Commits on Nov 14, 2022

1. grpc/acl: relax permissions required for "core" endpoints …

   Previously, these endpoints required `service:write` permission on _any_
   service as a sort of proxy for "is the caller allowed to participate in
   the mesh?".
   
   Now, they're called as part of the process of establishing a server
   connection by any consumer of the consul-server-connection-manager
   library, which will include non-mesh workloads (e.g. Consul KV as a
   storage backend for Vault) as well as ancillary components such as
   consul-k8s' acl-init process, which likely won't have `service:write`
   permission.
   
   So this commit relaxes those requirements to accept *any* valid ACL token
   on the following gRPC endpoints:
   
   - `hashicorp.consul.dataplane.DataplaneService/GetSupportedDataplaneFeatures`
   - `hashicorp.consul.serverdiscovery.ServerDiscoveryService/WatchServers`
   - `hashicorp.consul.connectca.ConnectCAService/WatchRoots`

   

   boxofrad committed Nov 14, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for ae9b6a9
   • Browse repository at this point

   Copy the full SHA

   ae9b6a9 View commit details

   Browse the repository at this point in the history