acl: allow auth methods created in the primary datacenter to optionally create global tokens #7899
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ly create global tokens
|
Note that this is not meant to be a fix for #7381. |
dnephin
reviewed
May 14, 2020
mkeeler
reviewed
May 14, 2020
| switch method.TokenType { | ||
| case "local", "": | ||
| case "global": | ||
| if !a.srv.InACLDatacenter() { |
There was a problem hiding this comment.
Is this only a restriction because the secondary servers would require a token to use in the RPC to the primary?
There was a problem hiding this comment.
That and having to sleep-loop until replication brought your newly-created token back to the secondary.
hashicorp-ci
pushed a commit
that referenced
this pull request
Jun 1, 2020
…ly create global tokens (#7899)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently auth methods (and binding rules) are dc-local items that are not replicated between datacenters. They are also restricted to only being able to create dc-local ACL tokens.
This restriction was initially set in place to avoid an availability issue in any application that headlessly would make use of an auth method to dynamically create a token before application start (such as a kubernetes pod pre start hook). If these needed to make a synchronous RPC back to the primary datacenter (that may not even be up) then that would incur both an additional startup delay and the probability of bringing everything to a screeching halt in the event the primary datacenter is briefly disconnected.
While this argument still holds for any auth method used headlessly (
type=kubernetesandtype=jwt) it is harder to make the same justification for user-driven flows liketype=oidc.In this PR I'm granting auth methods defined in the primary datacenter the option of being configured to exclusively create global ACL tokens.
type=kubernetesandtype=jwtas well.