Connect Managed Proxy + ACL with default deny policy doesn't work #4441
Labels
theme/connect
Anything related to Consul Connect, Service Mesh, Side Car Proxies
type/bug
Feature does not function as expected
Milestone
Comments
banks
added
the
theme/connect
mkeeler
added a commit
that referenced
this issue
Jul 30, 2018
Fixes: #4441 This fixes the issue with Connect Managed Proxies + ACLs being broken. The underlying problem was that the token parsed for most http endpoints was sent untouched to the servers via the RPC request. These changes make it so that at the HTTP endpoint when parsing the token we additionally attempt to convert potential proxy tokens into regular tokens before sending to the RPC endpoint. Proxy tokens are only valid on the agent with the managed proxy so the resolution has to happen before it gets forwarded anywhere.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Overview of the Issue
When Consul starts a managed proxy it passes it a ProxyToken in the environment. This isn't a normal ACL token. It is an agent-local token tied to the proxy. The root cause of managed proxies not working with acls with a default deny policy is that many RPC endpoints aren't resolving proxy tokens but are just resolving regular tokens.
One in particular is the Health.ServiceNodes RPC endpoint. When querying /v1/health/connect/:service (as the managed proxy does) it attempts to lookup the proxy token as a regular token and fails.
Reproduction Steps
Steps to reproduce this issue, eg:
Log Fragments
The text was updated successfully, but these errors were encountered: