search

hashicorp / consul

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
https://www.consul.io
Other
28.39k stars 4.43k forks source link

Feature: ACL Policy Management allow overwriting/looking up a policy by name #5962

Open rnsc opened 5 years ago

rnsc commented 5 years ago

Feature Description

The Consul Agent CLI supports the no-merge feature when executing an UPDATE command on an existing ACL policy. (https://www.consul.io/docs/commands/acl/policy/update.html#no-merge) I'd like to have that feature also available on the API of Consul.

Use Case(s)

We're provisioning policies through the API and wanted to update policies in place but overwriting the old rules. Currently, we have to:

  1. check if we have a policy existing with our naming convention
  2. delete it
  3. recreate it with the new rules

We'd just like to avoid having to delete an existing policy when we only want to overwrite rules.

mkeeler commented 5 years ago

@rnsc The API itself is overwrite only. The CLI when doing policy merging will first download the existing policy and use current values for defaults where none are specified to the CLI.

So unless I am not understanding your needs, I think the API already does what you want. You still have to check if it exists because Consul will not allow you to create two policies with the same name. But once you know that, you can use either the v1/acl/policy endpoint to create a new one or v1/acl/policy/:id to update an existing one (this is overwriting).

A couple improvements I could see us making are:

  1. Adding a v1/acl/policy/name/:name to lookup a policy by name. That way if you are not tracking the policy IDs you wouldn't have to list the policies and search for the matching name yourself.
  2. Potentially adding a overwrite query parameter to the v1/acl/policy endpoint to allow overwriting an existing policy if it exists.
rnsc commented 5 years ago

@mkeeler Thanks for the prompt reply! I was under the assumption that the default of the API was merging rules. I might have confused my tests with the CLI and the API. Sorry for that.

Your two points make sense also for me. Should I close this issue and open a new one with your feedback or should we update this one?

Thanks,

mkeeler commented 5 years ago

I would leave it open for now. I think your usage helped to highlight a couple fairly minor issues with the API and we can keep it open for tracking those. I will change the title though once I come up with a succinct way to describe the new features that would be good.

mkeeler commented 4 years ago

At least part of this has now been merged in #6615 and will be released in v1.7.3