{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/consul-k8s/issues/26","repository_url":"https://api.github.com/repos/hashicorp/consul-k8s","labels_url":"https://api.github.com/repos/hashicorp/consul-k8s/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/consul-k8s/issues/26/comments","events_url":"https://api.github.com/repos/hashicorp/consul-k8s/issues/26/events","html_url":"https://github.com/hashicorp/consul-k8s/issues/26","id":374846148,"node_id":"MDU6SXNzdWUzNzQ4NDYxNDg=","number":26,"title":"Consul ACL Policy - k8s to Consul","user":{"login":"arctiqtim","id":19749398,"node_id":"MDQ6VXNlcjE5NzQ5Mzk4","avatar_url":"https://avatars0.githubusercontent.com/u/19749398?v=4","gravatar_id":"","url":"https://api.github.com/users/arctiqtim","html_url":"https://github.com/arctiqtim","followers_url":"https://api.github.com/users/arctiqtim/followers","following_url":"https://api.github.com/users/arctiqtim/following{/other_user}","gists_url":"https://api.github.com/users/arctiqtim/gists{/gist_id}","starred_url":"https://api.github.com/users/arctiqtim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arctiqtim/subscriptions","organizations_url":"https://api.github.com/users/arctiqtim/orgs","repos_url":"https://api.github.com/users/arctiqtim/repos","events_url":"https://api.github.com/users/arctiqtim/events{/privacy}","received_events_url":"https://api.github.com/users/arctiqtim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-29T03:36:32Z","updated_at":"2018-10-29T03:36:32Z","closed_at":null,"author_association":"NONE","body":"On a Consul setup with default deny policy and ACLs enabled I can't seem to get the correct policy to allow the service sync to work from k8s to consul.\r\n\r\nUsing a token with the following policy:\r\n```    node_prefix \"\" {\r\n      policy = \"write\"\r\n    }\r\n    service_prefix \"\" {\r\n      policy = \"read\"\r\n    }\r\n```\r\nI see the following errors:\r\n```\r\n    2018/10/29 02:50:24 [ERR] consul: \"Catalog.Register\" RPC failed to server x.x.x.x:8300: rpc error making call: rpc error making call: Permission denied\r\n    2018/10/29 02:50:24 [ERR] http: Request PUT /v1/catalog/register, error: rpc error making call: rpc error making call: Permission denied from=x.x.x.x:38006\r\n```\r\n\r\nRelaxing the policy with:\r\n```    node_prefix \"\" {\r\n      policy = \"write\"\r\n    }\r\n    service_prefix \"\" {\r\n      policy = \"read\"\r\n    }\r\n    agent_prefix \"\" {\r\n      policy = \"write\"\r\n    }\r\n    session_prefix \"\" {\r\n      policy = \"write\"\r\n    }\r\n```\r\nI am seeing the following errors:\r\n```\r\n2018-10-29T03:07:02.848Z [WARN ] to-consul/sink: error registering service: node-name=k8s-sync service-name=test err=\"Unexpected response code: 403 (rpc error making call: rpc error making call: Permission denied)\"\r\n```\r\n\r\nIf I change the consul-k8s deployment to use the master token instead, the sync'ing services work perfectly.  Is there any guidance on what ACL policies are required in order for this sync to work?\r\n\r\nThis is currently running in GKE with the latest Consul release, so the newer ACL scheme.\r\n```/ # consul members\r\nNode                 Address         Status  Type    Build     Protocol  DC   Segment\r\nconsul-0             x.x.x.x:8301  alive   server  1.4.0rc1  2         cs1  <all>\r\nconsul-1             x.x.x.x:8301  alive   server  1.4.0rc1  2         cs1  <all>\r\nconsul-2             x.x.x.x:8301  alive   server  1.4.0rc1  2         cs1  <all>\r\nconsul-agents-fzl8j  x.x.x.x:8301  alive   client  1.4.0rc1  2         cs1  <default>\r\nconsul-agents-g6l9d  x.x.x.x:8301  alive   client  1.4.0rc1  2         cs1  <default>\r\nconsul-agents-xdfl7  x.x.x.x:8301  alive   client  1.4.0rc1  2         cs1  <default>\r\n```\r\n"}}
{"actor":{"display_login":"arctiqtim"}}