reload service registration configuration on SIGHUP

[kevinschoonover]

If the consul token is ever rotated in a service configuration on disk, vault will never pick up the changes and will be unable to perform future service registrations.

This change reloads the configuration for service registrations whenever vault receives SIGHUP for consul by recreating the consul client since consul doesn't have a clear API for editting an agent's ACL token.

You can test these changes locally by:

1. creating the following configuration

   # service_registration.hcl
   service_registration "consul" {
     token = "test"
   }
   

2. running consul and vault in dev mode

   VAULT_LOG_LEVEL=debug ~vault server -dev -config service_registration.hcl
   consul agent -dev
   

3. editing the service_registration.hcl file
4. sending HUP to vault kill -HUP $(pidof vault)

[gbolo]

can we get some traction on this? Vault should have the ability to reload service_registration without having to restart and unseal

[kevinschoonover]

@VioletHynes - was hoping to take advantage of your offer while the iron is hot. Not sure if this applied to only the consul-template repo.

[VioletHynes]

Applies here too! I'll try and get some eyes on it, thank you!

[marcboudreau]

LGTM

[marcboudreau]

I'm just looking into a panic that was thrown from one of the tests.

[marcboudreau]

Sorry, that I didn't pick this up before, but one of the tests showed that ServiceRegistration can be nil, which leads to a panic.

[marcboudreau]

Thanks for your submission @kevinschoonover! ❤️