Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use global token for controller #369

Merged
merged 1 commit into from
Nov 5, 2020
Merged

Use global token for controller #369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
BUG FIXES:
* Federation: ensure replication ACL token can replicate policies and tokens in Consul namespaces other than `default` (Consul-enterprise only). [[GH-364](https://github.com/hashicorp/consul-k8s/issues/364)]
* CRDs: validate custom resources can only set namespace fields if Consul namespaces are enabled [[GH-375](https://github.com/hashicorp/consul-k8s/pull/375)]
* CRDs: Ensure ACL token is global so that secondary DCs can manage custom resources.
Without this fix, controllers running in secondary datacenters would get ACL errors. [[GH-369](https://github.com/hashicorp/consul-k8s/pull/369)]

## 0.19.0 (October 12, 2020)

Expand Down
5 changes: 4 additions & 1 deletion subcommand/server-acl-init/command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -666,7 +666,10 @@ func (c *Command) Run(args []string) int {
c.log.Error("Error templating controller token rules", "err", err)
return 1
}
err = c.createLocalACL("controller", rules, consulDC, consulClient)
// Controller token must be global because config entry writes all
// go to the primary datacenter. This means secondary datacenters need
// a token that is known by the primary datacenters.
err = c.createGlobalACL("controller", rules, consulDC, consulClient)
if err != nil {
c.log.Error(err.Error())
return 1
Expand Down
10 changes: 10 additions & 0 deletions subcommand/server-acl-init/command_ent_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,7 @@ func TestRun_ACLPolicyUpdates(t *testing.T) {
"-ingress-gateway-name=anothergw",
"-terminating-gateway-name=gw",
"-terminating-gateway-name=anothergw",
"-create-controller-token",
}
// Our second run, we're going to update from namespaces disabled to
// namespaces enabled with a single destination ns.
Expand Down Expand Up @@ -267,6 +268,7 @@ func TestRun_ACLPolicyUpdates(t *testing.T) {
"anothergw-ingress-gateway-token",
"gw-terminating-gateway-token",
"anothergw-terminating-gateway-token",
"controller-token",
}
policies, _, err := consul.ACL().PolicyList(nil)
require.NoError(err)
Expand Down Expand Up @@ -318,6 +320,7 @@ func TestRun_ACLPolicyUpdates(t *testing.T) {
"anothergw-ingress-gateway-token",
"gw-terminating-gateway-token",
"anothergw-terminating-gateway-token",
"controller-token",
}
policies, _, err = consul.ACL().PolicyList(nil)
require.NoError(err)
Expand Down Expand Up @@ -682,6 +685,13 @@ func TestRun_TokensWithNamespacesEnabled(t *testing.T) {
SecretNames: []string{resourcePrefix + "-connect-inject-acl-token"},
LocalToken: false,
},
"controller token": {
TokenFlags: []string{"-create-controller-token"},
PolicyNames: []string{"controller-token"},
PolicyDCs: nil,
SecretNames: []string{resourcePrefix + "-controller-acl-token"},
LocalToken: false,
},
}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We were missing a bunch of tests for these tokens.

for testName, c := range cases {
t.Run(testName, func(t *testing.T) {
Expand Down
18 changes: 16 additions & 2 deletions subcommand/server-acl-init/command_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,9 +233,9 @@ func TestRun_TokensPrimaryDC(t *testing.T) {
TestName: "Controller token",
TokenFlags: []string{"-create-controller-token"},
PolicyNames: []string{"controller-token"},
PolicyDCs: []string{"dc1"},
PolicyDCs: nil,
SecretNames: []string{resourcePrefix + "-controller-acl-token"},
LocalToken: true,
LocalToken: false,
},
{
TestName: "Health Checks ACL token",
Expand Down Expand Up @@ -400,6 +400,14 @@ func TestRun_TokensReplicatedDC(t *testing.T) {
SecretNames: []string{resourcePrefix + "-connect-inject-acl-token"},
LocalToken: true,
},
{
TestName: "Controller token",
TokenFlags: []string{"-create-controller-token"},
PolicyNames: []string{"controller-token-dc2"},
PolicyDCs: nil,
SecretNames: []string{resourcePrefix + "-controller-acl-token"},
LocalToken: false,
},
}
for _, c := range cases {
t.Run(c.TestName, func(t *testing.T) {
Expand Down Expand Up @@ -530,6 +538,12 @@ func TestRun_TokensWithProvidedBootstrapToken(t *testing.T) {
PolicyNames: []string{"connect-inject-token"},
SecretNames: []string{resourcePrefix + "-connect-inject-acl-token"},
},
{
TestName: "Controller token",
TokenFlags: []string{"-create-controller-token"},
PolicyNames: []string{"controller-token"},
SecretNames: []string{resourcePrefix + "-controller-acl-token"},
},
}
for _, c := range cases {
t.Run(c.TestName, func(t *testing.T) {
Expand Down