cdc4b20afa
A Node Identity is very similar to a service identity. Its main targeted use is to allow creating tokens for use by Consul agents that will grant the necessary permissions for all the typical agent operations (node registration, coordinate updates, anti-entropy). Half of this commit is for golden file based tests of the acl token and role cli output. Another big updates was to refactor many of the tests in agent/consul/acl_endpoint_test.go to use the same style of tests and the same helpers. Besides being less boiler plate in the tests it also uses a common way of starting a test server with ACLs that should operate without any warnings regarding deprecated non-uuid master tokens etc.
96 lines
2.1 KiB
Go
96 lines
2.1 KiB
Go
// +build !consulent
|
|
|
|
package structs
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/consul/acl"
|
|
)
|
|
|
|
const (
|
|
EnterpriseACLPolicyGlobalManagement = ""
|
|
|
|
// aclPolicyTemplateServiceIdentity is the template used for synthesizing
|
|
// policies for service identities.
|
|
aclPolicyTemplateServiceIdentity = `
|
|
service "%[1]s" {
|
|
policy = "write"
|
|
}
|
|
service "%[1]s-sidecar-proxy" {
|
|
policy = "write"
|
|
}
|
|
service_prefix "" {
|
|
policy = "read"
|
|
}
|
|
node_prefix "" {
|
|
policy = "read"
|
|
}`
|
|
|
|
// A typical Consul node requires two permissions for itself.
|
|
// node:write
|
|
// - register itself in the catalog
|
|
// - update its network coordinates
|
|
// - potentially used to delete services during anti-entropy
|
|
// service:read
|
|
// - used during anti-entropy to discover all services that
|
|
// are registered to the node. That way the node can diff
|
|
// its local state against an accurate depiction of the
|
|
// remote state.
|
|
aclPolicyTemplateNodeIdentity = `
|
|
node "%[1]s" {
|
|
policy = "write"
|
|
}
|
|
service_prefix "" {
|
|
policy = "read"
|
|
}`
|
|
)
|
|
|
|
type ACLAuthMethodEnterpriseFields struct{}
|
|
|
|
type ACLAuthMethodEnterpriseMeta struct{}
|
|
|
|
func (_ *ACLAuthMethodEnterpriseMeta) FillWithEnterpriseMeta(_ *EnterpriseMeta) {
|
|
// do nothing
|
|
}
|
|
|
|
func (_ *ACLAuthMethodEnterpriseMeta) ToEnterpriseMeta() *EnterpriseMeta {
|
|
return DefaultEnterpriseMeta()
|
|
}
|
|
|
|
func aclServiceIdentityRules(svc string, _ *EnterpriseMeta) string {
|
|
return fmt.Sprintf(aclPolicyTemplateServiceIdentity, svc)
|
|
}
|
|
|
|
func (p *ACLPolicy) EnterprisePolicyMeta() *acl.EnterprisePolicyMeta {
|
|
return nil
|
|
}
|
|
|
|
func (m *ACLAuthMethod) TargetEnterpriseMeta(_ *EnterpriseMeta) *EnterpriseMeta {
|
|
return &m.EnterpriseMeta
|
|
}
|
|
|
|
func (t *ACLToken) NodeIdentityList() []*ACLNodeIdentity {
|
|
if len(t.NodeIdentities) == 0 {
|
|
return nil
|
|
}
|
|
|
|
out := make([]*ACLNodeIdentity, 0, len(t.NodeIdentities))
|
|
for _, n := range t.NodeIdentities {
|
|
out = append(out, n.Clone())
|
|
}
|
|
return out
|
|
}
|
|
|
|
func (r *ACLRole) NodeIdentityList() []*ACLNodeIdentity {
|
|
if len(r.NodeIdentities) == 0 {
|
|
return nil
|
|
}
|
|
|
|
out := make([]*ACLNodeIdentity, 0, len(r.NodeIdentities))
|
|
for _, n := range r.NodeIdentities {
|
|
out = append(out, n.Clone())
|
|
}
|
|
return out
|
|
}
|