core: Parse VAULT_ALLOW_PENDING_REMOVAL_MOUNTS as bool (#17319) (#17365)

* docs: Update VAULT_ALLOW_PENDING_REMOVAL_MOUNTS doc

command/server.go

@@ -40,6 +40,7 @@ import (
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/internalshared/listenerutil"
+	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
@@ -1266,6 +1267,16 @@ func (c *ServerCommand) Run(args []string) int {
 		}
 	}
 
+	if allowPendingRemoval := os.Getenv(consts.VaultAllowPendingRemovalMountsEnv); allowPendingRemoval != "" {
+		var err error
+		vault.PendingRemovalMountsAllowed, err = strconv.ParseBool(allowPendingRemoval)
+		if err != nil {
+			c.UI.Warn(wrapAtLength("WARNING! failed to parse " +
+				consts.VaultAllowPendingRemovalMountsEnv + " env var: " +
+				"defaulting to false."))
+		}
+	}
+
 	// If mlockall(2) isn't supported, show a warning. We disable this in dev
 	// because it is quite scary to see when first using Vault. We also disable
 	// this if the user has explicitly disabled mlock in configuration.

vault/mount.go

@@ -104,6 +104,8 @@ var (
 	// mountAliases maps old backend names to new backend names, allowing us
 	// to move/rename backends but maintain backwards compatibility
 	mountAliases = map[string]string{"generic": "kv"}
+
+	PendingRemovalMountsAllowed = false
 )
 
 func (c *Core) generateMountAccessor(entryType string) (string, error) {
@@ -960,7 +962,7 @@ func (c *Core) handleDeprecatedMountEntry(ctx context.Context, entry *MountEntry
 
 		case consts.PendingRemoval:
 			dl.Error(errDeprecatedMount.Error())
-			if allow := os.Getenv(consts.VaultAllowPendingRemovalMountsEnv); allow == "" {
+			if !PendingRemovalMountsAllowed {
 				return nil, fmt.Errorf("could not mount %q: %w", t, errDeprecatedMount)
 			}
 			resp.AddWarning(errDeprecatedMount.Error())

website/content/docs/commands/server.mdx

@@ -60,7 +60,7 @@ flags](/docs/commands) included on all commands.
   are "standard" and "json". This can also be specified via the
   VAULT_LOG_FORMAT environment variable.
 
-- `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` `(string: "")` - (environment variable)
+- `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` `(bool: false)` - (environment variable)
 Allow Vault to be started with builtin engines which have the `Pending Removal`
 deprecation state. This is a temporary stopgap in place in order to perform an
 upgrade and disable these engines. Once these engines are marked `Removed` (in