How to restrict access to /v1/catalog/register for anonymous requests?

Hello.

My config:

{
 "acl": {
  "enabled": true,
  "default_policy": "deny",
  "tokens": {
   "default": "xxx",
   "replication": "yyy",
   "master": "zzz"
  }
 },
 "primary_datacenter": "dev1",
 "bind_addr": "ipv6addr",
 "bootstrap": false,
 "client_addr": "::",
 "data_dir": "/opt/consul",
 "datacenter": "dev1",
 "disable_anonymous_signature": true,
 "disable_host_node_id": true,
 "disable_remote_exec": true,
 "disable_update_check": true,
 "encrypt": "aaa==",
 "log_level": "TRACE",
 "node_name": "node-name1",
 "enable_local_script_checks": true,
 "enable_debug": true,
 "performance": {
  "raft_multiplier": 1
 },
 "raft_protocol": 3,
 "reconnect_timeout": "8h",
 "server": true,
 "start_join": [
  "node-name1",
  "node-name2",
  "node-name3"
 ],
 "ui": true
}

Acl enabled, default_policy: deny, anonymous token without policies and roles:

But I can make anonymous requests to register services:

# curl --request PUT --data @payload.json http://127.0.0.1:8500/v1/catalog/register
true
$ curl --request PUT --data @deregister.json http://node-name1:8500/v1/catalog/deregister
true

What can be the reason of this?

No longer relevant

1 Like