Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consul Connect Native support #6083

Closed
schmichael opened this issue Aug 6, 2019 · 2 comments · Fixed by #8011
Closed

Consul Connect Native support #6083

schmichael opened this issue Aug 6, 2019 · 2 comments · Fixed by #8011
Assignees
@shoenig
Labels
theme/consul/connect Consul Connect integration type/enhancement

Comments

@schmichael
Copy link
Member

schmichael commented Aug 6, 2019 •
edited
Loading

Implement support for Consul Connect Native services: https://www.consul.io/docs/connect/native.html

A little struct plumbing work we need to ensure the CONSUL_TOKEN is exposed to the native task when Consul ACLs are enabled.

Also need to give the namespaced native service access to the host Consul API.
@schmichael schmichael added theme/consul/connect Consul Connect integration type/enhancement labels Aug 6, 2019
@schmichael schmichael added this to the 0.10.0 milestone Aug 6, 2019
@schmichael schmichael removed this from the 0.10.0 milestone Sep 3, 2019
@schmichael schmichael added this to the 0.10.1 milestone Oct 16, 2019
@schmichael schmichael mentioned this issue Oct 16, 2019
Open
@schmichael schmichael modified the milestones: 0.10.1, 0.10.2 Nov 5, 2019
@schmichael schmichael modified the milestones: 0.10.2, 0.10.3 Nov 20, 2019
@idrennanvmware
Copy link
Contributor

Wanted to check in on this issue as it's in the critical path for us on a production nomad deployment. We have windows and Linux machines that we need to use the native connect client so we cannot commit to envoy

Does this still look like it can make the 0.10.3 milestone?

@shoenig shoenig modified the milestones: 0.10.4, 0.11.0 Feb 20, 2020
@schmichael schmichael removed this from the 0.11.0 milestone Apr 9, 2020
@shoenig shoenig mentioned this issue Jun 17, 2020
Merged
shoenig added a commit that referenced this issue Jun 17, 2020
@shoenig
consul/connect: add support for running connect native tasks
c84fd77 
This PR adds the capability of running Connect Native Tasks on Nomad,
particularly when TLS and ACLs are enabled on Consul.

The `connect` stanza now includes a `native` parameter, which can be
set to the name of task that backs the Connect Native Consul service.

There is a new Client configuration parameter for the `consul` stanza
called `share_ssl`. Like `allow_unauthenticated` the default value is
true, but recommended to be disabled in production environments. When
enabled, the Nomad Client's Consul TLS information is shared with
Connect Native tasks through the normal Consul environment variables.
This does NOT include auth or token information.

If Consul ACLs are enabled, Service Identity Tokens are automatically
and injected into the Connect Native task through the CONSUL_HTTP_TOKEN
environment variable.

Any of the automatically set environment variables can be overridden by
the Connect Native task using the `env` stanza.

Fixes #6083
shoenig added a commit that referenced this issue Jun 22, 2020
@shoenig
consul/connect: add support for running connect native tasks
7e8d5c2 
This PR adds the capability of running Connect Native Tasks on Nomad,
particularly when TLS and ACLs are enabled on Consul.

The `connect` stanza now includes a `native` parameter, which can be
set to the name of task that backs the Connect Native Consul service.

There is a new Client configuration parameter for the `consul` stanza
called `share_ssl`. Like `allow_unauthenticated` the default value is
true, but recommended to be disabled in production environments. When
enabled, the Nomad Client's Consul TLS information is shared with
Connect Native tasks through the normal Consul environment variables.
This does NOT include auth or token information.

If Consul ACLs are enabled, Service Identity Tokens are automatically
and injected into the Connect Native task through the CONSUL_HTTP_TOKEN
environment variable.

Any of the automatically set environment variables can be overridden by
the Connect Native task using the `env` stanza.

Fixes #6083
@github-actions
Copy link

github-actions bot commented Nov 6, 2022

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 6, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@shoenig shoenig

Labels
theme/consul/connect Consul Connect integration type/enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

consul/connect: implement initial support for connect native hashicorp/nomad
3 participants
@schmichael @shoenig @idrennanvmware