Always update auth method #282
Conversation
Previously, we would only update auth method in Consul if Consul namespaces are enabled. This was necessary to make sure that if namespace configuration changes, it is reflected in the auth method. However, running Consul servers externally is another use case why it's important to update the auth method. That is because if you run a Helm install, then uninstall and install again, the auth method saved in Consul will be out-of-date: it will have the service account JWT token saved in the auth method refers to the service account token that has been deleted from Kubernetes when you ran helm uninstall. This change proposes to always update the auth method to solve for the external servers use case.
ishustava
added
area/acls
ishustava
requested review from
a team,
lkysow and
kschoche
and removed request for
a team
|
This one took me a bit to grok. For other reviewers, what's happening is when running with external servers, e.g. Consul on Azure, when you helm install for the first time, we create a Consul auth method that Consul uses to exchange service account tokens for consul acl tokens. The auth method works by Consul servers calling the Kubernetes API and checking if the service account is valid. In order for consul to call the kube api, it itself needs a service account token. On first install, this service account token is stored in the Consul servers. When the consul installation is deleted, we don't delete the auth method from the consul servers since we're just uninstalling the consul clients in kube. However we do delete the service account resource from Kubernetes. This means the consul servers now have an auth method that's trying to use a token that was deleted from Kubernetes. On re-install, prior to this PR, we would recognize that the auth method exists and not update it. It would then still have the now-deleted service account token and so any |
thanks! I think it's OK for just myself to do the testing. I've tested this with HCS, and it works nicely! |
Prevent incorrect connectInject config
Previously, we would only update auth method in Consul
if Consul namespaces are enabled. This was necessary to make sure
that if namespace configuration changes, it is reflected in the auth method.
However, running Consul servers externally is another use case why it's important
to update the auth method. That is because if you run a Helm install, then uninstall
and install again, the auth method saved in Consul is out-of-date:
the service account JWT token saved in the auth method refers to the service account token
that has been deleted from Kubernetes when you ran helm uninstall.
This change proposes to always update the auth method to solve for the
external servers use case.