search

hashicorp / consul

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
https://www.consul.io
Other
28.37k stars 4.42k forks source link

Service "name" registration blocked by ACLs #3774

Closed winmasta closed 6 years ago

winmasta commented 6 years ago

consul version for both Client and Server

Client: [1.0.2] Server: [1.0.2]

consul info for both Client and Server

To obtain this info I was forced to disable both ACLs because of permission denied.

Client:

{
  "Config": {
    "Datacenter": "test",
    "NodeName": "laptop",
    "Revision": "b55059f",
    "Server": false,
    "Version": "1.0.2"
  },
  "DebugConfig": {
    "ACLAgentMasterToken": "hidden",
    "ACLAgentToken": "hidden",
    "ACLDatacenter": "",
    "ACLDefaultPolicy": "allow",
    "ACLDisabledTTL": "2m0s",
    "ACLDownPolicy": "extend-cache",
    "ACLEnableKeyListPolicy": false,
    "ACLEnforceVersion8": true,
    "ACLMasterToken": "hidden",
    "ACLReplicationToken": "hidden",
    "ACLTTL": "30s",
    "ACLToken": "hidden",
    "AEInterval": "1m0s",
    "AdvertiseAddrLAN": "1.2.3.4",
    "AdvertiseAddrWAN": "1.2.3.4",
    "AutopilotCleanupDeadServers": true,
    "AutopilotDisableUpgradeMigration": false,
    "AutopilotLastContactThreshold": "200ms",
    "AutopilotMaxTrailingLogs": 250,
    "AutopilotRedundancyZoneTag": "",
    "AutopilotServerStabilizationTime": "10s",
    "AutopilotUpgradeVersionTag": "",
    "BindAddr": "0.0.0.0",
    "Bootstrap": false,
    "BootstrapExpect": 0,
    "CAFile": "/etc/consul.d/tls/ca.cert",
    "CAPath": "",
    "CertFile": "/etc/consul.d/tls/consul.cert",
    "CheckDeregisterIntervalMin": "1m0s",
    "CheckReapInterval": "30s",
    "CheckUpdateInterval": "5m0s",
    "Checks": [],
    "ClientAddrs": [
      "127.0.0.1"
    ],
    "ConsulCoordinateUpdateBatchSize": 128,
    "ConsulCoordinateUpdateMaxBatches": 5,
    "ConsulCoordinateUpdatePeriod": "5s",
    "ConsulRaftElectionTimeout": "5s",
    "ConsulRaftHeartbeatTimeout": "5s",
    "ConsulRaftLeaderLeaseTimeout": "2.5s",
    "ConsulSerfLANGossipInterval": "200ms",
    "ConsulSerfLANProbeInterval": "1s",
    "ConsulSerfLANProbeTimeout": "500ms",
    "ConsulSerfLANSuspicionMult": 4,
    "ConsulSerfWANGossipInterval": "500ms",
    "ConsulSerfWANProbeInterval": "5s",
    "ConsulSerfWANProbeTimeout": "3s",
    "ConsulSerfWANSuspicionMult": 6,
    "ConsulServerHealthInterval": "2s",
    "DNSAddrs": [
      "tcp://127.0.0.1:8600",
      "udp://127.0.0.1:8600"
    ],
    "DNSAllowStale": true,
    "DNSDisableCompression": false,
    "DNSDomain": "consul.",
    "DNSEnableTruncate": false,
    "DNSMaxStale": "87600h0m0s",
    "DNSNodeTTL": "0s",
    "DNSOnlyPassing": false,
    "DNSPort": 8600,
    "DNSRecursorTimeout": "2s",
    "DNSRecursors": [],
    "DNSServiceTTL": {},
    "DNSUDPAnswerLimit": 3,
    "DataDir": "/consul/data",
    "Datacenter": "test",
    "DevMode": false,
    "DisableAnonymousSignature": false,
    "DisableCoordinates": false,
    "DisableHostNodeID": true,
    "DisableKeyringFile": false,
    "DisableRemoteExec": true,
    "DisableUpdateCheck": false,
    "DiscardCheckOutput": false,
    "EnableACLReplication": false,
    "EnableAgentTLSForChecks": false,
    "EnableDebug": false,
    "EnableScriptChecks": false,
    "EnableSyslog": false,
    "EnableUI": false,
    "EncryptKey": "hidden",
    "EncryptVerifyIncoming": true,
    "EncryptVerifyOutgoing": true,
    "HTTPAddrs": [
      "tcp://127.0.0.1:8500"
    ],
    "HTTPBlockEndpoints": [],
    "HTTPPort": 8500,
    "HTTPResponseHeaders": {},
    "HTTPSAddrs": [],
    "HTTPSPort": -1,
    "KeyFile": "hidden",
    "LeaveDrainTime": "5s",
    "LeaveOnTerm": true,
    "LogLevel": "INFO",
    "NodeID": "9ed3ed70-24f7-ba3c-1cea-9fbea4a20b93",
    "NodeMeta": {},
    "NodeName": "laptop",
    "NonVotingServer": false,
    "PidFile": "",
    "RPCAdvertiseAddr": "tcp://1.2.3.4:8300",
    "RPCBindAddr": "tcp://0.0.0.0:8300",
    "RPCHoldTimeout": "7s",
    "RPCMaxBurst": 1000,
    "RPCProtocol": 2,
    "RPCRateLimit": -1,
    "RaftProtocol": 0,
    "ReconnectTimeoutLAN": "0s",
    "ReconnectTimeoutWAN": "0s",
    "RejoinAfterLeave": false,
    "RetryJoinIntervalLAN": "30s",
    "RetryJoinIntervalWAN": "30s",
    "RetryJoinLAN": [
      "5.6.7.8"
    ],
    "RetryJoinMaxAttemptsLAN": 0,
    "RetryJoinMaxAttemptsWAN": 0,
    "RetryJoinWAN": [],
    "Revision": "b55059f",
    "SegmentLimit": 64,
    "SegmentName": "",
    "SegmentNameLimit": 64,
