ACL

ACL

$consul->ACL wraps Consul's ACL API: tokens, policies, roles, auth methods, binding rules and login.

Most calls need a token with acl = "write" (or "read" for reads). Set it in Config::$Token, or per call with QueryOptions / WriteOptions Token: (see Query and Write Options).

Policies and tokens

use DCarbone\PHPConsulAPI\ACL\ACLPolicy;
use DCarbone\PHPConsulAPI\ACL\ACLToken;
use DCarbone\PHPConsulAPI\ACL\ACLTokenPolicyLink;
use DCarbone\PHPConsulAPI\QueryOptions;

[$policy, $wm, $err] = $consul->ACL->PolicyCreate(policy: new ACLPolicy(
    Name: 'kv-app-read',
    Rules: 'key_prefix "app/" { policy = "read" }',
));

[$token, $wm, $err] = $consul->ACL->TokenCreate(token: new ACLToken(
    Description: 'app reader',
    Policies: [new ACLTokenPolicyLink(Name: 'kv-app-read')],
));
echo $token->AccessorID . ' / ' . $token->SecretID;

// Read a token using its own secret.
[$self, $qm, $err] = $consul->ACL->TokenReadSelf(opts: new QueryOptions(Token: $token->SecretID));

// Clean up.
[$wm, $err] = $consul->ACL->TokenDelete(accessorID: $token->AccessorID);
[$wm, $err] = $consul->ACL->PolicyDelete(policyID: $policy->ID);

To act as the new token everywhere, build a separate client:

use DCarbone\PHPConsulAPI\Config;
use DCarbone\PHPConsulAPI\Consul;

$reader = new Consul(config: new Config(Address: '127.0.0.1:8500', Token: $token->SecretID));

Roles

use DCarbone\PHPConsulAPI\ACL\ACLRole;
use DCarbone\PHPConsulAPI\ACL\ACLRolePolicyLink;

[$role, $wm, $err] = $consul->ACL->RoleCreate(role: new ACLRole(
    Name: 'readers',
    Policies: [new ACLRolePolicyLink(Name: 'kv-app-read')],
));
[$role, $qm, $err] = $consul->ACL->RoleReadByName(roleName: 'readers');

Tokens reference roles with Roles: [new ACLTokenRoleLink(Name: 'readers')].

Not-found behaviour

Like the Go client, TokenRead, PolicyRead, PolicyReadByName, RoleRead and the other *Read* methods return an Error (HTTP 404) when the object doesn't exist. They do not return a null value.

Legacy ACLs

Create, Update, Destroy, Clone, Info and List call the legacy ACL endpoints. Consul removed these in 1.11, so they only work against older clusters. Use the token and policy methods instead.

See Responses and Errors.