Skip to content

server-acl-init: Create global ACL auth method for API Gateway in secondary dc #1481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nathancoleman merged 6 commits into from
Sep 16, 2022
Merged

server-acl-init: Create global ACL auth method for API Gateway in secondary dc #1481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
494e955
server-acl-init: Use global policy + auth method for API Gateway in s…
nathancoleman Sep 6, 2022
f1a9304
Update test assertions to expect global auth method + token
nathancoleman Sep 6, 2022
9a1ce78
Add changelog entry
nathancoleman Sep 6, 2022
5278eef
Update control-plane/subcommand/server-acl-init/command.go
nathancoleman Sep 14, 2022
433192f
Update CHANGELOG.md
nathancoleman Sep 15, 2022
1322a55
Merge branch 'main' into apigw-server-acl-init
nathancoleman Sep 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
## UNRELEASED

BUG FIXES:
* Control plane
* Use global ACL auth method to provision ACL tokens for API Gateway in secondary datacenter [[GH-1481](https://github.com/hashicorp/consul-k8s/pull/1481)]

## 0.48.0 (September 01, 2022)

FEATURES:
Expand Down
11 changes: 10 additions & 1 deletion control-plane/subcommand/server-acl-init/command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,7 +592,16 @@ func (c *Command) Run(args []string) int {
return 1
}
serviceAccountName := c.withPrefix("api-gateway-controller")
if err := c.createACLPolicyRoleAndBindingRule("api-gateway-controller", rules, consulDC, primaryDC, localPolicy, primary, localComponentAuthMethodName, serviceAccountName, consulClient); err != nil {

// API gateways require a global policy/token because they must
// create config-entry resources in the primary, even when deployed
// to a secondary datacenter
authMethodName := localComponentAuthMethodName
if !primary {
authMethodName = globalComponentAuthMethodName
}
err = c.createACLPolicyRoleAndBindingRule("api-gateway-controller", rules, consulDC, primaryDC, globalPolicy, primary, authMethodName, serviceAccountName, consulClient)
if err != nil {
c.log.Error(err.Error())
return 1
}
Expand Down
6 changes: 3 additions & 3 deletions control-plane/subcommand/server-acl-init/command_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2291,7 +2291,7 @@ func TestRun_PoliciesAndBindingRulesACLLogin_SecondaryDatacenter(t *testing.T) {
TokenFlags: []string{"-api-gateway-controller"},
PolicyNames: []string{"api-gateway-controller-policy-" + secondaryDatacenter},
Roles: []string{resourcePrefix + "-api-gateway-controller-acl-role-" + secondaryDatacenter},
GlobalAuthMethod: false,
GlobalAuthMethod: true,
},
{
TestName: "Snapshot Agent",
Expand Down Expand Up @@ -2599,8 +2599,8 @@ func TestRun_ValidateLoginToken_SecondaryDatacenter(t *testing.T) {
ComponentName: "api-gateway-controller",
TokenFlags: []string{"-api-gateway-controller"},
Roles: []string{resourcePrefix + "-api-gateway-controller-acl-role-dc2"},
GlobalAuthMethod: false,
GlobalToken: false,
GlobalAuthMethod: true,
GlobalToken: true,
},
{
ComponentName: "snapshot-agent",
Expand Down