    "Segments": [],
    "SerfAdvertiseAddrLAN": "tcp://1.2.3.4:8301",
    "SerfAdvertiseAddrWAN": "tcp://1.2.3.4:8302",
    "SerfBindAddrLAN": "tcp://0.0.0.0:8301",
    "SerfBindAddrWAN": "tcp://0.0.0.0:8302",
    "SerfPortLAN": 8301,
    "SerfPortWAN": 8302,
    "ServerMode": false,
    "ServerName": "",
    "ServerPort": 8300,
    "Services": [
      {
        "Address": "",
        "Check": {
          "CheckID": "",
          "DeregisterCriticalServiceAfter": "0s",
          "DockerContainerID": "",
          "HTTP": "",
          "Header": {},
          "Interval": "0s",
          "Method": "",
          "Name": "",
          "Notes": "",
          "Script": "",
          "ScriptArgs": [],
          "Shell": "",
          "Status": "",
          "TCP": "",
          "TLSSkipVerify": false,
          "TTL": "0s",
          "Timeout": "0s"
        },
        "Checks": [],
        "EnableTagOverride": false,
        "ID": "",
        "Name": "mgmt-test",
        "Port": 0,
        "Tags": [
          "tag"
        ],
        "Token": "hidden"
      }
    ],
    "SessionTTLMin": "0s",
    "SkipLeaveOnInt": false,
    "StartJoinAddrsLAN": [],
    "StartJoinAddrsWAN": [],
    "SyncCoordinateIntervalMin": "15s",
    "SyncCoordinateRateTarget": 64,
    "SyslogFacility": "LOCAL0",
    "TLSCipherSuites": [],
    "TLSMinVersion": "tls10",
    "TLSPreferServerCipherSuites": false,
    "TaggedAddresses": {
      "lan": "1.2.3.4",
      "wan": "1.2.3.4"
    },
    "TelemetryAllowedPrefixes": [],
    "TelemetryBlockedPrefixes": [
      "consul.consul"
    ],
    "TelemetryCirconusAPIApp": "",
    "TelemetryCirconusAPIToken": "hidden",
    "TelemetryCirconusAPIURL": "",
    "TelemetryCirconusBrokerID": "",
    "TelemetryCirconusBrokerSelectTag": "",
    "TelemetryCirconusCheckDisplayName": "",
    "TelemetryCirconusCheckForceMetricActivation": "",
    "TelemetryCirconusCheckID": "",
    "TelemetryCirconusCheckInstanceID": "",
    "TelemetryCirconusCheckSearchTag": "",
    "TelemetryCirconusCheckTags": "",
    "TelemetryCirconusSubmissionInterval": "",
    "TelemetryCirconusSubmissionURL": "",
    "TelemetryDisableHostname": false,
    "TelemetryDogstatsdAddr": "",
    "TelemetryDogstatsdTags": [],
    "TelemetryFilterDefault": true,
    "TelemetryMetricsPrefix": "consul",
    "TelemetryStatsdAddr": "",
    "TelemetryStatsiteAddr": "",
    "TranslateWANAddrs": false,
    "UIDir": "",
    "UnixSocketGroup": "",
    "UnixSocketMode": "",
    "UnixSocketUser": "",
    "VerifyIncoming": true,
    "VerifyIncomingHTTPS": false,
    "VerifyIncomingRPC": false,
    "VerifyOutgoing": true,
    "VerifyServerHostname": false,
    "Version": "1.0.2",
    "VersionPrerelease": "",
    "Watches": []
  },
  "Coord": {
    "Vec": [
      -0.21391030850866227,
      0.08019957039539499,
      -0.1604764839819527,
      -0.04241962973167556,
      -0.0006579089287141544,
      -0.036864341145137244,
      -0.00039872228329441045,
      -0.11041046562806833
    ],
    "Error": 0.3248940186754195,
    "Adjustment": -0.003579409448015474,
    "Height": 0.0002695074300294771
  },
  "Member": {
    "Name": "laptop",
    "Addr": "1.2.3.4",
    "Port": 8301,
    "Tags": {
      "build": "1.0.2:b55059f",
      "dc": "test",
      "id": "9ed3ed70-24f7-ba3c-1cea-9fbea4a20b93",
      "role": "node",
      "segment": "",
      "vsn": "2",
      "vsn_max": "3",
      "vsn_min": "2"
    },
    "Status": 1,
    "ProtocolMin": 1,
    "ProtocolMax": 5,
    "ProtocolCur": 2,
    "DelegateMin": 2,
    "DelegateMax": 5,
    "DelegateCur": 4
  },
  "Stats": {
    "agent": {
      "check_monitors": "0",
      "check_ttls": "0",
      "checks": "0",
      "services": "1"
    },
    "build": {
      "prerelease": "",
      "revision": "b55059f",
      "version": "1.0.2"
    },
    "consul": {
      "known_servers": "1",
      "server": "false"
    },
    "runtime": {
      "arch": "amd64",
      "cpu_count": "4",
      "goroutines": "39",
      "max_procs": "4",
      "os": "linux",
      "version": "go1.9.2"
    },
    "serf_lan": {
      "coordinate_resets": "0",
      "encrypted": "true",
      "event_queue": "0",
      "event_time": "5",
      "failed": "0",
      "health_score": "0",
      "intent_queue": "0",
      "left": "0",
      "member_time": "18",
      "members": "2",
      "query_queue": "0",
      "query_time": "1"
    }
  },
  "Meta": {
    "consul-network-segment": ""
  }
}

