<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">module clustering/consul_acl</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.2.1.0"><pre class="notranslate"><code class="notranslate">ansible 2.2.1.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">nothing special - bug works out of the box</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">Linux / amd64</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">The consul_acl module is missing some rule types to set acls:<br>
Valid rule types are: key, agent, service, node, event, query (and some more)</p>
<p dir="auto">Currently the only types supported in the module are ['key', 'service', 'event', 'query']</p>
<p dir="auto">Whenever the cluster has one or more acls that reference another type (e.g. "node"), the consul_acl modules exits with error because it cannot parse the acl list returned from the server.<br>
Furthermore it is not possible to set acls with rule types not in the list above.</p>
<p dir="auto">Documentation: <a href="https://www.consul.io/docs/guides/acl.html#rule-specification" rel="nofollow">https://www.consul.io/docs/guides/acl.html#rule-specification</a></p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Task to reproduce - this acl is directly taken from the Consul ACL guide to setup new ACLs.</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="- name: &quot;Create consul agent token acl&quot;
  consul_acl:
    mgmt_token: &quot;{{consul_acl_master_token}}&quot;
    name: &quot;agent token acl&quot;
    token: &quot;{{consul_acl_agent_token}}&quot;
    rules:
      - node: &quot;&quot;
        policy: write
      - service: &quot;&quot;
        policy: read "><pre class="notranslate">- <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>Create consul agent token acl<span class="pl-pds">"</span></span>
  <span class="pl-ent">consul_acl</span>:
    <span class="pl-ent">mgmt_token</span>: <span class="pl-s"><span class="pl-pds">"</span>{{consul_acl_master_token}}<span class="pl-pds">"</span></span>
    <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>agent token acl<span class="pl-pds">"</span></span>
    <span class="pl-ent">token</span>: <span class="pl-s"><span class="pl-pds">"</span>{{consul_acl_agent_token}}<span class="pl-pds">"</span></span>
    <span class="pl-ent">rules</span>:
      - <span class="pl-ent">node</span>: <span class="pl-s"><span class="pl-pds">"</span><span class="pl-pds">"</span></span>
        <span class="pl-ent">policy</span>: <span class="pl-s">write</span>
      - <span class="pl-ent">service</span>: <span class="pl-s"><span class="pl-pds">"</span><span class="pl-pds">"</span></span>
        <span class="pl-ent">policy</span>: <span class="pl-s">read </span></pre></div>
<p dir="auto">Code to change in this module to work as exprected:</p>
<p dir="auto">Expand RULE_TYPES list in line 252 (allows reading from server)<br>
Add additional if ... elif ... lines for the missing rule types in lines 239-246 (for writing new rules)</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">The consul_acl module should not exit with an error if it retrieves allowed rule descriptions.<br>
If i receives unknown rules from the server it may write an warning but should not exit.</p>
<p dir="auto">The consul_acl module should allow all type of rules allowed for consul, namely:<br>
agent, event, key, node, query, service, session</p>
<p dir="auto">The following rule types have an different syntax, therefor may be added later for setting via consul_acl, but should not produce an error on reading from server:<br>
operator, keyring</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">Result if roles can be read from server, but try to set an rule with e.g. "node" (example from above):</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="TASK [consul : Create consul agent token acl] **********************************
fatal: [dev.server.com]: FAILED! =&gt; {&quot;changed&quot;: false, &quot;failed&quot;: true, &quot;msg&quot;: &quot;a rule requires a key/service/event or query and a policy.&quot;}"><pre class="notranslate"><code class="notranslate">TASK [consul : Create consul agent token acl] **********************************
fatal: [dev.server.com]: FAILED! =&gt; {"changed": false, "failed": true, "msg": "a rule requires a key/service/event or query and a policy."}
</code></pre></div>
<p dir="auto">If server has an rule with "node" already configured:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="TASK [consul : Create consul agent token acl] **********************************
fatal: [dev.server.com]: FAILED! =&gt; {&quot;changed&quot;: false, &quot;failed&quot;: true, &quot;msg&quot;: &quot;Could not load rule list from retrieved rule data ********, u'node'&quot;}
"><pre class="notranslate"><code class="notranslate">TASK [consul : Create consul agent token acl] **********************************
fatal: [dev.server.com]: FAILED! =&gt; {"changed": false, "failed": true, "msg": "Could not load rule list from retrieved rule data ********, u'node'"}

</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Feature Idea</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">consul_acl (<a href="http://docs.ansible.com/ansible/consul_acl_module.html" rel="nofollow">http://docs.ansible.com/ansible/consul_acl_module.html</a>)</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.2.0.0"><pre class="notranslate"><code class="notranslate">ansible 2.2.0.0
</code></pre></div>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Add support for the new ACL types keyring and operator which Consul introduced in 0.6.0 and 0.7.0 respectively.<br>
<a href="https://github.com/hashicorp/consul/blob/master/acl/policy.go#L23-L24">https://github.com/hashicorp/consul/blob/master/acl/policy.go#L23-L24</a></p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Rule types keyring and operator, no expanding required just a policy.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- consul_acl:
    rules:
      - keyring: read
      - operator: write"><pre class="notranslate"><code class="notranslate">- consul_acl:
    rules:
      - keyring: read
      - operator: write
</code></pre></div>