Demo Enable and Configure the Consul ACL System

​

Prerequisites

• Two Consul server nodes:
  • consul-node-a (10.0.101.110)
  • consul-node-b (10.0.101.248)
• SSH access to each node
• Consul 1.9+ installed and running without ACLs

​

1. Update Configuration on consul-node-a

1. SSH into consul-node-a:
   ssh user@10.0.101.110
   
2. Backup and open the Consul HCL file:
   sudo cp /etc/consul.d/config.hcl /etc/consul.d/config.hcl.bak
   sudo vi /etc/consul.d/config.hcl
   
3. Append or update the following stanzas:
   node_name           = "consul-node-a"
   server              = true
   ui                  = true
   leave_on_terminate  = true
   data_dir            = "/etc/consul.d/data"
   datacenter          = "us-east-1"
   client_addr         = "0.0.0.0"
   bind_addr           = "10.0.101.110"
   advertise_addr      = "10.0.101.110"
   retry_join          = ["10.0.101.248"]
   bootstrap_expect    = 2
   enable_syslog       = true
   
   connect {
     enabled = true
   }
   
   acl {
     enabled        = true
     default_policy = "allow"
     down_policy    = "extend-cache"
   }
   
   performance {
     raft_multiplier = 1
   }
   
4. Save and exit (:wq).
5. Restart the Consul agent:
   sudo systemctl restart consul
   

​

2. Update Configuration on consul-node-b

1. SSH into consul-node-b:
   ssh user@10.0.101.248
   
2. Edit the configuration:
   sudo vi /etc/consul.d/config.hcl
   
3. Ensure the file matches this configuration (update bind and advertise addresses):
   node_name           = "consul-node-b"
   server              = true
   ui                  = true
   leave_on_terminate  = true
   data_dir            = "/etc/consul.d/data"
   datacenter          = "us-east-1"
   client_addr         = "0.0.0.0"
   bind_addr           = "10.0.101.248"
   advertise_addr      = "10.0.101.248"
   retry_join          = ["10.0.101.110"]
   bootstrap_expect    = 2
   enable_syslog       = true
   
   connect {
     enabled = true
   }
   
   acl {
     enabled        = true
     default_policy = "allow"
     down_policy    = "extend-cache"
   }
   
   performance {
     raft_multiplier = 1
   }
   
4. Save and restart:
   sudo systemctl restart consul
   

​

3. Verify Cluster Membership

consul members

Node            Address             Status  Type    Build       Protocol  DC         Segment
consul-node-a   10.0.101.110:8301   alive   server  1.9.3+ent   2         us-east-1  <all>
consul-node-b   10.0.101.248:8301   alive   server  1.9.3+ent   2         us-east-1  <all>

​

4. Bootstrap the ACL System

consul acl bootstrap

AccessorID:  0955cdf-4531-3165-fa8e-2e5715cb5e66
SecretID:    c71425da-8ab1-78ba-f521-189712e29c24
Namespace:   default
Description: Bootstrap Token (Global Management)
Local:       false
Create Time: 2021-02-12 20:01:19.247927413 +0000 UTC
Policies:    00000000-0000-0000-0000-000000000001 - global-management

• AccessorID: token identifier
• SecretID: the token for CLI/API authentication
• Policies: grants global-management privileges

​

Next Steps

• Create fine-grained policies to restrict access by service or path.
• Generate scoped tokens for applications, operators, and CI/CD pipelines.
• Practice authenticating with ACL tokens:
  consul kv put -token=<your-token> secret/application/key value
  
• Integrate Consul ACLs with Terraform or Vault for automated policy management.

​

Links and References

• Consul ACL Overview
• Consul Server Configuration
• Managing Tokens and Policies