Server:

{
  "Config": {
    "Datacenter": "test",
    "NodeName": "consul-test",
    "Revision": "b55059f",
    "Server": true,
    "Version": "1.0.2"
  },
  "DebugConfig": {
    "ACLAgentMasterToken": "hidden",
    "ACLAgentToken": "hidden",
    "ACLDatacenter": "",
    "ACLDefaultPolicy": "allow",
    "ACLDisabledTTL": "2m0s",
    "ACLDownPolicy": "extend-cache",
    "ACLEnableKeyListPolicy": false,
    "ACLEnforceVersion8": true,
    "ACLMasterToken": "hidden",
    "ACLReplicationToken": "hidden",
    "ACLTTL": "30s",
    "ACLToken": "hidden",
    "AEInterval": "1m0s",
    "AdvertiseAddrLAN": "5.6.7.8",
    "AdvertiseAddrWAN": "5.6.7.8",
    "AutopilotCleanupDeadServers": true,
    "AutopilotDisableUpgradeMigration": false,
    "AutopilotLastContactThreshold": "200ms",
    "AutopilotMaxTrailingLogs": 250,
    "AutopilotRedundancyZoneTag": "",
    "AutopilotServerStabilizationTime": "10s",
    "AutopilotUpgradeVersionTag": "",
    "BindAddr": "5.6.7.8",
    "Bootstrap": true,
    "BootstrapExpect": 0,
    "CAFile": "/etc/consul.d/ssl/ca.cert",
    "CAPath": "",
    "CertFile": "/etc/consul.d/ssl/consul.cert",
    "CheckDeregisterIntervalMin": "1m0s",
    "CheckReapInterval": "30s",
    "CheckUpdateInterval": "5m0s",
    "Checks": [],
    "ClientAddrs": [
      "5.6.7.8"
    ],
    "ConsulCoordinateUpdateBatchSize": 128,
    "ConsulCoordinateUpdateMaxBatches": 5,
    "ConsulCoordinateUpdatePeriod": "5s",
    "ConsulRaftElectionTimeout": "5s",
    "ConsulRaftHeartbeatTimeout": "5s",
    "ConsulRaftLeaderLeaseTimeout": "2.5s",
    "ConsulSerfLANGossipInterval": "200ms",
    "ConsulSerfLANProbeInterval": "1s",
    "ConsulSerfLANProbeTimeout": "500ms",
    "ConsulSerfLANSuspicionMult": 4,
    "ConsulSerfWANGossipInterval": "500ms",
    "ConsulSerfWANProbeInterval": "5s",
    "ConsulSerfWANProbeTimeout": "3s",
    "ConsulSerfWANSuspicionMult": 6,
    "ConsulServerHealthInterval": "2s",
    "DNSAddrs": [
      "tcp://5.6.7.8:8600",
      "udp://5.6.7.8:8600"
    ],
    "DNSAllowStale": true,
    "DNSDisableCompression": false,
    "DNSDomain": "consul.",
    "DNSEnableTruncate": false,
    "DNSMaxStale": "87600h0m0s",
    "DNSNodeTTL": "0s",
    "DNSOnlyPassing": false,
    "DNSPort": 8600,
    "DNSRecursorTimeout": "2s",
    "DNSRecursors": [],
    "DNSServiceTTL": {},
    "DNSUDPAnswerLimit": 3,
    "DataDir": "/consul/data",
    "Datacenter": "test",
    "DevMode": false,
    "DisableAnonymousSignature": false,
    "DisableCoordinates": false,
    "DisableHostNodeID": true,
    "DisableKeyringFile": false,
    "DisableRemoteExec": true,
    "DisableUpdateCheck": false,
    "DiscardCheckOutput": false,
    "EnableACLReplication": false,
    "EnableAgentTLSForChecks": false,
    "EnableDebug": false,
    "EnableScriptChecks": false,
    "EnableSyslog": false,
    "EnableUI": true,
    "EncryptKey": "hidden",
    "EncryptVerifyIncoming": true,
    "EncryptVerifyOutgoing": true,
    "HTTPAddrs": [
      "tcp://5.6.7.8:8500"
    ],
    "HTTPBlockEndpoints": [],
    "HTTPPort": 8500,
    "HTTPResponseHeaders": {},
    "HTTPSAddrs": [],
    "HTTPSPort": -1,
