Consul Enterprise uses Sentinel to augment the built-in ACL system to provide advanced policy enforcement. Sentinel policies can currently execute on KV modify and service registration.
---
@ -14,29 +14,27 @@ description: |-
Consul 1.0 adds integration with [Sentinel](https://hashicorp.com/sentinel) for policy enforcement.
Sentinel policies help extend the ACL system in Consul beyond the static "read", "write", and "deny"
policies to support full conditional logic, and integration with external systems.
policies to support full conditional logic and integration with external systems.
## Sentinel in Consul
Sentinel policies are applied during writes to the KV Store.
ACL policy definitions take a `sentinel` field specifying the code and the enforcement level.
Here's an example:
An optional `sentinel` field specifying code and enforcement level can be added to [ACL policy definitions](/docs/agent/acl-rules.html#sentinel-integration) for Consul KV. The following policy ensures that the value written during a KV update must end with "dc1".
```text
key "datacenter_name" {
policy = "write"
sentinel {
code = <<EOF
import "strings"
main = rule { strings.has_suffix(value,"foo") }
enforcementlevel = "soft-mandatory"
main = rule { strings.has_suffix(value, "dc1") }
EOF
enforcementlevel = "soft-mandatory"
}
}
```
This policy ensures that the value written during a KV update must end with "foo".
If the `enforcementlevel` property is not set, it defaults to "hard-mandatory".
## Imports
@ -57,27 +55,32 @@ Consul passes some context as variables into Sentinel, which are available to us
@ -64,8 +64,6 @@ The following guides are available:
* [Semaphore](/docs/guides/semaphore.html) - This guide covers using the KV store to implement a semaphore.
* [Sentinel](/docs/guides/sentinel.html) - This guide covers using Sentinel for policy enforcement in Consul.
* [Server Performance](/docs/guides/performance.html) - This guide covers minimum requirements for Consul servers as well as guidelines for running Consul servers in production.
* [Windows Service](/docs/guides/windows-guide.html) - This guide covers how to run Consul as a service on Windows.