You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/content/docs/security/acl/tokens/create/create-a-mesh-gateway-token.mdx
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,13 @@
1
1
---
2
2
layout: docs
3
3
page_title: Create a token for mesh gateway registration
4
-
Description: >-
4
+
description: >-
5
5
Learn how to create ACL tokens that your mesh gateway can present to Consul servers so that they can register with the Consul catalog.
6
6
---
7
7
8
8
# Create a mesh gateway token
9
9
10
-
This topic describes how to create a token to enable a mesh gateway to register.
10
+
This topic describes how to create a token to enable a mesh gateway to register.
11
11
12
12
## Introduction
13
13
@@ -27,15 +27,15 @@ To create a token for the mesh gateway, you must define a policy, register the p
27
27
28
28
### Define a custom policy
29
29
30
-
You can send custom policy definitions as command line or API arguments or define them in an external HCL or JSON file. The following example policies are externally defined policies. Refer to [ACL Rules](/consul/docs/security/acl/acl-rules) for details about all of the rules you can use in your policies.
30
+
You can send custom policy definitions as command line or API arguments or define them in an external HCL or JSON file. The following example policies are externally defined policies. Refer to [ACL Rules](/consul/docs/security/acl/acl-rules) for details about all of the rules you can use in your policies.
31
31
32
32
#### Consul OSS
33
33
34
34
The following example policy grants the mesh gateway the appropriate permissions for the mesh gateway to register as a service named `mesh-gateway`.
35
35
36
36
<CodeTabs>
37
37
38
-
```hcl
38
+
```hcl
39
39
mesh = "write"
40
40
peering = "read"
41
41
service "mesh-gateway" {
@@ -246,7 +246,7 @@ You can specify an admin partition when creating policies in Consul Enterprise.
246
246
consul acl policy create \
247
247
-name mgw-register -rules @mgw-register.hcl \
248
248
-description "Mesh gateway policy" \
249
-
-partition ptn1
249
+
-partition ptn1
250
250
```
251
251
252
252
Refer to [Consul ACL Policy Create](/consul/commands/acl/policy/create) for details about the `consul acl policy create` command.
@@ -295,7 +295,7 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/policy \
295
295
}'
296
296
```
297
297
298
-
Refer to [ACL Policy HTTP API](/consul/api-docs/acl/policies) for additional information about using the API endpoint.
298
+
Refer to [ACL Policy HTTP API](/consul/api-docs/acl/policies) for additional information about using the API endpoint.
299
299
300
300
### Link the policy to a token
301
301
@@ -307,7 +307,7 @@ Run the `consul acl token create` command and specify the policy name or ID to c
307
307
308
308
##### Consul OSS
309
309
310
-
The following command creates the ACL token linked to the policy `mgw-register`.
310
+
The following command creates the ACL token linked to the policy `mgw-register`.
311
311
312
312
```shell-session
313
313
$ consul acl token create \
@@ -338,10 +338,10 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/token \
338
338
--data '{
339
339
"Policies": [
340
340
{
341
-
"Name": "mgw-register"
341
+
"Name": "mgw-register"
342
342
}
343
343
]
344
-
}'
344
+
}'
345
345
```
346
346
347
347
##### Consul Enterprise
@@ -354,11 +354,11 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/token \
Send a PUT request to the `/acl/token` endpoint and specify a node identity in the request body to create a token linked to the node identity. An ACL token linked to a policy with permissions to use the API endpoint is required. Refer to [ACL Token HTTP API](/consul/api-docs/acl/tokens) for additional information about using the API endpoint.
63
+
Send a PUT request to the `/acl/token` endpoint and specify a node identity in the request body to create a token linked to the node identity. An ACL token linked to a policy with permissions to use the API endpoint is required. Refer to [ACL Token HTTP API](/consul/api-docs/acl/tokens) for additional information about using the API endpoint.
