luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Merge pull request #4917 from hashicorp/replication-token-cleanup 

Use acl replication_token for connect
This commit is contained in:
Kyle Havlovitz 2018-11-12 09:12:54 -08:00 committed by GitHub
parent 16f843bdf4 69a8d149d5
commit b0dcf54e50
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
9 changed files with 54 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
agent/config/builder.go
View File

@ -756,6 +756,7 @@ func (b *Builder) Build() (rt RuntimeConfig, err error) {
ConnectProxyDefaultDaemonCommand: proxyDefaultDaemonCommand, ConnectProxyDefaultDaemonCommand: proxyDefaultDaemonCommand,
ConnectProxyDefaultScriptCommand: proxyDefaultScriptCommand, ConnectProxyDefaultScriptCommand: proxyDefaultScriptCommand,
ConnectProxyDefaultConfig: proxyDefaultConfig, ConnectProxyDefaultConfig: proxyDefaultConfig,
ConnectReplicationToken: b.stringVal(c.ACL.Tokens.Replication),
DataDir: b.stringVal(c.DataDir), DataDir: b.stringVal(c.DataDir),
Datacenter: datacenter, Datacenter: datacenter,
DevMode: b.boolVal(b.Flags.DevMode), DevMode: b.boolVal(b.Flags.DevMode),

11
agent/config/config.go
View File

@ -499,12 +499,11 @@ type Upstream struct {
type Connect struct { type Connect struct {
// Enabled opts the agent into connect. It should be set on all clients and // Enabled opts the agent into connect. It should be set on all clients and
// servers in a cluster for correct connect operation. // servers in a cluster for correct connect operation.
Enabled *bool `json:"enabled,omitempty" hcl:"enabled" mapstructure:"enabled"` Enabled *bool `json:"enabled,omitempty" hcl:"enabled" mapstructure:"enabled"`
Proxy ConnectProxy `json:"proxy,omitempty" hcl:"proxy" mapstructure:"proxy"` Proxy ConnectProxy `json:"proxy,omitempty" hcl:"proxy" mapstructure:"proxy"`
ProxyDefaults ConnectProxyDefaults `json:"proxy_defaults,omitempty" hcl:"proxy_defaults" mapstructure:"proxy_defaults"` ProxyDefaults ConnectProxyDefaults `json:"proxy_defaults,omitempty" hcl:"proxy_defaults" mapstructure:"proxy_defaults"`
CAProvider *string `json:"ca_provider,omitempty" hcl:"ca_provider" mapstructure:"ca_provider"` CAProvider *string `json:"ca_provider,omitempty" hcl:"ca_provider" mapstructure:"ca_provider"`
CAConfig map[string]interface{} `json:"ca_config,omitempty" hcl:"ca_config" mapstructure:"ca_config"` CAConfig map[string]interface{} `json:"ca_config,omitempty" hcl:"ca_config" mapstructure:"ca_config"`
ReplicationToken *string `json:"replication_token,omitempty" hcl:"replication_token" mapstructure:"replication_token"`
} }
// ConnectProxy is the agent-global connect proxy configuration. // ConnectProxy is the agent-global connect proxy configuration.

1
agent/config/runtime_test.go
View File

@ -4143,6 +4143,7 @@ func TestFullConfig(t *testing.T) {
"connect_timeout_ms": float64(1000), "connect_timeout_ms": float64(1000),
"pedantic_mode": true, "pedantic_mode": true,
}, },
ConnectReplicationToken: "5795983a",
DNSAddrs: []net.Addr{tcpAddr("93.95.95.81:7001"), udpAddr("93.95.95.81:7001")}, DNSAddrs: []net.Addr{tcpAddr("93.95.95.81:7001"), udpAddr("93.95.95.81:7001")},
DNSARecordLimit: 29907, DNSARecordLimit: 29907,
DNSAllowStale: true, DNSAllowStale: true,

