Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

consul watch within namespace #9353

Closed
denislavdenov opened this issue Dec 9, 2020 · 0 comments · Fixed by #10795
Closed

consul watch within namespace #9353

denislavdenov opened this issue Dec 9, 2020 · 0 comments · Fixed by #10795
Assignees
Labels
type/bug Feature does not function as expected

Comments

@denislavdenov
Copy link
Contributor

trying to watch over a KV entry in a namespace, but gets permission denied errors when using the namespace-management token.

Еxpectation is to be able to do use consul watch command in a namespace.

When running a consul watch command in the default namespace, it executes normally:
consul watch -type=keyprefix -prefix=redis/
[
{
"Key": "redis/config/minconns",
"CreateIndex": 9601002,
"ModifyIndex": 9601002,
"LockIndex": 0,
"Flags": 0,
"Value": "NTY0Mw==",
"Session": "",
"Namespace": "default"
}
]
However, when this is run within a namespace (using namespace operator token), a 403 error is returned:
consul watch -type=keyprefix -prefix=redis/
Error querying Consul agent: Unexpected response code: 403 (Permission denied)

Looking at docs and source code, it seems that consul watch command does not support namespace functionality.

https://github.com/hashicorp/consul-enterprise/blob/master/command/watch/watch.go

Filing this bug report as requested from @mikemorris .

@mikemorris mikemorris added the type/bug Feature does not function as expected label Dec 9, 2020
blake added a commit that referenced this issue Aug 5, 2021
Remove unnecessary query to determine node name when using
`consul watch`.

Fixes #9353
blake added a commit that referenced this issue Aug 8, 2021
Replace call to /agent/self with /status/leader to verify agent
reachability before initializing a watch. This endpoint is not guarded
by ACLs, and as such can be queried by any unauthenticated API client.

Fixes #9353
blake added a commit that referenced this issue Aug 9, 2021
Replace call to /agent/self with /status/leader to verify agent
reachability before initializing a watch. This endpoint is not guarded
by ACLs, and as such can be queried by any API client regardless of
their permissions.

Fixes #9353
hc-github-team-consul-core pushed a commit that referenced this issue Aug 9, 2021
Replace call to /agent/self with /status/leader to verify agent
reachability before initializing a watch. This endpoint is not guarded
by ACLs, and as such can be queried by any API client regardless of
their permissions.

Fixes #9353
hc-github-team-consul-core pushed a commit that referenced this issue Aug 9, 2021
Replace call to /agent/self with /status/leader to verify agent
reachability before initializing a watch. This endpoint is not guarded
by ACLs, and as such can be queried by any API client regardless of
their permissions.

Fixes #9353
hc-github-team-consul-core pushed a commit that referenced this issue Aug 9, 2021
Replace call to /agent/self with /status/leader to verify agent
reachability before initializing a watch. This endpoint is not guarded
by ACLs, and as such can be queried by any API client regardless of
their permissions.

Fixes #9353
@blake blake self-assigned this Aug 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Feature does not function as expected
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants