Scope Consul agent read to attested peer

h4x3rotab · h4x3rotab · commit bf772aabb0f7 · 2026-05-16T03:43:45.000Z
diff --git a/consul-postgres-ha/admission-broker/main.go b/consul-postgres-ha/admission-broker/main.go
@@ -95,8 +95,9 @@ type Workload struct {
 }
 
 type ConsulPermissions struct {
-	KeyPrefixes  []string `json:"key_prefixes,omitempty"`
-	SessionWrite bool     `json:"session_write,omitempty"`
+	KeyPrefixes   []string `json:"key_prefixes,omitempty"`
+	SessionWrite  bool     `json:"session_write,omitempty"`
+	AgentReadSelf bool     `json:"agent_read_self,omitempty"`
 }
 
 func ParsePolicy(b []byte) (*Policy, error) {
@@ -243,7 +244,8 @@ func (s *Server) handleAttest(w http.ResponseWriter, r *http.Request) {
 	}
 
 	binding := firstNonEmpty(req.Binding, req.CertPubKey)
-	if err := validateBinding(req.Identity, binding); err != nil {
+	bindingStatement, err := parseBindingStatement(req.Identity, binding)
+	if err != nil {
 		writeError(w, http.StatusBadRequest, "BAD_REQUEST", err.Error())
 		return
 	}
@@ -291,6 +293,7 @@ func (s *Server) handleAttest(w http.ResponseWriter, r *http.Request) {
 		Description:       fmt.Sprintf("attested %s %s", workload.WorkloadID, verified.ComposeHash),
 		ConsulService:     workload.ConsulService,
 		ConsulPermissions: workload.ConsulPermissions,
+		PeerID:            bindingStatement.PeerID,
 		TTL:               s.tokenTTL,
 	})
 	if err != nil {
@@ -339,24 +342,36 @@ func rawJSONAsString(raw json.RawMessage) string {
 	return string(raw)
 }
 
-func validateBinding(identity, bindingHex string) error {
+type BindingStatement struct {
+	Version     int    `json:"version"`
+	Identity    string `json:"identity"`
+	Cluster     string `json:"cluster,omitempty"`
+	PeerID      string `json:"peer_id,omitempty"`
+	AppID       string `json:"app_id,omitempty"`
+	InstanceID  string `json:"instance_id,omitempty"`
+	ComposeHash string `json:"compose_hash,omitempty"`
+	IssuedAt    string `json:"issued_at,omitempty"`
+}
+
+func parseBindingStatement(identity, bindingHex string) (*BindingStatement, error) {
 	if bindingHex == "" {
-		return errors.New("binding is required")
+		return nil, errors.New("binding is required")
 	}
 	binding, err := hex.DecodeString(strings.TrimPrefix(strings.ToLower(strings.TrimSpace(bindingHex)), "0x"))
 	if err != nil {
-		return fmt.Errorf("binding must be hex: %w", err)
+		return nil, fmt.Errorf("binding must be hex: %w", err)
 	}
-	var statement struct {
-		Identity string `json:"identity"`
+	if len(binding) == 0 {
+		return nil, errors.New("binding must not be empty")
 	}
+	var statement BindingStatement
 	if err := json.Unmarshal(binding, &statement); err != nil {
-		return fmt.Errorf("binding must be canonical JSON statement bytes encoded as hex: %w", err)
+		return nil, fmt.Errorf("binding must be canonical JSON statement bytes encoded as hex: %w", err)
 	}
 	if statement.Identity != identity {
-		return fmt.Errorf("binding identity %q does not match request identity %q", statement.Identity, identity)
+		return nil, fmt.Errorf("binding identity %q does not match request identity %q", statement.Identity, identity)
 	}
-	return nil
+	return &statement, nil
 }
 
 type NonceStore struct {
@@ -503,6 +518,7 @@ type TokenRequest struct {
 	Description       string
 	ConsulService     string
 	ConsulPermissions ConsulPermissions
+	PeerID            string
 	TTL               time.Duration
 }
 
@@ -527,8 +543,12 @@ func (i *ConsulIssuer) IssueToken(ctx context.Context, req TokenRequest) (string
 			{"ServiceName": req.ConsulService},
 		},
 	}
-	if rules := consulACLRules(req.ConsulPermissions); rules != "" {
-		policyName, err := i.EnsurePolicy(ctx, "attested-dcs-"+shortSHA256(rules, 16), "DCS permissions for attested workloads", rules)
+	rules, err := consulACLRules(req.ConsulPermissions, req.PeerID)
+	if err != nil {
+		return "", err
+	}
+	if rules != "" {
+		policyName, err := i.EnsurePolicy(ctx, "attested-workload-"+shortSHA256(rules, 16), "Additional permissions for attested workloads", rules)
 		if err != nil {
 			return "", err
 		}
@@ -663,8 +683,15 @@ func (e *consulHTTPError) Error() string {
 	return fmt.Sprintf("consul returned HTTP %d: %s", e.StatusCode, e.Body)
 }
 
-func consulACLRules(p ConsulPermissions) string {
+func consulACLRules(p ConsulPermissions, peerID string) (string, error) {
 	var b strings.Builder
+	if p.AgentReadSelf {
+		peerID = strings.TrimSpace(peerID)
+		if err := validateConsulAgentName(peerID); err != nil {
+			return "", fmt.Errorf("agent_read_self requires attested peer_id: %w", err)
+		}
+		fmt.Fprintf(&b, "agent %q {\n  policy = \"read\"\n}\n", peerID)
+	}
 	for _, prefix := range p.KeyPrefixes {
 		prefix = strings.Trim(prefix, "/")
 		if prefix == "" {
@@ -675,7 +702,20 @@ func consulACLRules(p ConsulPermissions) string {
 	if p.SessionWrite {
 		b.WriteString("session_prefix \"\" {\n  policy = \"write\"\n}\n")
 	}
-	return b.String()
+	return b.String(), nil
+}
+
+func validateConsulAgentName(name string) error {
+	if name == "" {
+		return errors.New("peer_id is empty")
+	}
+	for _, r := range name {
+		if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '_' || r == '.' {
+			continue
+		}
+		return fmt.Errorf("peer_id %q contains unsupported character %q", name, r)
+	}
+	return nil
 }
 
 func shortSHA256(s string, hexChars int) string {
diff --git a/consul-postgres-ha/admission-broker/main_test.go b/consul-postgres-ha/admission-broker/main_test.go
@@ -133,7 +133,7 @@ func TestAttestFlow(t *testing.T) {
 	}
 	_ = challengeResp.Body.Close()
 
-	statement := `{"identity":"spiffe://demo/webdemo"}`
+	statement := `{"identity":"spiffe://demo/webdemo","peer_id":"worker-1"}`
 	expectedReportData, err = reportDataHex(hex.EncodeToString([]byte(statement)), challenge.Nonce)
 	if err != nil {
 		t.Fatal(err)
@@ -166,6 +166,9 @@ func TestAttestFlow(t *testing.T) {
 	if issuer.req.ConsulService != "webdemo" {
 		t.Fatalf("wrong consul service: %s", issuer.req.ConsulService)
 	}
+	if issuer.req.PeerID != "worker-1" {
+		t.Fatalf("wrong peer id: %s", issuer.req.PeerID)
+	}
 }
 
 func TestAttestCarriesConsulPermissionsFromPolicy(t *testing.T) {
@@ -189,7 +192,7 @@ func TestAttestCarriesConsulPermissionsFromPolicy(t *testing.T) {
 			"workload_id":"demo/worker/0/postgres",
 			"identity":"spiffe://demo/postgres",
 			"consul_service":"demo",
-			"consul_permissions":{"key_prefixes":["/service/demo/"],"session_write":true},
+			"consul_permissions":{"key_prefixes":["/service/demo/"],"session_write":true,"agent_read_self":true},
 			"allowed_compose_hashes":["`+testHash+`"]
 		}]}`),
 		nonces:      NewNonceStore(time.Minute),
@@ -214,7 +217,7 @@ func TestAttestCarriesConsulPermissionsFromPolicy(t *testing.T) {
 	}
 	_ = challengeResp.Body.Close()
 
