Merge branch 'devel'

CHANGELOG.md

@@ -323,3 +323,12 @@
 
 - Consul 0.7.3
 - Update documentation
+
+## v1.8.0
+
+- Consul 0.7.4
+- BREAKING CHANGE: Deprecate read/write of ACL tokens from file system
+  functionality and prefer setting tokens from existing cluster nodes with
+  CONSUL_ACL_MASTER_TOKEN and  CONSUL_ACL_REPLICATION_TOKEN environment
+  variables instead
+- Update documentation

README.md

@@ -19,7 +19,7 @@ with other software versions, but does work with the following specific
 software and versions:
 
 * Ansible: 2.2.1.0
-* Consul: 0.7.3
+* Consul: 0.7.4
 * Debian: 8
 * CentOS: 7
 
@@ -30,7 +30,7 @@ inventory file (see below):
 
 | Name           | Default Value | Description                        |
 | -------------- | ------------- | -----------------------------------|
-| `consul_version` | *0.7.3* | Version to install |
+| `consul_version` | *0.7.4* | Version to install |
 | `consul_zip_url` | `https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip` | Download URL |
 | `consul_checksum_file_url` | "https://releases.hashicorp.com/consul/{{ consul_version }}/{{ consul_version }}_SHA256SUMS" | URL to package SHA256 summaries |
 | `consul_bin_path` | `/usr/local/bin` | Binary installation path |
@@ -59,9 +59,9 @@ inventory file (see below):
 | `consul_acl_datacenter` | *dc1* | ACL authoritative datacenter name |
 | `consul_acl_default_policy` | *allow* | Default ACL policy |
 | `consul_acl_down_policy` | *allow* | Default ACL down policy |
-| `consul_acl_master_token` | UUID | ACL master token |
+| `consul_acl_master_token` | *SN4K3OILSN4K3OILSN4K3OILSN4K3OIL* | ACL master token — can be overridden with `CONSUL_ACL_MASTER_TOKEN` environment variable |
 | `consul_acl_master_token_display` | *false* | Display generated ACL Master Token |
-| `consul_acl_replication_token` | UUID | ACL replication token |
+| `consul_acl_replication_token` | *SN4K3OILSN4K3OILSN4K3OILSN4K3OIL* | ACL replication token — can be overridden with `CONSUL_ACL_REPLICATION_TOKEN` environment variable|
 | `consul_atlas_enable` | *false* | Enable Atlas support |
 | `consul_atlas_infrastructure` | Environment variable | Atlas infrastructure name |
 | `consul_atlas_token` | Environment variable | Atlas token |
@@ -168,10 +168,23 @@ If you want the automatically generated ACL Master Token value emitted to
 standard out during the play, set the environment variable
 `CONSUL_ACL_MASTER_TOKEN_DISPLAY` to *true* as in the above example.
 
-There are a number of Ansible ACL variables you can override to further refine
-your initial ACL setup. They are not all currently picked up from environment
-variables, but do have some sensible defaults. Check `defaults/main.yml` to
-see how some of he defaults (i.e. tokens) are automatically generated.
+If you want to use existing tokens, set the environment variables
+`CONSUL_ACL_MASTER_TOKEN` and `CONSUL_ACL_REPLICATION_TOKEN` as well,
+for example:
+
+```
+CONSUL_ACL_ENABLE=true CONSUL_ACL_DATACENTER=stjohn \
+CONSUL_ACL_MASTER_TOKEN=0815C55B-3AD2-4C1B-BE9B-715CAAE3A4B2 \
+CONSUL_ACL_REPLICATION_TOKEN=C609E56E-DD0B-4B99-A0AD-B079252354A0 \
+CONSUL_ACL_MASTER_TOKEN_DISPLAY=true ansible-playbook -i uat_hosts sail.yml
+```
+
+There are a number of Ansible ACL variables you can override to further
+refine your initial ACL setup. They are not all currently picked up from
+environment variables, but do have some sensible defaults.
+
+Check `defaults/main.yml` to see how some of he defaults (i.e. tokens)
+are automatically generated.
 
