Sentinel Overview

This feature requires .

Consul 1.0 adds integration with Sentinel for policy enforcement. Sentinel policies help extend the ACL system in Consul beyond the static “read”, “write”, and “deny” policies to support full conditional logic and integration with external systems.

Sentinel policies are applied during writes to the KV Store.

Ensure values written during KV updates end in ‘dc1’

key "datacenter_name" {
  policy = "write"
  sentinel {
      code = <<EOF
main = rule { strings.has_suffix(value, "dc1") }
EOF
      enforcementlevel = "soft-mandatory"
  }
}

If the enforcementlevel property is not set, it defaults to “hard-mandatory”.

Consul imports all the from Sentinel except http. All functions in these imports are available to be used in policies.

Variables injected during KV store writes

The following are two examples of ACL policies with Sentinel rules.

Any values stored under the key ‘dc1’ end with ‘dev’

key "dc1" {
    policy = "write"
    sentinel {
        code = <<EOF
import "strings"
main = rule { strings.has_suffix(value, "dev") }
    }
}

Restricted Update Time

The key ‘haproxy_version’ can only be updated during business hours

key "haproxy_version" {
    policy = "write"
    sentinel {
        code = <<EOF
import "time"
main = rule { time.now.hour > 8 and time.now.hour < 17 }
EOF
    }
}