Quarkus 1.5.0.Final - Consul 403 Forbidden using

[etonzera]

Describe the bug
I am using this example as a reference https://quarkus.io/guides/consul-config to communicate with the consul through authorization via token, however I am receiving the following exception.

ERROR: Failed to start application
java.lang.RuntimeException: Got unexpected HTTP response code 403 from http://myconsul:8500/v1/kv/servicedesk/servicedesk-req/data
	at io.quarkus.consul.config.runtime.DefaultConsulConfigGateway.getValue(DefaultConsulConfigGateway.java:136)
	at io.quarkus.consul.config.runtime.ConsulConfigSourceProvider.getConfigSources(ConsulConfigSourceProvider.java:55)
	at io.quarkus.runtime.configuration.ConfigUtils.addSourceProvider(ConfigUtils.java:107)
	at io.quarkus.runtime.configuration.ConfigUtils.addSourceProviders(ConfigUtils.java:121)
	at io.quarkus.runtime.generated.Config.readConfig(Config.zig:1321)
	at io.quarkus.deployment.steps.RuntimeConfigSetup.deploy(RuntimeConfigSetup.zig:56)
	at io.quarkus.runner.ApplicationImpl.doStart(ApplicationImpl.zig:330)
	at io.quarkus.runtime.Application.start(Application.java:90)
	at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:90)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:61)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:38)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:106)
	at io.quarkus.runner.GeneratedMain.main(GeneratedMain.zig:29)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at io.quarkus.runner.bootstrap.StartupActionImpl$3.run(StartupActionImpl.java:144)
	at java.base/java.lang.Thread.run(Thread.java:834)

jun 11, 2020 3:09:57 PM io.quarkus.runtime.ApplicationLifecycleManager run
ERROR: Error running Quarkus application
java.lang.RuntimeException: Failed to start quarkus
	at io.quarkus.runner.ApplicationImpl.doStart(ApplicationImpl.zig:535)
	at io.quarkus.runtime.Application.start(Application.java:90)
	at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:90)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:61)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:38)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:106)
	at io.quarkus.runner.GeneratedMain.main(GeneratedMain.zig:29)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at io.quarkus.runner.bootstrap.StartupActionImpl$3.run(StartupActionImpl.java:144)
	at java.base/java.lang.Thread.run(Thread.java:834)

Expected behavior
When checking my settings they seem to be ok. Because I can get the result waiting via cURL with both X-Consul-Token and Authorization: Bearer see:

curl -v --header "Authorization: Bearer bd5517a2-581c-bde9-0a66-8e1cdc86a482" http://myconsul:8500/v1/kv/servicedesk/servicedesk-req/data
*   Trying myip...
* TCP_NODELAY set
* Connected to myconsul (myip) port 8500 (#0)
> GET /v1/kv/servicedesk/servicedesk-req/data HTTP/1.1
> Host: myconsul:8500
> User-Agent: curl/7.58.0
> Accept: */*
> Authorization: Bearer bd5517a2-581c-bde9-0a66-8e1cdc86a482
> 
< HTTP/1.1 200 OK
< Access-Control-Allow-Origin: *
< Content-Type: application/json
< Vary: Accept-Encoding
< X-Consul-Index: 116518468
< X-Consul-Knownleader: true
< X-Consul-Lastcontact: 0
< Date: Thu, 11 Jun 2020 18:02:18 GMT
< Content-Length: 398
< 
* Connection #0 to host myconsul left intact
[{"LockIndex":0,"Key":"servicedesk/servicedesk-req/data","Flags":0,"Value":"dXNkLnVybDogImh0dHA6Ly91c2QuZGVzLnNpY3JlZGkubmV0OjgwNTAiCnVzZC51c2VybmFtZTogYXBwX3NpdGVpbnN0CnJlcS5maW5kLmF0dHJzOiAiZGVzY3JpcHRpb24sc3VtbWFyeSxzdGF0dXMsb3Blbl9kYXRlLGdyb3VwLGNhdGVnb3J5LGN1c3RvbWVyIgp1c2QudXBsb2FkLnJlcG9zaXRvcnk6IDEwMDIKdXNkLnVwbG9hZC5taW1lLnR5cGU6IFRleHQ=","CreateIndex":97429879,"ModifyIndex":116518468}]

Actual behavior
Shouldn't the quarkus return the same result to me?

To Reproduce
https://quarkus.io/guides/consul-config
Here are my properties

#consul
quarkus.consul-config.enabled=true
quarkus.consul-config.agent.token=mytoken
quarkus.consul-config.agent.host-port=myconsul:8500
quarkus.consul-config.properties-value-keys=servicedesk/servicedesk-req/data

could @geoand check this?

Thankful!

[geoand]

Thanks for reporting.

Do you perhaps have a specific script you are using to start Consul with auth enabled?
I can of course do it myself, but would love to save time if you have something ready to go.

[etonzera]

Unfortunately I don't, because I'm using the consul already set up by the company's devops team and since today is a holiday in my country, I'll only get it tomorrow. But I was trying to configure it locally on my workstation and was basing myself on this example:

https://github.com/dj-wasabi/consul-acl-examples/tree/master/single-dc

Speaking of which, you don't think we could improve the consul's documentation on the quarkus page and put information on how to configure the consul to receive authentication via token and also how the user does to create the variables within the consul, based on the documentation that is in the quarkus + vault page? I believe it will make life much easier for users.

[geoand]

Unfortunately I don't, because I'm using the consul already set up by the company's devops team and since today is a holiday in my country, I'll only get it tomorrow. But I was trying to configure it locally on my workstation and was basing myself on this example:

https://github.com/dj-wasabi/consul-acl-examples/tree/master/single-dc

I'll give it a try soon, thanks

Speaking of which, you don't think we could improve the consul's documentation on the quarkus page and put information on how to configure the consul to receive authentication via token and also how the user does to create the variables within the consul, based on the documentation that is in the quarkus + vault page? I believe it will make life much easier for users.

Yeah, I think those are good ideas. Would you be interested in contributing those documentation improvements?

[geoand]

#9959 fixes the issue

[etonzera]

Yeah, I think those are good ideas. Would you be interested in contributing those documentation improvements?

Absolutely. I would be very grateful! How to proceed?

[geoand]

Yeah, I think those are good ideas. Would you be interested in contributing those documentation improvements?

Absolutely. I would be very grateful! How to proceed?

The documentation is at: https://github.com/quarkusio/quarkus/blob/master/docs/src/main/asciidoc/consul-config.adoc

Feel free to work on it at your own pace and when you are done, you can submit a Pull Request and ping me for a review.

[etonzera]

I will contribute. Thank you for the invite

[geoand]

Thanks you!