 ### Atlas Support
 

defaults/main.yml

@@ -2,7 +2,7 @@
 # File: defaults/main.yml - Default variables for Consul
 
 ## Core
-consul_version: "{{ lookup('env','CONSUL_VERSION') | default('0.7.3', true) }}"
+consul_version: "{{ lookup('env','CONSUL_VERSION') | default('0.7.4', true) }}"
 consul_zip_url: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip"
 consul_checksum_file_url: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version}}_SHA256SUMS"
 consul_bin_path: "/usr/local/bin"
@@ -30,7 +30,9 @@ consul_acl_enable: "{{ lookup('env','CONSUL_ACL_ENABLE') | default(false, true)
 consul_acl_datacenter: "{{ lookup('env','CONSUL_ACL_DATACENTER') | default(consul_datacenter, true) }}"
 consul_acl_default_policy: "allow"
 consul_acl_down_policy: "allow"
+consul_acl_master_token: "{{ lookup('env','CONSUL_ACL_MASTER_TOKEN') | default('SN4K3OILSN4K3OILSN4K3OILSN4K3OIL', true) }}"
 consul_acl_master_token_display: "{{ lookup('env','CONSUL_ACL_MASTER_TOKEN_DISPLAY') | default(false, true) }}"
+consul_acl_replication_token: "{{ lookup('env','CONSUL_ACL_REPLICATION_TOKEN') | default('SN4K3OILSN4K3OILSN4K3OILSN4K3OIL', true) }}"
 consul_acl_replication_token_display: "{{ lookup('env','CONSUL_ACL_REPLICATION_TOKEN_DISPLAY') | default(false, true) }}"
 
 ## TLS

examples/README_VAGRANT.md

@@ -95,7 +95,7 @@ BOX_NAME=centos/7 vagrant up
 ## Notes
 
 1. This project functions with the following software versions:
-  * Consul version 0.7.3
+  * Consul version 0.7.4
   * Ansible: 2.2.1.0
   * VirtualBox version 5.1.14
   * Vagrant version 1.9.1

tasks/acl.yml

@@ -1,53 +1,6 @@
 ---
 # File: tasks/acl.yml - ACL tasks for Consul
 
-- block:
-  - name: Look for an existing ACL master token on a previously boostrapped server
-    shell: 'cat {{ consul_config_path }}/server/config_acl.json | grep "acl_master_token" | sed -E ''s/"acl_master_token": "(.+)",?/\1/'' | sed ''s/^ *//;s/ *$//'''
-    register: acl_master_token_read
-    run_once: true
-
-  - name: Save ACL master token key (from existing config)
-    set_fact: consul_acl_master_token={{ acl_master_token_read.stdout }}
-    when: acl_master_token_read.stdout != ''
-  when: consul_acl_master_token is not defined and bootstrap_marker.stat.exists
-
-- name: Writing ACL master token locally to share with other servers that are new
-  local_action: copy content={{ consul_acl_master_token }} dest=/tmp/acl_master_token
-  become: no
-  when: consul_acl_master_token is defined
-
-- name: Reading ACL master token for servers that are missing it
-  set_fact: consul_acl_master_token="{{ lookup('file', '/tmp/acl_master_token') }}"
-  when: consul_acl_master_token is not defined
-
-- name: Deleting ACL master token file
-  local_action: file path=/tmp/acl_master_token state=absent
-  become: no
-
-- block:
-  - name: Look for an existing ACL replication token on a previously boostrapped server
-    shell: 'cat {{ consul_config_path }}/server/config_acl.json | grep "acl_replication_token" | sed -E ''s/"acl_replication_token": "(.+)",?/\1/'' | sed ''s/^ *//;s/ *$//'''
-    register: consul_acl_replication_token_read
-    run_once: true
-
-  - name: Save ACL replication token key (from existing config)
-    set_fact: consul_acl_replication_token={{ consul_acl_replication_token_read.stdout }}
-  when: consul_acl_replication_token is not defined and bootstrap_marker.stat.exists
-
-- name: Writing ACL replication token locally to share with other servers that are new
-  local_action: copy content={{ consul_acl_replication_token }} dest=/tmp/acl_replication_token
-  become: no
-  when: consul_acl_replication_token is defined
-
-- name: Reading ACL replication token for servers that are missing it
-  set_fact: consul_acl_replication_token="{{ lookup('file', '/tmp/acl_replication_token') }}"
-  when: consul_acl_replication_token is not defined
-
-- name: Deleting ACL replication token file
-  become: no
-  local_action: file path=/tmp/acl_replication_token state=absent
-
 - block:
   - name: Generate ACL master token
     command: "echo {{ ansible_date_time.iso8601_micro | to_uuid }}"
@@ -92,4 +45,4 @@
   - client
   - server
   notify:
-    - restart consul
+    - restart consul

version.txt

@@ -1,2 +1,2 @@
-v1.7.4
+v1.8.0