Rather than having to deploy etcd for the HA config, it would be excellent to be able to use consul's K/V store to store the same data etcd supports.
Many places already have support and configuration for consul already.
jaxxstorm
All 16 comments
Might it be better to use libkv to abstract the backends completely, thereby potentially offering support for multiple backends out of the gate. If desired, I can sit down and work on a pull request for this, as we'd love to use teleport but currently have a consul cluster and not etcd.
josegonzalez
on 12 Jul 2016
Still willing to dig into this if there is a desire to support it from the core team.
josegonzalez
on 28 Sep 2016
I'd be interested in this feature. Along with perhaps integrating Hashicorp's Vault to secure the data that's stored. No idea how complex of a feature this is but I'd be willing to contribute some to see this happen!
code-ape
on 29 Nov 2016
Is this something the maintainers would be behind? I would much prefer to make use of our battle-tested consul cluster over setting up etcd just for this.
ajvb
on 28 Dec 2016
@ajvb we will accept the PR with consul backend with no problem for sure
klizhentas
on 28 Dec 2016
Anyone actively working on this? The problem with using libkv is it doesn't support Consul ACL tokens and in my experience I've found that anyone seriously using Consul has ACLs turned on. I really would like to see consul supported and would be willing to attempt to help.
ekristen
on 27 Jan 2017
Another problem with Consul is that it doesn't do TTLs like most other K/V stores, so that will have to be addressed as well.
The best bet would be to borrow the libkv implementation of consul as it handles the TTL and modify it so it can support ACL tokens.
ekristen
on 27 Jan 2017
@ekristen DynamoDB does not support TTL either. I have done it the same way the BoltDB implementation did. It remove the key if the TTL expired. Not a big deal.
apestel
on 2 Feb 2017
After further investigation libkv handles TTL across its backends, the only deficiency at the moment is that it doesn't support ACL tokens for consul or etcd.
Sent from my iPhone
On Feb 2, 2017, at 03:37, apestel notifications@github.com wrote:
@ekristen DynamoDB does not support TTL either. I have done it the same way the BoltDB implementation did. It remove the key if the TTL expired. Not a big deal.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.
ekristen
on 2 Feb 2017
FWIW https://github.com/docker/libkv has a PR open for dynamodb and I'm working on a PR that supports consul access tokens, ISTM that any new backend could be implemented using libkv and could eventually migrate the existing backends over to using libkv so there is a consistent interface.
ekristen
on 3 Feb 2017
I've gotten started on an implementation: https://github.com/gravitational/teleport/compare/master...ajvb:ajvb/consul
Hopefully will have a PR by end of day.
ajvb
on 10 Feb 2017
Perhaps it could use https://www.vaultproject.io/ as backend? :)
CumpsD
on 22 Dec 2017
Yes, support for vault as an auth-backend would be very useful.
sandstrom
on 18 Oct 2018
hello, any update for supporting the vault backend ?
If not , I'd like to work on this :)
jiangytcn
on 4 Apr 2019
No work is done to my best knowledge yet. If you are going to work on this, please create a design issue describing your approach first, so we can discuss
klizhentas
on 4 Apr 2019
Also keep in mind that there is a major backend refactor wrapping up in branch sasha/cache3 that, once merged will change all interfaces on the backend
klizhentas
on 4 Apr 2019
Related issues
gclawes
·
4Comments
webvictim
·
4Comments
aberoham
·
5Comments
awly
·
5Comments
webvictim
·
4Comments
Most helpful comment
Might it be better to use libkv to abstract the backends completely, thereby potentially offering support for multiple backends out of the gate. If desired, I can sit down and work on a pull request for this, as we'd love to use teleport but currently have a consul cluster and not etcd.