    "KeyFile": "hidden",
    "LeaveDrainTime": "5s",
    "LeaveOnTerm": false,
    "LogLevel": "INFO",
    "NodeID": "dc81987f-8d79-60f7-7aba-548fdbaba794",
    "NodeMeta": {},
    "NodeName": "consul-test",
    "NonVotingServer": false,
    "PidFile": "",
    "RPCAdvertiseAddr": "tcp://5.6.7.8:8300",
    "RPCBindAddr": "tcp://5.6.7.8:8300",
    "RPCHoldTimeout": "7s",
    "RPCMaxBurst": 1000,
    "RPCProtocol": 2,
    "RPCRateLimit": -1,
    "RaftProtocol": 0,
    "ReconnectTimeoutLAN": "0s",
    "ReconnectTimeoutWAN": "0s",
    "RejoinAfterLeave": false,
    "RetryJoinIntervalLAN": "30s",
    "RetryJoinIntervalWAN": "30s",
    "RetryJoinLAN": [],
    "RetryJoinMaxAttemptsLAN": 0,
    "RetryJoinMaxAttemptsWAN": 0,
    "RetryJoinWAN": [],
    "Revision": "b55059f",
    "SegmentLimit": 64,
    "SegmentName": "",
    "SegmentNameLimit": 64,
    "Segments": [],
    "SerfAdvertiseAddrLAN": "tcp://5.6.7.8:8301",
    "SerfAdvertiseAddrWAN": "tcp://5.6.7.8:8302",
    "SerfBindAddrLAN": "tcp://5.6.7.8:8301",
    "SerfBindAddrWAN": "tcp://5.6.7.8:8302",
    "SerfPortLAN": 8301,
    "SerfPortWAN": 8302,
    "ServerMode": true,
    "ServerName": "",
    "ServerPort": 8300,
    "Services": [
      {
        "Address": "",
        "Check": {
          "CheckID": "",
          "DeregisterCriticalServiceAfter": "0s",
          "DockerContainerID": "",
          "HTTP": "",
          "Header": {},
          "Interval": "0s",
          "Method": "",
          "Name": "",
          "Notes": "",
          "Script": "",
          "ScriptArgs": [],
          "Shell": "",
          "Status": "",
          "TCP": "",
          "TLSSkipVerify": false,
          "TTL": "0s",
          "Timeout": "0s"
        },
        "Checks": [],
        "EnableTagOverride": false,
        "ID": "",
        "Name": "consul-test",
        "Port": 0,
        "Tags": [
          "consul"
        ],
        "Token": "hidden"
      }
    ],
    "SessionTTLMin": "0s",
    "SkipLeaveOnInt": true,
    "StartJoinAddrsLAN": [],
    "StartJoinAddrsWAN": [],
    "SyncCoordinateIntervalMin": "15s",
    "SyncCoordinateRateTarget": 64,
    "SyslogFacility": "LOCAL0",
    "TLSCipherSuites": [],
    "TLSMinVersion": "tls10",
    "TLSPreferServerCipherSuites": false,
    "TaggedAddresses": {
      "lan": "5.6.7.8",
      "wan": "5.6.7.8"
    },
    "TelemetryAllowedPrefixes": [],
    "TelemetryBlockedPrefixes": [
      "consul.consul"
    ],
    "TelemetryCirconusAPIApp": "",
    "TelemetryCirconusAPIToken": "hidden",
    "TelemetryCirconusAPIURL": "",
    "TelemetryCirconusBrokerID": "",
    "TelemetryCirconusBrokerSelectTag": "",
    "TelemetryCirconusCheckDisplayName": "",
    "TelemetryCirconusCheckForceMetricActivation": "",
    "TelemetryCirconusCheckID": "",
    "TelemetryCirconusCheckInstanceID": "",
    "TelemetryCirconusCheckSearchTag": "",
    "TelemetryCirconusCheckTags": "",
    "TelemetryCirconusSubmissionInterval": "",
    "TelemetryCirconusSubmissionURL": "",
    "TelemetryDisableHostname": false,
    "TelemetryDogstatsdAddr": "",
    "TelemetryDogstatsdTags": [],
    "TelemetryFilterDefault": true,
