luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

docs: fix hcl use on production acls guide (#6739) 

Also clean up some general whitespace formatting.
This commit is contained in:
R.B. Boyer 2019-11-04 11:11:59 -06:00 committed by GitHub
parent 7081643191
commit 7994712731
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 52 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
website/source/docs/guides/production-acls.html.md
View File

@ -43,13 +43,13 @@ on them when you apply the token.
``` ```
# agent.hcl # agent.hcl
{ {
acl = { acl = {
enabled = true, enabled = true
default_policy = "deny", default_policy = "deny"
enable_token_persistence = true enable_token_persistence = true
} }
} }
``` ```
~> Note: Token persistence was introduced in Consul 1.4.3. In older versions ~> Note: Token persistence was introduced in Consul 1.4.3. In older versions
@ -122,9 +122,9 @@ example below has unrestricted privileges for node related actions for
``` ```
# consul-server-one-policy.hcl # consul-server-one-policy.hcl
node "consul-server-one" { node "consul-server-one" {
policy = "write" policy = "write"
} }
``` ```
When creating agent policies, review the [node rules]( When creating agent policies, review the [node rules](
@ -232,9 +232,9 @@ definition](https://www.consul.io/docs/agent/services.html).
```sh ```sh
# dashboard-policy.hcl # dashboard-policy.hcl
service "dashboard" { service "dashboard" {
policy = "write" policy = "write"
} }
``` ```
Use the policy definition to initiate the policy. Use the policy definition to initiate the policy.
@ -257,20 +257,20 @@ location.
Finally, add the token to the service definition. Finally, add the token to the service definition.
``` ```
{ {
"service": { "service": {
"name": "dashboard", "name": "dashboard",
"port": 9002, "port": 9002,
"token": "57c5d69a-5f19-469b-0543-12a487eecc66", "token": "57c5d69a-5f19-469b-0543-12a487eecc66",
"check": { "check": {
"id": "dashboard-check", "id": "dashboard-check",
"http": "http://localhost:9002/health", "http": "http://localhost:9002/health",
"method": "GET", "method": "GET",
"interval": "1s", "interval": "1s",
"timeout": "1s" "timeout": "1s"
} }
} }
} }
``` ```
If the service is running, you will need to restart it. Unlike with agent If the service is running, you will need to restart it. Unlike with agent
@ -301,16 +301,16 @@ nodes, and prepared queries.
``` ```
# dns-request-policy.hcl # dns-request-policy.hcl
node_prefix "" { node_prefix "" {
policy = "read" policy = "read"
} }
service_prefix "" { service_prefix "" {
policy = "read" policy = "read"
} }
# only needed if using prepared queries # only needed if using prepared queries
query_prefix "" { query_prefix "" {
policy = "read" policy = "read"
} }
``` ```
First, create the policy. First, create the policy.
@ -336,10 +336,9 @@ The data file must contain a valid token.
``` ```
# dns-token.json # dns-token.json
{ {
"Token":"5467d69a-5f19-469b-0543-12a487eecc66" "Token": "5467d69a-5f19-469b-0543-12a487eecc66"
} }
``` ```
Note, if you have multiple agents serving DNS requests you can use the same Note, if you have multiple agents serving DNS requests you can use the same
@ -370,9 +369,9 @@ operator will use the token when issuing commands, either with the CLI or API.
### Recursive Reads ### Recursive Reads
``` ```
key_prefix "redis/" { key_prefix "redis/" {
policy = "read" policy = "read"
} }
``` ```
In the above example, we are allowing any key with the prefix `redis/` to be In the above example, we are allowing any key with the prefix `redis/` to be
@ -387,8 +386,8 @@ same prefix would allow you to update any keys that begin with "redis/".
``` ```
key "dashboard-app" { key "dashboard-app" {
policy = "write" policy = "write"
} }
``` ```
In the above example, we are allowing read and write privileges to the In the above example, we are allowing read and write privileges to the
@ -401,9 +400,9 @@ keys.
### Read Privileges for One Key ### Read Privileges for One Key
``` ```
key "counting-app" { key "counting-app" {
policy = "read" policy = "read"
} }
``` ```
In the above example, we are setting a read privileges for a single key, In the above example, we are setting a read privileges for a single key,
@ -442,15 +441,15 @@ not even to view the token you used to access the UI.
``` ```
# operator-ui.hcl # operator-ui.hcl
service_prefix "" { service_prefix "" {
policy = "read" policy = "read"
} }
key_prefix "" { key_prefix "" {
policy = "read" policy = "read"
} }
node_prefix "" { node_prefix "" {
policy = "read" policy = "read"
} }
``` ```
## Summary ## Summary