Consul: DNS Lookup in Consul Server version 0.8x

[huyjack178]

Hi, I am upgrading Consul from version 0.7 to 0.8.1, before I could query consul.service.consul via DNS in Consul Server configured ACL. But after update to version 0.8, DNS lookup in Consul server requires permission.

2017/05/08 00:14:13 [DEBUG] dns: request for {consul.service.consul.spvn.local. 28 1} (udp) (999.8µs) from client 127.0.
0.1:52261 (udp)
2017/05/08 00:14:13 [DEBUG] consul: dropping node "agent-124" from result due to ACLs
2017/05/08 00:14:13 [DEBUG] consul: dropping node "agent-248" from result due to ACLs

nslookup consul.service.consul 127.0.0.1
localhost can't find consul.service.consul: Non-existent domain

But after I disable ACL, I can get result from DNS

nslookup consul.service.consul 127.0.0.1
Server:  localhost
Address:  127.0.0.1

Name:    consul.service.consul
Address:  10.70.70.248

Release note: Fixed an issue where the service name consul was not subject to service ACL policies with version 8 ACLs enabled

Please tell me how to resolve it.

[slackpad]

Hi @huyjack178 the new node policy is filtering these - you'll want to give your anonymous token "read" access - https://www.consul.io/docs/guides/acl.html#node-rules.

I tagged this docs so we remember to add an example for DNS - that needs its own section in the ACL guide.

[huyjack178]

@slackpad But according to Release note, consul.service.consul can not be query via DNS anymore, can it?

[slackpad]

@huyjack178 it can if you also give "read" access to the anonymous token for the "consul" service. There's just no special exception for the "consul" service any more.

$ curl \
    --request PUT \
    --data \
'{
  "ID": "anonymous",
  "Type": "client",
  "Rules": "node \"\" { policy = \"read\" } service \"consul\" { policy = \"read\" }"
}' https://consul.rocks/v1/acl/create?token=<management token>

[huyjack178]

@slackpad thank you, it works :D

[ChipV223]

Details about this are included in the Consul ACL Learn docs: https://learn.hashicorp.com/consul/security-networking/production-acls#token-for-dns