    "TelemetryMetricsPrefix": "consul",
    "TelemetryStatsdAddr": "",
    "TelemetryStatsiteAddr": "",
    "TranslateWANAddrs": false,
    "UIDir": "",
    "UnixSocketGroup": "",
    "UnixSocketMode": "",
    "UnixSocketUser": "",
    "VerifyIncoming": true,
    "VerifyIncomingHTTPS": false,
    "VerifyIncomingRPC": false,
    "VerifyOutgoing": true,
    "VerifyServerHostname": false,
    "Version": "1.0.2",
    "VersionPrerelease": "",
    "Watches": []
  },
  "Coord": {
    "Vec": [
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "Error": 1.5,
    "Adjustment": 0,
    "Height": 1e-05
  },
  "Member": {
    "Name": "consul-test",
    "Addr": "5.6.7.8",
    "Port": 8301,
    "Tags": {
      "bootstrap": "1",
      "build": "1.0.2:b55059f",
      "dc": "test",
      "id": "dc81987f-8d79-60f7-7aba-548fdbaba794",
      "port": "8300",
      "raft_vsn": "3",
      "role": "consul",
      "segment": "",
      "use_tls": "1",
      "vsn": "2",
      "vsn_max": "3",
      "vsn_min": "2",
      "wan_join_port": "8302"
    },
    "Status": 1,
    "ProtocolMin": 1,
    "ProtocolMax": 5,
    "ProtocolCur": 2,
    "DelegateMin": 2,
    "DelegateMax": 5,
    "DelegateCur": 4
  },
  "Stats": {
    "agent": {
      "check_monitors": "0",
      "check_ttls": "0",
      "checks": "0",
      "services": "1"
    },
    "build": {
      "prerelease": "",
      "revision": "b55059f",
      "version": "1.0.2"
    },
    "consul": {
      "bootstrap": "true",
      "known_datacenters": "1",
      "leader": "true",
      "leader_addr": "5.6.7.8:8300",
      "server": "true"
    },
    "raft": {
      "applied_index": "494",
      "commit_index": "494",
      "fsm_pending": "0",
      "last_contact": "0",
      "last_log_index": "494",
      "last_log_term": "5",
      "last_snapshot_index": "0",
      "last_snapshot_term": "0",
      "latest_configuration": "[{Suffrage:Voter ID:dc81987f-8d79-60f7-7aba-548fdbaba794 Address:5.6.7.8:8300}]",
      "latest_configuration_index": "1",
      "num_peers": "0",
      "protocol_version": "3",
      "protocol_version_max": "3",
      "protocol_version_min": "0",
      "snapshot_version_max": "1",
      "snapshot_version_min": "0",
      "state": "Leader",
      "term": "5"
    },
    "runtime": {
      "arch": "amd64",
      "cpu_count": "1",
      "goroutines": "79",
      "max_procs": "1",
      "os": "linux",
      "version": "go1.9.2"
    },
    "serf_lan": {
      "coordinate_resets": "0",
      "encrypted": "true",
      "event_queue": "0",
      "event_time": "5",
      "failed": "1",
      "health_score": "7",
      "intent_queue": "0",
      "left": "0",
      "member_time": "18",
      "members": "2",
      "query_queue": "0",
      "query_time": "1"
    },
    "serf_wan": {
      "coordinate_resets": "0",
      "encrypted": "true",
      "event_queue": "0",
      "event_time": "1",
      "failed": "0",
      "health_score": "0",
      "intent_queue": "0",
      "left": "0",
      "member_time": "1",
      "members": "1",
      "query_queue": "0",
      "query_time": "1"
    }
  },
  "Meta": {
    "consul-network-segment": ""
  }
}

