proxycfg: Lookup the agent token as a default
When no ACL token is provided with the service registration.
This commit is contained in:
parent
d189524e71
commit
7c865d03ac
|
@ -0,0 +1,3 @@
|
|||
```release-note:bug
|
||||
acl: fixes a bug that prevented the default user token from being used to authorize service registration for connect proxies.
|
||||
```
|
|
@ -559,6 +559,7 @@ func (a *Agent) Start(ctx context.Context) error {
|
|||
Health: a.rpcClientHealth,
|
||||
Logger: a.logger.Named(logging.ProxyConfig),
|
||||
State: a.State,
|
||||
Tokens: a.baseDeps.Tokens,
|
||||
Source: &structs.QuerySource{
|
||||
Datacenter: a.config.Datacenter,
|
||||
Segment: a.config.SegmentName,
|
||||
|
|
|
@ -9,6 +9,7 @@ import (
|
|||
"github.com/hashicorp/consul/agent/cache"
|
||||
"github.com/hashicorp/consul/agent/local"
|
||||
"github.com/hashicorp/consul/agent/structs"
|
||||
"github.com/hashicorp/consul/agent/token"
|
||||
"github.com/hashicorp/consul/tlsutil"
|
||||
)
|
||||
|
||||
|
@ -73,6 +74,9 @@ type ManagerConfig struct {
|
|||
// logger is the agent's logger to be used for logging logs.
|
||||
Logger hclog.Logger
|
||||
TLSConfigurator *tlsutil.Configurator
|
||||
// Tokens configured on the local agent. Used to look up the agent token if
|
||||
// a service is registered without a token.
|
||||
Tokens *token.Store
|
||||
|
||||
// IntentionDefaultAllow is set by the agent so that we can pass this
|
||||
// information to proxies that need to make intention decisions on their
|
||||
|
@ -156,7 +160,7 @@ func (m *Manager) syncState() {
|
|||
// know that so we'd need to set it here if not during registration of the
|
||||
// proxy service. Sidecar Service in the interim can do that, but we should
|
||||
// validate more generally that that is always true.
|
||||
err := m.ensureProxyServiceLocked(svc, m.State.ServiceToken(sid))
|
||||
err := m.ensureProxyServiceLocked(svc)
|
||||
if err != nil {
|
||||
m.Logger.Error("failed to watch proxy service",
|
||||
"service", sid.String(),
|
||||
|
@ -175,10 +179,18 @@ func (m *Manager) syncState() {
|
|||
}
|
||||
|
||||
// ensureProxyServiceLocked adds or changes the proxy to our state.
|
||||
func (m *Manager) ensureProxyServiceLocked(ns *structs.NodeService, token string) error {
|
||||
func (m *Manager) ensureProxyServiceLocked(ns *structs.NodeService) error {
|
||||
sid := ns.CompoundServiceID()
|
||||
state, ok := m.proxies[sid]
|
||||
|
||||
// Retrieve the token used to register the service, or fallback to the
|
||||
// default user token. This token is expected to match the token used in
|
||||
// the xDS request for this data.
|
||||
token := m.State.ServiceToken(sid)
|
||||
if token == "" {
|
||||
token = m.Tokens.UserToken()
|
||||
}
|
||||
|
||||
state, ok := m.proxies[sid]
|
||||
if ok {
|
||||
if !state.Changed(ns, token) {
|
||||
// No change
|
||||
|
|
|
@ -572,7 +572,7 @@ func TestManager_SyncState_DefaultToken(t *testing.T) {
|
|||
Cache: c,
|
||||
Health: &health.Client{Cache: c, CacheName: cachetype.HealthServicesName},
|
||||
State: state,
|
||||
// TODO: Tokens: tokens,
|
||||
Tokens: tokens,
|
||||
Source: &structs.QuerySource{Datacenter: "dc1"},
|
||||
Logger: logger,
|
||||
})
|
||||
|
|
Loading…
Reference in New Issue