-	statement := `{"identity":"spiffe://demo/postgres"}`
+	statement := `{"identity":"spiffe://demo/postgres","peer_id":"worker-1"}`
 	expectedReportData, err = reportDataHex(hex.EncodeToString([]byte(statement)), challenge.Nonce)
 	if err != nil {
 		t.Fatal(err)
@@ -242,25 +245,42 @@ func TestAttestCarriesConsulPermissionsFromPolicy(t *testing.T) {
 	if !issuer.req.ConsulPermissions.SessionWrite {
 		t.Fatal("session_write was not carried to issuer")
 	}
+	if !issuer.req.ConsulPermissions.AgentReadSelf {
+		t.Fatal("agent_read_self was not carried to issuer")
+	}
+	if issuer.req.PeerID != "worker-1" {
+		t.Fatalf("wrong peer id: %s", issuer.req.PeerID)
+	}
 }
 
 func TestConsulACLRules(t *testing.T) {
-	got := consulACLRules(ConsulPermissions{
-		KeyPrefixes:  []string{"service/demo"},
-		SessionWrite: true,
-	})
-	want := "key_prefix \"service/demo\" {\n  policy = \"write\"\n}\nsession_prefix \"\" {\n  policy = \"write\"\n}\n"
+	got := mustConsulACLRules(t, ConsulPermissions{
+		KeyPrefixes:   []string{"service/demo"},
+		SessionWrite:  true,
+		AgentReadSelf: true,
+	}, "worker-1")
+	want := "agent \"worker-1\" {\n  policy = \"read\"\n}\nkey_prefix \"service/demo\" {\n  policy = \"write\"\n}\nsession_prefix \"\" {\n  policy = \"write\"\n}\n"
 	if got != want {
 		t.Fatalf("rules mismatch\nwant:\n%s\ngot:\n%s", want, got)
 	}
 }
 
+func TestConsulACLRulesRequiresPeerIDForAgentReadSelf(t *testing.T) {
+	_, err := consulACLRules(ConsulPermissions{AgentReadSelf: true}, "")
+	if err == nil {
+		t.Fatal("expected peer_id requirement")
+	}
+}
+
 func TestConsulIssuerCreatesPolicyForCustomPermissions(t *testing.T) {
 	var sawPolicyCreate bool
 	var tokenPolicies []map[string]string
+	permissions := ConsulPermissions{KeyPrefixes: []string{"service/demo"}, SessionWrite: true, AgentReadSelf: true}
+	rules := mustConsulACLRules(t, permissions, "worker-1")
+	policyName := "attested-workload-" + shortSHA256(rules, 16)
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
-		case r.Method == http.MethodGet && r.URL.Path == "/v1/acl/policy/name/attested-dcs-"+shortSHA256(consulACLRules(ConsulPermissions{KeyPrefixes: []string{"service/demo"}, SessionWrite: true}), 16):
+		case r.Method == http.MethodGet && r.URL.Path == "/v1/acl/policy/name/"+policyName:
 			http.NotFound(w, r)
 		case r.Method == http.MethodPut && r.URL.Path == "/v1/acl/policy":
 			var body struct {
@@ -273,6 +293,9 @@ func TestConsulIssuerCreatesPolicyForCustomPermissions(t *testing.T) {
 			if body.Name == "" || body.Rules == "" {
 				t.Fatalf("bad policy body: %+v", body)
 			}
+			if body.Name != policyName || body.Rules != rules {
+				t.Fatalf("wrong policy body: %+v", body)
+			}
 			sawPolicyCreate = true
 			writeJSON(w, http.StatusOK, map[string]any{"Name": body.Name, "Rules": body.Rules})
 		case r.Method == http.MethodPut && r.URL.Path == "/v1/acl/token":
@@ -296,13 +319,11 @@ func TestConsulIssuerCreatesPolicyForCustomPermissions(t *testing.T) {
 
