Open yardbirdsax opened 3 years ago
I think I've incorporated everything requested, please let me know if there's anything else required here? Thanks!
Howdy, just wanted to ping here since I still have this PR outstanding. Was there anything else I need to do to get it closed out?
Fixes #119
Functional Changes
consul-iam-policies
module now includes permissions for reading / writing SSM parameters when a new variable namedacl_store_type
is set to "ssm".consul-cluster
module now includes an input variable namedacl_store_type
, which is used to indicate where created ACL tokens should be stored. Currently this only supports the value "ssm", but could support other methods in the future. This value is only used to pass on to theconsul-iam-policies
module.bash-commons
library, which is used in cases where ACLs are enabled.run-consul
script now accepts a switch parameter--enable-acl
, which if set will cause the script to generate a root ACL token upon cluster provision, and store it as a specially named SSM parameter. The bootstrap command is executed on only one of the server instances; other server instances and client instances will wait for the SSM parameter to become available, then use it to create their own agent tokens with minimal rights. (Note: while this currently only supports SSM, it was written internally in a way that future expansion to other stores would be possible.)run-consul
script now accepts an argument--acl-storage-type
, which is required when the--enable-acl
flag is set. This allows the user to select how the bootstrap process stores generated ACL tokens. Currently the only supported value is 'ssm'.Testing / Refactoring related changes
consul-commons.sh
file so as to make testing them independent of running therun-consul
script easier.Known Issues
Test results: https://gist.github.com/yardbirdsax/e08efec4799c7e286ce093b5dfee89c3