes.

- Allow to set agent tokens, without the need for a direct connection to the desired node.

- further prospects: set agent tokens trough UI

#### Research

I already did some reserch and came accross the following, how it could be possible to implement it:

1. Redirect the HTTP request to the leader via RPC and call the HTTP API of the the desired node from there
I think this is the way with the at least impact, but on the downside this feature is then dependant on the HTTP API for internal use.

2. Serf Event/Query. Documentation says `no guaranteed delivery`. Needs futher research.

I hope someone with more knowledge about Consul's internals can give me some feedback about this.

If you think this would be usefull and we find a good way to implement this, i am willing to contribute a patch.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.