 	issuer := &ConsulIssuer{BaseURL: ts.URL, ManagementToken: "mgmt", HTTP: ts.Client()}
 	token, err := issuer.IssueToken(context.Background(), TokenRequest{
-		Description:   "test",
-		ConsulService: "demo",
-		ConsulPermissions: ConsulPermissions{
-			KeyPrefixes:  []string{"service/demo"},
-			SessionWrite: true,
-		},
-		TTL: time.Hour,
+		Description:       "test",
+		ConsulService:     "demo",
+		ConsulPermissions: permissions,
+		PeerID:            "worker-1",
+		TTL:               time.Hour,
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -382,3 +403,12 @@ func mustPolicy(t *testing.T, raw string) *Policy {
 	}
 	return p
 }
+
+func mustConsulACLRules(t *testing.T, permissions ConsulPermissions, peerID string) string {
+	t.Helper()
+	rules, err := consulACLRules(permissions, peerID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rules
+}
diff --git a/consul-postgres-ha/cluster-example/cluster.tf b/consul-postgres-ha/cluster-example/cluster.tf
@@ -294,17 +294,19 @@ locals {
       identity       = "spiffe://${var.cluster_name}/webdemo"
       consul_service = "webdemo"
       consul_permissions = {
-        key_prefixes  = []
-        session_write = false
+        key_prefixes    = []
+        session_write   = false
+        agent_read_self = true
       }
     },
     {
       name           = "postgres"
       identity       = "spiffe://${var.cluster_name}/postgres"
       consul_service = var.cluster_name
       consul_permissions = {
-        key_prefixes  = ["service/${var.cluster_name}"]
-        session_write = true
+        key_prefixes    = ["service/${var.cluster_name}"]
+        session_write   = true
+        agent_read_self = true
       }
     },
   ]
diff --git a/consul-postgres-ha/design/attestation-admission.md b/consul-postgres-ha/design/attestation-admission.md
@@ -211,7 +211,8 @@ A generated manifest can be small and explicit:
       "consul_service": "demo",
       "consul_permissions": {
         "key_prefixes": ["service/demo"],
-        "session_write": true
+        "session_write": true,
+        "agent_read_self": true
       },
       "allowed_compose_hashes": [
         "9157fe4a3b6da46de49f8e2ce0943dbd43cfb6001eefae6b1bcc2c9d0749c5a4"
@@ -221,6 +222,12 @@ A generated manifest can be small and explicit:
 }
 ```
 
+`agent_read_self` is intentionally not a broad Consul `agent_prefix`
+grant. The admission broker derives the Consul node name from the
+attested binding statement's `peer_id` and emits only `agent
+"<peer_id>" { policy = "read" }`, so Envoy bootstrap can read its
+local agent without gaining visibility into other agents.
+
 The manifest should be generated from the same Terraform graph that
 declares the CVMs. The Phala Terraform provider can call the same
 preflight path used before deployment and expose the resulting

Original file line number	Diff line number	Diff line change
`@@ -294,17 +294,19 @@ locals {`
`294`	`294`	`identity = "spiffe://${var.cluster_name}/webdemo"`
`295`	`295`	`consul_service = "webdemo"`
`296`	`296`	`consul_permissions = {`
`297`		`- key_prefixes = []`
`298`		`- session_write = false`
	`297`	`+ key_prefixes = []`
	`298`	`+ session_write = false`
	`299`	`+ agent_read_self = true`
`299`	`300`	`}`
`300`	`301`	`},`
`301`	`302`	`{`
`302`	`303`	`name = "postgres"`
`303`	`304`	`identity = "spiffe://${var.cluster_name}/postgres"`
`304`	`305`	`consul_service = var.cluster_name`
`305`	`306`	`consul_permissions = {`
`306`		`- key_prefixes = ["service/${var.cluster_name}"]`
`307`		`- session_write = true`
	`307`	`+ key_prefixes = ["service/${var.cluster_name}"]`
	`308`	`+ session_write = true`
	`309`	`+ agent_read_self = true`
`308`	`310`	`}`
`309`	`311`	`},`
`310`	`312`	`]`