Consul ACL配置

consul 节点有server模式,与client 的模式， 微服务通过Nginx 访问 consul client 节点用来进行服务的注册与发现。

consul ACL介绍

ACL是访问控制列表，consul中主要用来控制 agent ，service，node，event，key，query 等功能的控制访问

consul ACL Server节点配置

{
         "data_dir": "/data/consul/data/",
         "datacenter": "lq",
         "log_level": "INFO",
         "bootstrap_expect": 3,
         "server": true,
         "bind_addr": "10.23.27.91",
         "client_addr": "0.0.0.0",
         "acl_datacenter": "lq",
         "acl_master_token":
        "autohome-openapi",
         "acl_default_policy": "deny" ,
         "acl_token" : "autohome-openapi",
         "retry_join": ["10.23.27.87"],
         "retry_interval": "30s",
         "rejoin_after_leave": true,
         "start_join": ["10.23.27.87"],
         "ui":true
 }
acl_default_policy 默认值值是allow，即能够执行任何操作，这里需要关闭
acl_master_token 需要在每个server上配置，有management级别的权限，相当于一个种子token
acl_datacenter区域的标识

在UI 界面进行ACL规则定制

官方文档有一例分配说明

# Default all keys to read-only
key "" { 
        policy = "read"
         }
 key "foo/" {
         policy = "write"
 }
 key "foo/private/" {
         # Deny access to the dir "foo/private" policy = "deny"
}
# Default all services to allow registration. Also permits all
# services to be discovered.
service "" {
         policy = "write"
}
 # Deny registration access to services prefixed "secure-".
# Discovery of the service is still allowed in read mode.
service "secure-" {
         policy = "read"
}
# Allow firing any user event by default.
event "" {
         policy = "write"
}
# Deny firing events prefixed with "destroy-".
event "destroy-" {
         policy = "deny"
}# Default prepared queries to read-only.
query "" {
         policy = "read"
}
 # Read-only mode for the encryption keyring by default (list only)
keyring = "read"

配置好权限后,就可以启动Consul 的Client 节点了。配置如下

{
         "data_dir": "/data/consul/data/",
         "datacenter": "lq",
         "log_level": "INFO",
         "bind_addr": "192.168.0.10",
         "client_addr": "0.0.0.0",
         "retry_join": ["10.23.27.87"],
         "acl_datacenter": "bj",
         "acl_token": "366ef886-4162-5e60-1c85-74ab7a944061",
         "ui":true

}