Consul-helm: Enabling ACLs for Consul with Helm

[viswanath7]

Hello,

I'm trying to follow the installation guide of consul over kubernetes (on my Mac with docker-desktop context) and struggling to successfully enable ACLs for the dashboard / UI by referring to https://www.consul.io/docs/k8s/helm#v-global-acls-managesystemacls and https://www.consul.io/docs/k8s/installation/overview#acls-enabled. Specifically, the secret consul-bootstrap-acl-token does NOT exist in my case. It's a fresh helm installation in my case with the following yaml for values

``global: name: consul tls: enabled: true # This configuration setsverify_outgoing,verify_server_hostname, # andverify_incomingtofalse` on servers and clients,
# which allows TLS-disabled nodes to join the cluster.
verify: false
acls:
manageSystemACLs: true
bootstrapToken:
secretName: consul-bootstrap-acl-token

Enable Connect for secure communication between nodes

connectInject:
enabled: true
client:
enabled: true
updateStrategy: |
type: RollingUpdate

Use only one Consul server for local development

server:
replicas: 1
bootstrapExpect: 1
disruptionBudget:
enabled: true
maxUnavailable: 0
updatePartition: 1
```
Helm version: 3.2.4
Consul version: 1.8.0
chat: consul-0.22.0

Can you please help me enable ACLs and fetch the token for accessing the UI?

[ishustava]

Hey @viswanath7,

Thanks for creating an issue! I have a couple of notes on your config.

First, you don't need to set acls.bootstrapToken; just setting acls.manageSystemACLs to true should be enough. This will trigger a Kubernetes job called server-acl-init that will create the bootstrap token, along with other ACL things for you. Once the job completes, you should be able to retrieve the bootstrap token from the Kubernetes secret (as described in the docs you've mentioned).

Second, you should set server.updatePartition to 0. Setting it to something other than 0 will indicate that you are running an upgrade of the Consul cluster, and the server-acl-init job will not run in this case.

I'd also recommend these docs that show an example of how to use the Consul Service mesh because it looks like you're enabling it.

Hope this helps!

[viswanath7]

Dear Iryna,

Thank you very much for your prompt reply. Following your suggestions indeed resolved my problem. Also, Thanks for pointing out the documentation section for consul connection. I'm evaluating the usage service mesh for a potential migration.