search

hashicorp / consul

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
https://www.consul.io
Other
28.33k stars 4.42k forks source link

consul command line arguments expose API tokens #1078

Closed mfischer-zd closed 6 years ago

mfischer-zd commented 9 years ago

the -token option is the only way to get consul lock to use a token to acquire a lock using the K/V store. This requires the token be specified on the command line, where it might be saved in a user's shell history file, and can be captured via ps(1).

Please add a -token_file argument as well so that it can be read from disk, or hide the value using setproctitle(3) or similar.

mfischer-zd commented 9 years ago

The same issue applies to the consul maint and consul watch subcommands.

ryanuber commented 9 years ago

@mfischer-zd thanks for opening this, makes sense to me. We use environment variables for a few other things, including the HTTP address and RPC address. I'm thinking we should do the same for the token with a CONSUL_TOKEN environment variable.

mfischer-zd commented 9 years ago

Any forward progress on this?

mfischer-zd commented 8 years ago

Over a year later.. any update?

slackpad commented 7 years ago

Sorry for the delay in getting to this one. As of 0.8.0 all CLI commands now support the https://www.consul.io/docs/commands/index.html#consul_http_token environment variable, which is a step in the right direction. Reading from a file is still open.

slackpad commented 6 years ago

Hi, adding support for reading from a file never made it on the roadmap, but support for an environment variable has been added everywhere in Consul. We would gladly review a PR for this functionality, but we are going to close this issue since it's not something we are going to implement ourselves.