Operating system and Environment details

Server (docker inspect): 

[
    {
        "Id": "cfa56d3213366f670cf11f9188636952f439c17ae627d45469b510ca72151e4f",
        "Created": "2017-12-30T10:04:24.030243824Z",
        "Path": "docker-entrypoint.sh",
        "Args": [
            "agent",
            "-ui",
            "-bind=5.6.7.8",
            "-client=5.6.7.8"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 13165,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2017-12-30T10:44:48.533015707Z",
            "FinishedAt": "2017-12-30T10:44:28.077448077Z"
        },
        "Image": "sha256:5c88a9c787af1fb65b6d2cb371a86eb0d16900cf12334e488e7d17efa54f1d26",
        "ResolvConfPath": "/var/lib/docker/containers/cfa56d3213366f670cf11f9188636952f439c17ae627d45469b510ca72151e4f/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/cfa56d3213366f670cf11f9188636952f439c17ae627d45469b510ca72151e4f/hostname",
        "HostsPath": "/var/lib/docker/containers/cfa56d3213366f670cf11f9188636952f439c17ae627d45469b510ca72151e4f/hosts",
        "LogPath": "/var/lib/docker/containers/cfa56d3213366f670cf11f9188636952f439c17ae627d45469b510ca72151e4f/cfa56d3213366f670cf11f9188636952f439c17ae627d45469b510ca72151e4f-json.log",
        "Name": "/consul",
        "RestartCount": 0,
        "Driver": "aufs",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": [
                "/etc/consul.d:/consul/config",
                "/etc/consul.d/ssl:/etc/consul.d/ssl"
            ],
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "host",
            "PortBindings": {
                "8500/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": "8500"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "unless-stopped",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": null,
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": -1,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0
        },
        "GraphDriver": {
            "Name": "aufs",
            "Data": null
        },
        "Mounts": [
            {
                "Type": "bind",
                "Source": "/etc/consul.d/ssl",
                "Destination": "/etc/consul.d/ssl",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "volume",
                "Name": "33a0f48a7c8a81da1548ecb216b273c5f2f8d6461ea6775b00126b7ebad93dcb",
                "Source": "/var/lib/docker/volumes/33a0f48a7c8a81da1548ecb216b273c5f2f8d6461ea6775b00126b7ebad93dcb/_data",
                "Destination": "/consul/data",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "bind",
                "Source": "/etc/consul.d",
                "Destination": "/consul/config",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "consul-test",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "8300/tcp": {},
                "8301/tcp": {},
                "8301/udp": {},
                "8302/tcp": {},
                "8302/udp": {},
                "8500/tcp": {},
                "8600/tcp": {},
                "8600/udp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "CONSUL_VERSION=1.0.2",
                "HASHICORP_RELEASES=https://releases.hashicorp.com"
            ],
            "Cmd": [
                "agent",
                "-ui",
                "-bind=5.6.7.8",
                "-client=5.6.7.8"
            ],
            "Image": "consul",
            "Volumes": {
                "/consul/data": {}
            },
            "WorkingDir": "",
            "Entrypoint": [
                "docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {}
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "467ad025a24c757334c90cdca58d1a48a439cd8f1e0d03f0d2b83fe606751b4c",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {},
            "SandboxKey": "/var/run/docker/netns/default",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "",
            "Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "MacAddress": "",
            "Networks": {
                "host": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "bfe09bdbfde415b44d6db9c7d88c97badc1f7e0879d06bd9cfa57fa25bb95e55",
                    "EndpointID": "4d379a81c2bc95f952db1ac481a88d3832d17766cfa459daf9e6897cbdda92bd",
                    "Gateway": "",
                    "IPAddress": "",
                    "IPPrefixLen": 0,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": ""
                }
            }
        }
    }
]

Client (docker inspect):