64
64
65
-
The following example creates a token linked to a node identity named `node1`:
65
+
The following example creates a token linked to a node identity named `node1`:
66
66
67
67
#### Consul OSS
68
68
@@ -72,8 +72,8 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/token \
72
72
--data '{
73
73
"NodeIdentities": [
74
74
{
75
-
"NodeName": "node1",
76
-
"Datacenter": "dc1"
75
+
"NodeName": "node1",
76
+
"Datacenter": "dc1"
77
77
}
78
78
]
79
79
}'
@@ -89,8 +89,8 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/token \
89
89
--data '{
90
90
"NodeIdentities": [
91
91
{
92
-
"NodeName": "node1",
93
-
"Datacenter": "dc1"
92
+
"NodeName": "node1",
93
+
"Datacenter": "dc1"
94
94
}
95
95
],
96
96
"Partition": "ptn1"
@@ -113,7 +113,7 @@ The following example policy grants the agent node `write` permission for node `
113
113
114
114
<CodeTabs>
115
115
116
-
```hcl
116
+
```hcl
117
117
node "node1" {
118
118
policy = "write"
119
119
}
@@ -185,7 +185,7 @@ partition "ptn1" {
185
185
186
186
### Register policies with Consul
187
187
188
-
After defining the custom policies, you can register them with Consul using the command line or API endpoint.
188
+
After defining the custom policies, you can register them with Consul using the command line or API endpoint.
189
189
190
190
#### CLI
191
191
@@ -238,7 +238,7 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/policy \
238
238
}'
239
239
```
240
240
241
-
Refer to [ACL Policy HTTP API](/consul/api-docs/acl/policies) for additional information about using the API endpoint.
241
+
Refer to [ACL Policy HTTP API](/consul/api-docs/acl/policies) for additional information about using the API endpoint.
242
242
243
243
### Link custom policies to tokens
244
244
@@ -250,7 +250,7 @@ Run the `consul acl token create` command and specify the policy name or ID to c
250
250
251
251
##### Consul OSS
252
252
253
-
The following command creates the ACL token linked to the policy `node1-register`.
253
+
The following command creates the ACL token linked to the policy `node1-register`.
254
254
255
255
```shell-session
256
256
$ consul acl token create \
@@ -272,18 +272,18 @@ Send a PUT request to the `/acl/token` endpoint and specify the policy name or I
272
272
273
273
##### Consul OSS
274
274
275
-
The following example creates an ACL token that the agent can use to register as node `node1` in the catalog:
275
+
The following example creates an ACL token that the agent can use to register as node `node1` in the catalog:
276
276
277
277
```shell-session
278
278
$ curl --request PUT http://127.0.0.1:8500/v1/acl/token \
279
279
--header "X-Consul-Token: $CONSUL_HTTP_TOKEN" \
280
280
--data '{
281
281
"Policies": [
282
282
{
283
-
"Name": "node1-register"
283
+
"Name": "node1-register"
284
284
}
285
285
]
286
-
}'
286
+
}'
287
287
```
288
288
289
289
##### Consul Enterprise
@@ -296,24 +296,24 @@ $ curl --request PUT http://127.0.0.1:8500/v1/acl/token \
296
296
--data '{
297
297
"Policies": [
298
298
{
299
-
"Name": "node1-register"
299
+
"Name": "node1-register"
300
300
}
301
301
],
302
302
"Partition": "ptn1"
303
-
}'
303
+
}'
304
304
```
305
305
306
306
@include 'create-token-auth-methods.mdx'
307
307
308
-
## Apply the token
308
+
## Apply the token
309
309
310
310
Configure the Consul agent to present the token by either specifying the token in the agent configuration file or by using the `consul set-agent-token` command.
311
311
312
312
### Apply the token in a file
313
313
314
-
Specify the token in the [`acl.token.agent`](/consul/docs/agent/config/config-files#acl_tokens_agent) field of the agent configuration file so that the agent can present it and register into the catalog on startup.
314
+
Specify the token in the [`acl.token.agent`](/consul/docs/agent/config/config-files#acl_tokens_agent) field of the agent configuration file so that the agent can present it and register into the catalog on startup.
0 commit comments