{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/consul/issues/4139","repository_url":"https://api.github.com/repos/hashicorp/consul","labels_url":"https://api.github.com/repos/hashicorp/consul/issues/4139/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/consul/issues/4139/comments","events_url":"https://api.github.com/repos/hashicorp/consul/issues/4139/events","html_url":"https://github.com/hashicorp/consul/issues/4139","id":324355964,"number":4139,"title":"New acl_down_policy: read-only","user":{"login":"sgirones","id":597063,"avatar_url":"https://avatars0.githubusercontent.com/u/597063?v=4","gravatar_id":"","url":"https://api.github.com/users/sgirones","html_url":"https://github.com/sgirones","followers_url":"https://api.github.com/users/sgirones/followers","following_url":"https://api.github.com/users/sgirones/following{/other_user}","gists_url":"https://api.github.com/users/sgirones/gists{/gist_id}","starred_url":"https://api.github.com/users/sgirones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sgirones/subscriptions","organizations_url":"https://api.github.com/users/sgirones/orgs","repos_url":"https://api.github.com/users/sgirones/repos","events_url":"https://api.github.com/users/sgirones/events{/privacy}","received_events_url":"https://api.github.com/users/sgirones/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-18T10:28:22Z","updated_at":"2018-05-18T10:28:22Z","closed_at":null,"author_association":"NONE","body":"#### Feature Description\r\n\r\nThere are currently 3 `acl_down_policy` options:\r\n* allow\r\n* deny\r\n* extend-cache\r\n\r\n`read-only` could be useful add on to that list\r\n\r\n#### Use Case(s)\r\n\r\nWe ran into a situation where, when retrieving the list of nodes from the Catalog API or a list of keys from the K/V API, the list would come empty (https://github.com/hashicorp/consul/issues/4103)\r\n\r\nWe discovered the situation arises when the cluster has no leader and the server serving the request hasn't had the chance to cache any ACL token (we have `acl_down_policy: extend-cache`).\r\n\r\nObviously, a solution would be to set the `acl_down_policy` to `allow`, but we find it too permissive.\r\n\r\nWe think having a `read-only` policy would help in these situations, specially when you rely on Consul as a source of truth for your infrastructure.\r\n"}}
{"actor":{"display_login":"sgirones"}}