search

hashicorp / consul-k8s

First-class support for Consul Service Mesh on Kubernetes
https://www.consul.io/docs/k8s
Mozilla Public License 2.0
669 stars 322 forks source link

Document required ACLs for catalogSync #262

Open jamielennox opened 4 years ago

jamielennox commented 4 years ago

I'm connecting to an existing cluster that has ACLs enabled. Going through the documentation the website tells me: 

For Consul, if ACLs are configured on the cluster, a Consul ACL token will need to be provided. Review the ACL rules when creating this token so that it only allows the necessary privileges.

and links to a generic what is ACL page.

It'd be really helpful if you could document somewhere the ACL that is actually required to have consul-sync work. I know there are multiple pieces to this, but even a full working example with some comments that we could use as a starting point would be a lot of help.

lkysow commented 4 years ago

Hey Jamie, yeah we need to document this better. For now this file has the policies we use for everything: https://github.com/hashicorp/consul-k8s/blob/master/subcommand/server-acl-init/rules.go