{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/consul/issues/2562","repository_url":"https://api.github.com/repos/hashicorp/consul","labels_url":"https://api.github.com/repos/hashicorp/consul/issues/2562/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/consul/issues/2562/comments","events_url":"https://api.github.com/repos/hashicorp/consul/issues/2562/events","html_url":"https://github.com/hashicorp/consul/issues/2562","id":192983259,"number":2562,"title":"ACL replication not working in 0.7.1","user":{"login":"cliff-ops","id":11353054,"avatar_url":"https://avatars.githubusercontent.com/u/11353054?v=3","gravatar_id":"","url":"https://api.github.com/users/cliff-ops","html_url":"https://github.com/cliff-ops","followers_url":"https://api.github.com/users/cliff-ops/followers","following_url":"https://api.github.com/users/cliff-ops/following{/other_user}","gists_url":"https://api.github.com/users/cliff-ops/gists{/gist_id}","starred_url":"https://api.github.com/users/cliff-ops/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cliff-ops/subscriptions","organizations_url":"https://api.github.com/users/cliff-ops/orgs","repos_url":"https://api.github.com/users/cliff-ops/repos","events_url":"https://api.github.com/users/cliff-ops/events{/privacy}","received_events_url":"https://api.github.com/users/cliff-ops/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-12-01T22:42:14Z","updated_at":"2016-12-02T03:35:27Z","closed_at":null,"body":"Versions:\r\n\r\nClient: Consul v0.7.1\r\nServer: Consul v0.7.1\r\n\r\nOS: CentOS Linux release 7.2.1511\r\n\r\nadded the following on all server agent in the authoritative ACL datacenter as well as the non-authoritative ACL datacenter. I also attempted adding it to only the non-authoritative datacenter.\r\nRestarted all server nodes in all DCs after making changes\r\n\r\n\"acl_replication_token\": xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\r\n\"acl_down_policy\": \"extend-cache\"\r\n\r\n\r\nWith log level set to TRACE I see the following in the logs on my non-authoritative ACL datacneter Consul server agents  every minute:\r\n\r\n2016/12/01 14:16:41 [WARN] consul: ACL replication error (will retry if still leader): failed to retrieve remote ACLs: rpc error: ACL not found\r\n\r\nI see nothing on the authoritative on the Consul server agents running in my authoritative ACL datacenter even with the log level set to TRACE.\r\n\r\n\r\nIt is unclear what that error message means or what might be the cause. I do have existing ACLs and I can see them in the UI.  When I curl the replication endpoint I see the following:\r\n\r\ncurl -s localhost:8500/v1/acl/replication | jq '.'\r\n{\r\n  \"Enabled\": true,\r\n  \"Running\": true,\r\n  \"SourceDatacenter\": \"JPN\",\r\n  \"ReplicatedIndex\": 0,\r\n  \"LastSuccess\": \"0001-01-01T00:00:00Z\",\r\n  \"LastError\": \"2016-12-01T22:36:51Z\"\r\n}\r\n\r\nAlso the docs don't really indicate what the acl_replication_token parameter should be. Is this the master token? Should it be another management token set up for just this purpose?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/consul/issues/comments/264365332","html_url":"https://github.com/hashicorp/consul/issues/2562#issuecomment-264365332","issue_url":"https://api.github.com/repos/hashicorp/consul/issues/2562","id":264365332,"user":{"login":"cliff-ops","id":11353054,"avatar_url":"https://avatars.githubusercontent.com/u/11353054?v=3","gravatar_id":"","url":"https://api.github.com/users/cliff-ops","html_url":"https://github.com/cliff-ops","followers_url":"https://api.github.com/users/cliff-ops/followers","following_url":"https://api.github.com/users/cliff-ops/following{/other_user}","gists_url":"https://api.github.com/users/cliff-ops/gists{/gist_id}","starred_url":"https://api.github.com/users/cliff-ops/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cliff-ops/subscriptions","organizations_url":"https://api.github.com/users/cliff-ops/orgs","repos_url":"https://api.github.com/users/cliff-ops/repos","events_url":"https://api.github.com/users/cliff-ops/events{/privacy}","received_events_url":"https://api.github.com/users/cliff-ops/received_events","type":"User","site_admin":false},"created_at":"2016-12-02T03:35:27Z","updated_at":"2016-12-02T03:35:27Z","body":"Ok this makes sense. When you say:\r\n\r\n\"As TTLs expire, the local TTL setting will determine how things re-up, \"\r\n\r\nThe local replica can continuously re-up the TTLs on the expired token from the local replica as long as the ACL datacenter is unreachable though right? In other words its not a one time operation?\r\n\r\nThanks"}}
{"actor":{"display_login":"cliff-ops"}}