6
agent/connect/ca/provider_consul.go
View File

@ -623,9 +623,9 @@ func (c *ConsulProvider) generateCA(privateKey string, sn uint64) (string, error
serialNum := &big.Int{} serialNum := &big.Int{}
serialNum.SetUint64(sn) serialNum.SetUint64(sn)
template := x509.Certificate{ template := x509.Certificate{
SerialNumber: serialNum, SerialNumber: serialNum,
Subject: pkix.Name{CommonName: name}, Subject: pkix.Name{CommonName: name},
URIs: []*url.URL{id.URI()}, URIs: []*url.URL{id.URI()},
BasicConstraintsValid: true, BasicConstraintsValid: true,
KeyUsage: x509.KeyUsageCertSign | KeyUsage: x509.KeyUsageCertSign |
x509.KeyUsageCRLSign | x509.KeyUsageCRLSign |

6
agent/connect/testing_ca.go
View File

@ -53,9 +53,9 @@ func TestCA(t testing.T, xc *structs.CARoot) *structs.CARoot {
// Create the CA cert // Create the CA cert
template := x509.Certificate{ template := x509.Certificate{
SerialNumber: sn, SerialNumber: sn,
Subject: pkix.Name{CommonName: result.Name}, Subject: pkix.Name{CommonName: result.Name},
URIs: []*url.URL{id.URI()}, URIs: []*url.URL{id.URI()},
BasicConstraintsValid: true, BasicConstraintsValid: true,
KeyUsage: x509.KeyUsageCertSign | KeyUsage: x509.KeyUsageCertSign |
x509.KeyUsageCRLSign | x509.KeyUsageCRLSign |

4
agent/consul/state/prepared_query_test.go
View File

@ -11,8 +11,8 @@ import (
func TestStateStore_PreparedQuery_isUUID(t *testing.T) { func TestStateStore_PreparedQuery_isUUID(t *testing.T) {
cases := map[string]bool{ cases := map[string]bool{
"": false, "": false,
"nope": false, "nope": false,
"f004177f-2c28-83b7-4229-eacc25fe55d1": true, "f004177f-2c28-83b7-4229-eacc25fe55d1": true,
"F004177F-2C28-83B7-4229-EACC25FE55D1": true, "F004177F-2C28-83B7-4229-EACC25FE55D1": true,
"x004177f-2c28-83b7-4229-eacc25fe55d1": false, // Bad hex "x004177f-2c28-83b7-4229-eacc25fe55d1": false, // Bad hex

30
agent/structs/check_definition.go
View File

@ -64,21 +64,21 @@ func (c *CheckDefinition) CheckType() *CheckType {
Status: c.Status, Status: c.Status,
Notes: c.Notes, Notes: c.Notes,
ScriptArgs: c.ScriptArgs, ScriptArgs: c.ScriptArgs,
AliasNode: c.AliasNode, AliasNode: c.AliasNode,
AliasService: c.AliasService, AliasService: c.AliasService,
HTTP: c.HTTP, HTTP: c.HTTP,
GRPC: c.GRPC, GRPC: c.GRPC,
GRPCUseTLS: c.GRPCUseTLS, GRPCUseTLS: c.GRPCUseTLS,
Header: c.Header, Header: c.Header,
Method: c.Method, Method: c.Method,
TCP: c.TCP, TCP: c.TCP,
Interval: c.Interval, Interval: c.Interval,
DockerContainerID: c.DockerContainerID, DockerContainerID: c.DockerContainerID,
Shell: c.Shell, Shell: c.Shell,
TLSSkipVerify: c.TLSSkipVerify, TLSSkipVerify: c.TLSSkipVerify,
Timeout: c.Timeout, Timeout: c.Timeout,
TTL: c.TTL, TTL: c.TTL,
DeregisterCriticalServiceAfter: c.DeregisterCriticalServiceAfter, DeregisterCriticalServiceAfter: c.DeregisterCriticalServiceAfter,
} }
} }