[
    {
        "Id": "807bf0610b7fdb3daea9a0102465ff4ab8ebda8e133a04613169ea80824a1b13",
        "Created": "2017-12-30T10:32:20.477917762Z",
        "Path": "docker-entrypoint.sh",
        "Args": [
            "agent"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 28653,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2017-12-30T10:46:21.761552885Z",
            "FinishedAt": "2017-12-30T10:46:10.7329204Z"
        },
        "Image": "sha256:5c88a9c787af1fb65b6d2cb371a86eb0d16900cf12334e488e7d17efa54f1d26",
        "ResolvConfPath": "/var/lib/docker/containers/807bf0610b7fdb3daea9a0102465ff4ab8ebda8e133a04613169ea80824a1b13/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/807bf0610b7fdb3daea9a0102465ff4ab8ebda8e133a04613169ea80824a1b13/hostname",
        "HostsPath": "/var/lib/docker/containers/807bf0610b7fdb3daea9a0102465ff4ab8ebda8e133a04613169ea80824a1b13/hosts",
        "LogPath": "/var/lib/docker/containers/807bf0610b7fdb3daea9a0102465ff4ab8ebda8e133a04613169ea80824a1b13/807bf0610b7fdb3daea9a0102465ff4ab8ebda8e133a04613169ea80824a1b13-json.log",
        "Name": "/consul-test",
        "RestartCount": 0,
        "Driver": "aufs",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": [
                "/etc/consul-test.d:/consul/config",
                "/etc/consul-test.d/tls:/etc/consul.d/tls"
            ],
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "host",
            "PortBindings": {},
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": null,
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": -1,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0
        },
        "GraphDriver": {
            "Name": "aufs",
            "Data": null
        },
        "Mounts": [
            {
                "Type": "bind",
                "Source": "/etc/consul-test.d",
                "Destination": "/consul/config",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "bind",
                "Source": "/etc/consul-test.d/tls",
                "Destination": "/etc/consul.d/tls",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "volume",
                "Name": "bd62763108c4fc27be2e5bfb4e678d38438b9e42ebc64a6141993aca7af13465",
                "Source": "/var/lib/docker/volumes/bd62763108c4fc27be2e5bfb4e678d38438b9e42ebc64a6141993aca7af13465/_data",
                "Destination": "/consul/data",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "laptop",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "8300/tcp": {},
                "8301/tcp": {},
                "8301/udp": {},
                "8302/tcp": {},
                "8302/udp": {},
                "8500/tcp": {},
                "8600/tcp": {},
                "8600/udp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "CONSUL_VERSION=1.0.2",
                "HASHICORP_RELEASES=https://releases.hashicorp.com"
            ],
            "Cmd": [
                "agent"
            ],
            "Image": "consul",
            "Volumes": {
                "/consul/data": {}
            },
            "WorkingDir": "",
            "Entrypoint": [
                "docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {}
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "8d14bcee8767f8aee6a5e73c08e0382bfa08d4cc805b3aee969eea524582de1c",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {},
            "SandboxKey": "/var/run/docker/netns/default",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "",
            "Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "MacAddress": "",
            "Networks": {
                "host": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "7292fdedcf0c363b007b68bce0a15a02ccfea5f2940fec2125804ee2a2ecd18d",
                    "EndpointID": "2c5169d4f5a50c61b718c4878cec56ccdd5dbc4be76d60e353a73f8526b0a411",
                    "Gateway": "",
                    "IPAddress": "",
                    "IPPrefixLen": 0,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": ""
                }
            }
        }
    }
]

Description of the Issue (and unexpected/desired result)

Service registration blocked by ACL but it shouldn't.

Reproduction steps

  1. Master token created curl -X PUT http://5.6.7.8:8500/v1/acl/bootstrap

2.ACL agent token created curl -X PUT -H "X-Consul-Token: 2dac2892-cd4b-339e-9616-8e69cf38c37b" -d '{"Name": "Agent Token","Type": "client","Rules": "node \"\" { policy = \"write\" } service \"\" { policy = \"write\" } key \"\" { policy = \"write\" } "}' http://5.6.7.8:8500/v1/acl/create

  1. Introduced ACL agent tocen on consul server curl -X PUT -H "X-Consul-Token: 2dac2892-cd4b-339e-9616-8e69cf38c37b" -d '{"Token": "5df79abf-87ab-2341-36ae-cf2a6f60cbdf"}' http://5.6.7.8:8500/v1/agent/token/acl_agent_token

  2. Introduced ACL token on consul client curl -X PUT -H "X-Consul-Token: 2dac2892-cd4b-339e-9616-8e69cf38c37b" -d '{"Token": "5df79abf-87ab-2341-36ae-cf2a6f60cbdf"}' http://127.0.0.1:8500/v1/agent/token/acl_agent_token

  3. Consul derver docker container restarted.

  4. Consul client docker container restarted.

Log Fragments or Link to gist

Client: 2017/12/30 10:41:17 [INFO] serf: EventMemberJoin: laptop 1.2.3.4 2017/12/30 10:41:17 [INFO] agent: Started DNS server 127.0.0.1:8600 (udp) 2017/12/30 10:41:17 [INFO] agent: Started DNS server 127.0.0.1:8600 (tcp) 2017/12/30 10:41:17 [INFO] agent: Started HTTP server on 127.0.0.1:8500 (tcp) 2017/12/30 10:41:17 [INFO] agent: started state syncer 2017/12/30 10:41:17 [INFO] agent: Retry join LAN is supported for: aliyun aws azure digitalocean gce os scaleway softlayer 2017/12/30 10:41:17 [INFO] agent: Joining LAN cluster... 2017/12/30 10:41:17 [INFO] agent: (LAN) joining: [5.6.7.8] 2017/12/30 10:41:17 [WARN] manager: No servers available 2017/12/30 10:41:17 [ERR] agent: failed to sync remote state: No known Consul servers 2017/12/30 10:41:17 [INFO] serf: EventMemberJoin: consul-test 5.6.7.8 2017/12/30 10:41:17 [WARN] memberlist: Refuting a suspect message (from: laptop) 2017/12/30 10:41:17 [INFO] consul: adding server consul-test (Addr: tcp/5.6.7.8:8300) (DC: test) 2017/12/30 10:41:17 [INFO] agent: (LAN) joined: 1 Err: 2017/12/30 10:41:17 [INFO] agent: Join LAN completed. Synced with 1 initial agents 2017/12/30 10:41:19 [ERR] consul: "Catalog.Register" RPC failed to server 5.6.7.8:8300: rpc error making call: Permission denied 2017/12/30 10:41:19 [WARN] agent: Service "mgmt-test" registration blocked by ACLs 2017/12/30 10:41:20 [INFO] agent: Synced node info 2017/12/30 10:41:30 [WARN] memberlist: Refuting a suspect message (from: consul-test) 2017/12/30 10:41:41 [WARN] memberlist: Refuting a suspect message (from: consul-test) 2017/12/30 10:42:03 [WARN] memberlist: Refuting a suspect message (from: consul-test) 2017/12/30 10:42:14 [WARN] memberlist: Refuting a suspect message (from: consul-test) 2017/12/30 10:42:36 [WARN] memberlist: Refuting a suspect message (from: consul-test)

