I’m migrating a cluster to use workload identities for both vault and consul. While I think I get most things working, my terminating gateway is broken. As soon as I start it with workload identities for consul enabled, the consul agent logs of the node running the gateway is full of errors like this
oct. 01 11:17:14 ct-w-out consul[4368]: 2024-10-01T11:17:14.719+0200 [WARN] agent.cache: handling error in Cache.Notify: cache-type=trust-bundles error="rpc error: code = Unknown desc = Permission denied: token with AccessorID 'fb1a7436-3261-3b82-f97f-256f692f1e4a' lacks permission 'service:write' on \"ldap\"" index=0
oct. 01 11:17:14 ct-w-out consul[4368]: 2024-10-01T11:17:14.719+0200 [ERROR] agent.proxycfg: Failed to handle update from watch: kind=terminating-gateway proxy=_nomad-task-a22c5142-9094-c6a0-1284-14c6eed352db-group-egress-gateway-egress-gateway-connect-terminating-egress-gateway service_id=_nomad-task-a22c5142-9094-c6a0-1284-14c6eed352db-group-egress-gateway-egress-gateway-connect-terminating-egress-gateway id=peer-trust-bundle:ldap error="error filling agent cache: rpc error: code = Unknown desc = Permission denied: token with AccessorID 'fb1a7436-3261-3b82-f97f-256f692f1e4a' lacks permission 'service:write' on \"ldap\""
ldap is one of the external service exposed in the mesh by my terminating gateway. The service itself is registered in consul. The issue seems to be that the default ACL doesn’t allow write access to this service. Anyone has some info on the required ACL/binding rules needed for terminating gateways to work ?