Permissive mTLS: Config entry filtering and CLI warnings [OSS]

[pglass]

Description

This adds filtering for service-defaults: consul config list -filter 'MutualTLSMode == "permissive"'.

It adds CLI warnings when the CLI writes a config entry and sees that either service-defaults or proxy-defaults contains MutualTLSMode=permissive, or sees that the mesh config entry contains AllowEnablingPermissiveMutualTLSMode=true.

Testing & Reproduction steps

• consul agent -dev
• Then run the follow script:

Example script

echo
echo ">>> Write mesh config entry"
cat <<-EOF | consul config write -
Kind = "mesh"

AllowEnablingPermissiveMutualTLS = true
EOF

echo
echo ">>> Write proxy-defaults config entry"
cat <<-EOF | consul config write -
Kind = "proxy-defaults"
Name = "global"

mutual_tls_mode = "permissive"
EOF

echo
echo ">>> Write service-defaults config entry"
cat <<-EOF | consul config write -
Kind = "service-defaults"
Name = "web"

MutualTLSMode = "permissive"
EOF

Output

>>> Write mesh config entry
Config entry written: mesh/mesh
WARNING: AllowEnablingPermissiveMutualTLS=true allows insecure MutualTLSMode=permissive configurations in the proxy-defaults and service-defaults config entries. You can set AllowEnablingPermissiveMutualTLS=false at any time to disallow additional permissive configurations. To list services in permissive mode, run `consul config list -kind service-defaults -filter 'MutualTLSMode = "permissive"'`.

>>> Write proxy-defaults config entry
Config entry written: proxy-defaults/global
WARNING: MutualTLSMode=permissive is insecure. To keep your services secure, set MutualTLSMode to `strict` whenever possible and override with service-defaults only if necessary. To check which service-defaults are currently in permissive mode, run `consul config list -kind service-defaults -filter 'MutualTLSMode = "permissive"'`.

>>> Write service-defaults config entry
Config entry written: service-defaults/web
WARNING: MutualTLSMode=permissive is insecure. Set to `strict` when your service no longer needs to accept non-mTLS traffic. Check `tcp.permissive_public_listener` metrics in Envoy for non-mTLS traffic. Refer to Consul documentation for more information.

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

[cthain]

👍