consul exec from server nodes only?

[tj]

More of a concern/question, but wouldn't it be potentially pretty harmful to allow non-server agent nodes to exec? Would it make more sense to restrict this to server nodes? Curious to hear your thoughts on that!

Really enjoying it so far! Amazing work as usual ;D

[armon]

I'm not sure what the harm is? In most cases, we try to mask the difference between a client/server, and transparently handle the distinction. From the perspective of a user, exec could be executing on the server (in many ways it's use of KV does heavily depend on the servers).

If you just mean restrictions in the form of ACL rules, then I agree those can be applied, but again, that enforcement can also be done at the edges on the clients. I'm curious to learn more about your concerns though.

[tj]

Hmm nevermind I thought the same functionality was exposed via the HTTP API as well (for interfacing through CLI), I was just going to chuck the UI behind TLS/basic auth so that would get scary if someone could exec on all your machines haha

[armon]

Technically, everything the 'exec' command does is over the HTTP API. So it is exposed over that.