40
agent/structs/check_definition_test.go
View File

@ -81,17 +81,17 @@ func TestCheckDefinitionToCheckType(t *testing.T) {
Status: "green", Status: "green",
Notes: "notes", Notes: "notes",
ServiceID: "svcid", ServiceID: "svcid",
Token: "tok", Token: "tok",
ScriptArgs: []string{"/bin/foo"}, ScriptArgs: []string{"/bin/foo"},
HTTP: "someurl", HTTP: "someurl",
TCP: "host:port", TCP: "host:port",
Interval: 1 * time.Second, Interval: 1 * time.Second,
DockerContainerID: "abc123", DockerContainerID: "abc123",
Shell: "/bin/ksh", Shell: "/bin/ksh",
TLSSkipVerify: true, TLSSkipVerify: true,
Timeout: 2 * time.Second, Timeout: 2 * time.Second,
TTL: 3 * time.Second, TTL: 3 * time.Second,
DeregisterCriticalServiceAfter: 4 * time.Second, DeregisterCriticalServiceAfter: 4 * time.Second,
} }
want := &CheckType{ want := &CheckType{
@ -100,15 +100,15 @@ func TestCheckDefinitionToCheckType(t *testing.T) {
Status: "green", Status: "green",
Notes: "notes", Notes: "notes",
ScriptArgs: []string{"/bin/foo"}, ScriptArgs: []string{"/bin/foo"},
HTTP: "someurl", HTTP: "someurl",
TCP: "host:port", TCP: "host:port",
Interval: 1 * time.Second, Interval: 1 * time.Second,
DockerContainerID: "abc123", DockerContainerID: "abc123",
Shell: "/bin/ksh", Shell: "/bin/ksh",
TLSSkipVerify: true, TLSSkipVerify: true,
Timeout: 2 * time.Second, Timeout: 2 * time.Second,
TTL: 3 * time.Second, TTL: 3 * time.Second,
DeregisterCriticalServiceAfter: 4 * time.Second, DeregisterCriticalServiceAfter: 4 * time.Second,
} }
verify.Values(t, "", got.CheckType(), want) verify.Values(t, "", got.CheckType(), want)

8
website/source/docs/agent/options.html.md
View File

@ -590,8 +590,10 @@ default will automatically work with some tooling.
The ACL token used to authorize secondary datacenters with the primary datacenter for replication The ACL token used to authorize secondary datacenters with the primary datacenter for replication
operations. This token is required for servers outside the [`primary_datacenter`](#primary_datacenter) when operations. This token is required for servers outside the [`primary_datacenter`](#primary_datacenter) when
ACLs are enabled. This token may be provided later using the [agent token API](/api/agent.html#update-acl-tokens) ACLs are enabled. This token may be provided later using the [agent token API](/api/agent.html#update-acl-tokens)
on each server. If the `replication` token is set in the config. This token must have at least "read" permissions on each server. This token must have at least "read" permissions on ACL data but if ACL
on ACL data but if ACL token replication is enabled then it must have "write" permissions. token replication is enabled then it must have "write" permissions. This also enables
Connect replication in Consul Enterprise, for which the token will require both operator
"write" and intention "read" permissions for replicating CA and Intention data.
* <a name="acl_datacenter"></a><a href="#acl_datacenter">`acl_datacenter`</a> - **This field is * <a name="acl_datacenter"></a><a href="#acl_datacenter">`acl_datacenter`</a> - **This field is
deprecated in Consul 1.4.0. See the [`primary_datacenter`](#primary_datacenter) field instead.** deprecated in Consul 1.4.0. See the [`primary_datacenter`](#primary_datacenter) field instead.**
@ -865,8 +867,6 @@ default will automatically work with some tooling.
* <a name="connect_proxy_defaults"></a><a href="#connect_proxy_defaults">`proxy_defaults`</a> [**Deprecated**](/docs/connect/proxies/managed-deprecated.html) This object configures the default proxy settings for service definitions with [managed proxies](/docs/connect/proxies/managed-deprecated.html) (now deprecated). It accepts the fields `exec_mode`, `daemon_command`, and `config`. These are used as default values for the respective fields in the service definition. * <a name="connect_proxy_defaults"></a><a href="#connect_proxy_defaults">`proxy_defaults`</a> [**Deprecated**](/docs/connect/proxies/managed-deprecated.html) This object configures the default proxy settings for service definitions with [managed proxies](/docs/connect/proxies/managed-deprecated.html) (now deprecated). It accepts the fields `exec_mode`, `daemon_command`, and `config`. These are used as default values for the respective fields in the service definition.
* <a name="replication_token"></a><a href="#replication_token">`replication_token`</a> When provided, this will enable Connect replication using this token to retrieve and replicate the Intentions to the non-authoritative local datacenter.
* <a name="datacenter"></a><a href="#datacenter">`datacenter`</a> Equivalent to the * <a name="datacenter"></a><a href="#datacenter">`datacenter`</a> Equivalent to the
[`-datacenter` command-line flag](#_datacenter). [`-datacenter` command-line flag](#_datacenter).