agent/config: AllowManagedAPIRegistration

agent/config/builder.go

@@ -665,6 +665,7 @@ func (b *Builder) Build() (rt RuntimeConfig, err error) {
 		ConnectCAProvider:                       connectCAProvider,
 		ConnectCAConfig:                         connectCAConfig,
 		ConnectProxyAllowManagedRoot:            b.boolVal(c.Connect.Proxy.AllowManagedRoot),
+		ConnectProxyAllowManagedAPIRegistration: b.boolVal(c.Connect.Proxy.AllowManagedAPIRegistration),
 		ConnectProxyBindMinPort:                 proxyMinPort,
 		ConnectProxyBindMaxPort:                 proxyMaxPort,
 		ConnectProxyDefaultExecMode:             proxyDefaultExecMode,

agent/config/config.go

@@ -382,6 +382,11 @@ type ConnectProxy struct {
 	// If this is true, then Consul will execute proxies if Consul is
 	// running as root. This is not recommended.
 	AllowManagedRoot *bool `json:"allow_managed_root" hcl:"allow_managed_root" mapstructure:"allow_managed_root"`
+
+	// AllowManagedAPIRegistration enables managed proxy registration
+	// via the agent HTTP API. If this is false, only file configurations
+	// can be used.
+	AllowManagedAPIRegistration *bool `json:"allow_managed_api_registration" hcl:"allow_managed_api_registration" mapstructure:"allow_managed_api_registration"`
 }
 
 // ConnectProxyDefaults is the agent-global defaults for managed Connect proxies.

agent/config/runtime.go

@@ -634,6 +634,11 @@ type RuntimeConfig struct {
 	// proxies when running as root (EUID == 0).
 	ConnectProxyAllowManagedRoot bool
 
+	// ConnectProxyAllowManagedAPIRegistration enables managed proxy registration
+	// via the agent HTTP API. If this is false, only file configurations
+	// can be used.
+	ConnectProxyAllowManagedAPIRegistration bool
+
 	// ConnectProxyDefaultExecMode is used where a registration doesn't include an
 	// exec_mode. Defaults to daemon.
 	ConnectProxyDefaultExecMode string

agent/config/runtime_test.go

@@ -2174,6 +2174,23 @@ func TestConfigFlagsAndEdgecases(t *testing.T) {
 				rt.ConnectProxyAllowManagedRoot = true
 			},
 		},
+
+		{
+			desc: "enabling Connect allow_managed_api_registration",
+			args: []string{
+				`-data-dir=` + dataDir,
+			},
+			json: []string{
+				`{ "connect": { "proxy": { "allow_managed_api_registration": true } } }`,
+			},
+			hcl: []string{
+				`connect { proxy { allow_managed_api_registration = true } }`,
+			},
+			patch: func(rt *RuntimeConfig) {
+				rt.DataDir = dataDir
+				rt.ConnectProxyAllowManagedAPIRegistration = true
+			},
+		},
 	}
 
 	testConfig(t, tests, dataDir)
@@ -3538,6 +3555,7 @@ func TestFullConfig(t *testing.T) {
 			"hyMy9Oxn": "XeBp4Sis",
 		},
 		ConnectProxyAllowManagedRoot:            false,
+		ConnectProxyAllowManagedAPIRegistration: false,
 		ConnectProxyDefaultExecMode:             "script",
 		ConnectProxyDefaultDaemonCommand:        []string{"consul", "connect", "proxy"},
 		ConnectProxyDefaultScriptCommand:        []string{"proxyctl.sh"},
@@ -4219,6 +4237,7 @@ func TestSanitize(t *testing.T) {
     "ConnectCAConfig": {},
     "ConnectCAProvider": "",
     "ConnectEnabled": false,
+    "ConnectProxyAllowManagedAPIRegistration": false,
     "ConnectProxyAllowManagedRoot": false,
     "ConnectProxyBindMaxPort": 0,
     "ConnectProxyBindMinPort": 0,