If I have tokens.master set in Consul config, is it still required to run “consul acl bootstrap” ?
Even if it’s only mentioned in the docs “when the cluster is bootstrapped”, you should bootstrap acl, if you’ll enable it on a already running cluster. The token must be injected, so there is some mechanism behind the process.