consul_acl makes api call before ACL api is available

[reppard]

I get connection refused when trying to create/modify an acl policy via the consul_acl type. I was able to create one by hacking in a wait, showing it to be a timing issue:

  exec { 'wait_a_damn_minute' :                                                                                                                                                               
    command => "echo 'Waiting...' && sleep 30",                                                                                                                                               
    path  => "/usr/bin:/bin",                                                                                                                                                                 
  }                                                                                                                                                                                           

  consul_acl { 'anonymous':                                                                                                                                                                   
    ensure        => 'present',                                                                                                                                                               
    name          => 'Anonymous Token',                                                                                                                                                       
    acl_api_token => 'S3Cr3tStuFFs',                                                                                                                                                               
    rules => {                                                                                                                                                                                
      'key' => {                                                                                                                                                                              
        "" => {'policy'    => 'read'},                                                                                                                                                        
        '_rexec' => {'policy' => 'write'},                                                                                                                                                    
      }                                                                                                                                                                                       
    },                                                                                                                                                                                        
    type    => 'client',                                                                                                                                                                      
    require => Exec['wait_a_damn_minute'],                                                                                                                                                    
  }  

[aj-jester]

@reppard quick question, when you mean the API call is made before ACL api is available...is this happening right after consul has recently restarted? I can't imagine the API not being available during normal usage.

[reppard]

Yes this is on a new node. The service is started and the acl policy apply
is attempted directly after. The failing request is /v1/acl/list I believe.

[sigerber]

You need to have a leader elected before you can use the rest API. This is how we implemented bootstrapping a cluster with ACLS in an idempotent way.

exec { 'leader_elected':
  command     => "/usr/bin/test \"$(curl -s http://localhost:6500/v1/status/leader)\" != '\"\"'",
  tries       => 5,
  try_sleep   => 1,
  unless      => "/usr/bin/test \"$(curl -s http://localhost:6500/v1/status/leader)\" != '\"\"'",
}

Consul_acl <||> { require => Exec['leader_elected'] }