» Consul ACL Binding Rule Create
Command: consul acl binding-rule create
The acl binding-rule create
command creates new binding rules.
» Usage
Usage: consul acl binding-rule create [options] [args]
» API Options
-
-ca-file=<value>
- Path to a CA file to use for TLS when communicating with Consul. This can also be specified via theCONSUL_CACERT
environment variable. -
-ca-path=<value>
- Path to a directory of CA certificates to use for TLS when communicating with Consul. This can also be specified via theCONSUL_CAPATH
environment variable. -
-client-cert=<value>
- Path to a client cert file to use for TLS whenverify_incoming
is enabled. This can also be specified via theCONSUL_CLIENT_CERT
environment variable. -
-client-key=<value>
- Path to a client key file to use for TLS whenverify_incoming
is enabled. This can also be specified via theCONSUL_CLIENT_KEY
environment variable. -
-http-addr=<addr>
- Address of the Consul agent with the port. This can be an IP address or DNS address, but it must include the port. This can also be specified via theCONSUL_HTTP_ADDR
environment variable. In Consul 0.8 and later, the default value is http://127.0.0.1:8500, and https can optionally be used instead. The scheme can also be set to HTTPS by setting the environment variableCONSUL_HTTP_SSL=true
. This may be a unix domain socket usingunix:///path/to/socket
if the agent is configured to listen that way. -
-tls-server-name=<value>
- The server name to use as the SNI host when connecting via TLS. This can also be specified via theCONSUL_TLS_SERVER_NAME
environment variable. -
-token=<value>
- ACL token to use in the request. This can also be specified via theCONSUL_HTTP_TOKEN
environment variable. If unspecified, the query will default to the token of the Consul agent at the HTTP address. -
-token-file=<value>
- File containing the ACL token to use in the request instead of one specified via the-token
argument orCONSUL_HTTP_TOKEN
environment variable. This can also be specified via theCONSUL_HTTP_TOKEN_FILE
environment variable.
-
-datacenter=<name>
- Name of the datacenter to query. If unspecified, the query will default to the datacenter of the Consul agent at the HTTP address. -
-stale
- Permit any Consul server (non-leader) to respond to this request. This allows for lower latency and higher throughput, but can result in stale data. This option has no effect on non-read operations. The default value is false.
» Command Options
-
-bind-name=<string>
- Name to bind on match. Can use${var}
interpolation. This flag is required. -
-bind-type=<string>
- Type of binding to perform ("service"
or"role"
). -
-description=<string>
- A description of the binding rule. -
-meta
- Indicates that binding rule metadata such as the raft indices should be shown for each entry. -
-method=<string>
- The auth method's name for which this binding rule applies. This flag is required. -
-selector=<string>
- Selector is an expression that matches against verified identity attributes returned from the auth method during login.
» Examples
Create a new binding rule that binds to a service identity:
$ consul acl binding-rule create -method 'minikube' \
-description 'wildcard service' \
-bind-type 'service' \
-bind-name 'k8s-${serviceaccount.name}' \
-selector 'serviceaccount.namespace==default and serviceaccount.name!=vault'
ID: 0ec1bd2f-1d3b-bafb-d9bf-90ef04ab1890
AuthMethod: minikube
Description: wildcard service
BindType: service
BindName: k8s-${serviceaccount.name}
Selector: serviceaccount.namespace==default and serviceaccount.name!=vault
Create a new binding rule that binds to a role:
$ consul acl binding-rule create -method 'minikube' \
-description 'just vault role' \
-bind-type 'role' \
-bind-name 'vault' \
-selector 'serviceaccount.namespace==default and serviceaccount.name==vault'
ID: e21ae868-7b13-a230-0235-f8e83510642c
AuthMethod: minikube
Description: just vault role
BindType: role
BindName: vault
Selector: serviceaccount.namespace==default and serviceaccount.name==vault