open-consul/.changelog/15346.txt at 4bc89b823fc7dbef5106664cd1442cba36c7f41b - luxolus/open-consul - Stateless Git Forge

luxolus/open-consul

Dan Upton 4719b717ea

grpc/acl: relax permissions required for "core" endpoints (#15346 )

Previously, these endpoints required `service:write` permission on _any_
service as a sort of proxy for "is the caller allowed to participate in
the mesh?".

Now, they're called as part of the process of establishing a server
connection by any consumer of the consul-server-connection-manager
library, which will include non-mesh workloads (e.g. Consul KV as a
storage backend for Vault) as well as ancillary components such as
consul-k8s' acl-init process, which likely won't have `service:write`
permission.

So this commit relaxes those requirements to accept *any* valid ACL token
on the following gRPC endpoints:

- `hashicorp.consul.dataplane.DataplaneService/GetSupportedDataplaneFeatures`
- `hashicorp.consul.serverdiscovery.ServerDiscoveryService/WatchServers`
- `hashicorp.consul.connectca.ConnectCAService/WatchRoots`

2023-01-04 12:40:34 +00:00

4 lines

174 B

Plaintext

Raw Blame History

	```release-note:enhancement
	acl: relax permissions on the `WatchServers`, `WatchRoots` and `GetSupportedDataplaneFeatures` gRPC endpoints to accept any valid ACL token
	```