Server: 2017/12/30 10:44:48 [INFO] raft: Initial configuration (index=1): [{Suffrage:Voter ID:dc81987f-8d79-60f7-7aba-548fdbaba794 Address:5.6.7.8:8300}] 2017/12/30 10:44:48 [INFO] serf: EventMemberJoin: consul-test.test 5.6.7.8 2017/12/30 10:44:48 [INFO] raft: Node at 5.6.7.8:8300 [Follower] entering Follower state (Leader: "") 2017/12/30 10:44:48 [WARN] serf: Failed to re-join any previously known node 2017/12/30 10:44:48 [INFO] serf: EventMemberJoin: consul-test 5.6.7.8 2017/12/30 10:44:48 [INFO] agent: Started DNS server 5.6.7.8:8600 (udp) 2017/12/30 10:44:48 [INFO] serf: Attempting re-join to previously known node: laptop: 1.2.3.4:8301 2017/12/30 10:44:48 [INFO] consul: Adding LAN server consul-test (Addr: tcp/5.6.7.8:8300) (DC: test) 2017/12/30 10:44:48 [INFO] consul: Handled member-join event for server "consul-test.test" in area "wan" 2017/12/30 10:44:48 [INFO] agent: Started DNS server 5.6.7.8:8600 (tcp) 2017/12/30 10:44:48 [INFO] agent: Started HTTP server on 5.6.7.8:8500 (tcp) 2017/12/30 10:44:48 [INFO] agent: started state syncer 2017/12/30 10:44:54 [WARN] raft: Heartbeat timeout from "" reached, starting election 2017/12/30 10:44:54 [INFO] raft: Node at 5.6.7.8:8300 [Candidate] entering Candidate state in term 5 2017/12/30 10:44:54 [INFO] raft: Election won. Tally: 1 2017/12/30 10:44:54 [INFO] raft: Node at 5.6.7.8:8300 [Leader] entering Leader state 2017/12/30 10:44:54 [INFO] consul: cluster leadership acquired 2017/12/30 10:44:54 [INFO] consul: New leader elected: consul-test 2017/12/30 10:44:54 [INFO] consul: member 'laptop' reaped, deregistering 2017/12/30 10:44:54 [INFO] agent: Synced node info 2017/12/30 10:44:58 [WARN] serf: Failed to re-join any previously known node 2017/12/30 10:45:18 [INFO] serf: EventMemberJoin: hlaptop 1.2.3.4 2017/12/30 10:45:18 [INFO] consul: member '-laptop' joined, marking health alive 2017/12/30 10:45:30 [INFO] memberlist: Suspect laptop has failed, no acks received 2017/12/30 10:45:34 [INFO] memberlist: Marking -laptop as failed, suspect timeout reached (0 peer confirmations) 2017/12/30 10:45:34 [INFO] serf: EventMemberFailed: laptop 1.2.3.4 2017/12/30 10:45:34 [INFO] consul: member 'laptop' failed, marking health critical 2017/12/30 10:45:34 [INFO] serf: EventMemberJoin: laptop 1.2.3.4 2017/12/30 10:45:34 [INFO] consul: member 'laptop' joined, marking health alive 2017/12/30 10:45:37 [ERR] memberlist: Push/Pull with laptop failed: dial tcp 1.2.3.4:8301: i/o timeout 2017/12/30 10:45:41 [INFO] memberlist: Suspect laptop has failed, no acks received 2017/12/30 10:45:52 [INFO] memberlist: Suspect laptop has failed, no acks received 2017/12/30 10:46:02 [INFO] memberlist: Suspect laptop has failed, no acks received

pearkes commented 6 years ago

From a quick look it seems like you might be missing the "agent" stanza for the tokens used by your agent. I recommend following the ACL Guide closely. We're definitely aware of the generally challenging UX here, and are working on more holistic improvements. However, issues on GitHub for Consul are intended to be related to bugs or feature requests, so we recommend using our other community resources instead of asking here.

If you feel this is a bug, please open a new issue with the appropriate information.