Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: namespace ACL permissions for exported services #22162

Merged
merged 2 commits into from
Feb 14, 2025
Merged

docs: namespace ACL permissions for exported services #22162

merged 2 commits into from
Feb 14, 2025

Conversation

boruszak
Copy link
Contributor

@boruszak boruszak commented Feb 13, 2025 •
edited
Loading

Description

This PR updates two pages of documentation in response to a support ticket.

Consul dataplanes use the builtin/service policy for their ACL permissions, but this policy does not grant access to all namespaces. Because the exported services configuration entry page included examples with the * wildcard, users experienced errors due to incorrect ACL permissions.

These updates specifically state the required ACL policies.

Preview links

Exported services configuration entry reference
Consul Dataplanes overview

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@github-actions github-actions bot added the type/docs Documentation needs to be created/updated/clarified label Feb 13, 2025
@boruszak boruszak added backport/ent/1.15 Changes are backported to 1.15 ent backport/ent/1.18 Changes are backported to 1.18 ent backport/1.20 Changes are backported to 1.20 backport/ent/1.19 Changes are backported to 1.19 ent pr/no-changelog PR does not need a corresponding .changelog entry labels Feb 13, 2025
@boruszak boruszak marked this pull request as ready for review February 13, 2025 21:46
@boruszak boruszak requested review from a team as code owners February 13, 2025 21:46
@boruszak boruszak requested a review from amirakha1 February 13, 2025 21:46
aimeeu
aimeeu approved these changes Feb 14, 2025
View reviewed changes
Copy link
Contributor

@aimeeu aimeeu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a new nits

website/content/docs/connect/dataplane/index.mdx

If ACLs are enabled, exported services between partitions that use dataplanes may experience errors when you define namespace partitions with the `*` wildcard. Consul dataplanes use a token with the `builtin/service` policy attached, but this policy does not include access to all namespaces.

Add the following policies to the service token attached to Consul dataplanes to grant Consul access to exported services across all namespaces:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Add the following policies to the service token attached to Consul dataplanes to grant Consul access to exported services across all namespaces:
Add these policies to the service token attached to Consul dataplanes to grant Consul access to exported services across all namespaces.

Kind of a grey area... but I applied the "introduce code block... descriptive sentence that ends with a period" rule

website/content/docs/connect/config-entries/exported-services.mdx
}
```

</CodeTabs>
</Tab>
</Tabs>

If you experience errors using the wildcard to export services on Consul on Kubernetes, make sure the [service token](/consul/docs/security/acl/tokens/create/create-a-service-token) is attached to a policy that grants read access to all namespaces:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If you experience errors using the wildcard to export services on Consul on Kubernetes, make sure the [service token](/consul/docs/security/acl/tokens/create/create-a-service-token) is attached to a policy that grants read access to all namespaces:
If you experience errors using the wildcard to export services on Consul on Kubernetes, make sure the [service token](/consul/docs/security/acl/tokens/create/create-a-service-token) is attached to a policy that grants read access to all namespaces as in this example.

@boruszak boruszak merged commit 68daf4c into main Feb 14, 2025
105 of 111 checks passed
@boruszak boruszak deleted the docs/CE-814-update-exported-services branch February 14, 2025 20:45
@hc-github-team-consul-core hc-github-team-consul-core mentioned this pull request Feb 14, 2025
Merged
4 tasks
@boruszak boruszak mentioned this pull request Feb 14, 2025
Merged
4 tasks
@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.18,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

4 similar comments
@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.18,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.18,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.18,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.18,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core hc-github-team-consul-core mentioned this pull request Feb 19, 2025
Merged
4 tasks
@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

4 similar comments
@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

10 similar comments
@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @boruszak! a backport is missing for this PR [22162] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@aimeeu aimeeu aimeeu approved these changes

@amirakha1 amirakha1 amirakha1 approved these changes

Assignees
No one assigned
Labels
backport/ent/1.15 Changes are backported to 1.15 ent backport/ent/1.18 Changes are backported to 1.18 ent backport/ent/1.19 Changes are backported to 1.19 ent backport/1.20 Changes are backported to 1.20 pr/no-changelog PR does not need a corresponding .changelog entry type/docs Documentation needs to be created/updated/clarified
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@boruszak @hc-github-team-consul-core @aimeeu @amirakha1