Comments (5)
Hello @remilapeyre , Thank you for your reply, that helped and I confirm that it works as intended, I can write into KV and read from it too.
from terraform-provider-consul.
Hi @vasilij-icabbi, if I understand correctly your question, this will depend on the resources and data-sources you want to use and the ACL configuration of your cluster.
I would start with a token with all privileges removed and add them as you need them. If you want to know which ACL is needed for a given resource, you can look at the "ACL Required" in the corresponding Consul HTTP API documentation.
Does this answer your question?
from terraform-provider-consul.
@remilapeyre Thank you for your reply. I use Consul provider for configuration only, so it needed only for KV storage.
I created policy with rule:
{
"Name": "terraform-token",
"Description": "Terraform Token Policy",
"Rules": "key_prefix \"\" { policy = \"write\" }"
}
Created token, assigned policy with role above and provided it to terraform consul provider. And here it fails with 403.
Either I do something wrong or either consul provider does some API calls and requires more policy rules to function proper, this is why I ask if there are any minimal rules I have to set?
Worth to mention that my Consul ACL policy is deny by default.
from terraform-provider-consul.
Hello,
just checking if anyone can help me here?
from terraform-provider-consul.
Hi @vasilij-icabbi, thanks for the ping.
Terraform currently needs to read the configuration of the agent to know which datacenter it is connected to. Can you confirm that it works with this policy?
{
"Name": "terraform-token",
"Description": "Terraform Token Policy",
"Rules": "key_prefix \"\" { policy = \"write\" } agent_prefix \"\" { policy = \"read\" }"
}
If so I will look into removing this restriction.
from terraform-provider-consul.
Related Issues (20)
- [Feature Request] Native support for TFE/TFC workload identity HOT 1
- New release? HOT 4
- Access logs not able to be configured by consul_config_entry HOT 1
- consul_acl_role support policies by name HOT 5
- resource.consul_service "async" changes after creation HOT 1
- consul_service check_id isn't optional as documented in registry HOT 1
- resource consul_prepared_query doesn't support RemoveEmptyTags in template HOT 1
- New `consul_acl_role_policy_attachment` resource
- `config_entry` should ignore `Status` key when determining diffs HOT 1
- consul_acl_role_policy_attachment causes unresponsive plugin in v2.19.0 HOT 7
- consul_config_entry_service_defaults panics when actually specifying defaults
- consul_config_entry_service_resolver: Error: time: invalid duration "" HOT 1
- Consul Provider Unable to Read Role that exists
- Missing "tls_server_name" parameter in consul_service resource HOT 1
- Tagged addresses not available when creating terraform consul_service resource
- Support CRUD operations on templated-policy HOT 2
- feature request: `data "consul_agent_config_file"`
- consul_config_entry fails with http-route kind
- failed to delete 'service' config entry: discovery chain "service" uses inconsistent protocols HOT 1
- consul_acl_role_policy_attachment does not reliably get saved in state
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-provider-consul.