scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 02:02:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

release prep

Browse Source
This commit is contained in:
Brian Kassouf
2018-11-12 11:10:47 -08:00
parent 39f7a2d4b0
commit 89b83086cd
11 changed files with 118 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
CHANGELOG.md
View File

@@ -1,4 +1,4 @@
## 1.0.0-beta2 (Unreleased) ## 1.0.0-beta2 (November 12th, 2018)
CHANGES: CHANGES:
@@ -52,26 +52,33 @@ IMPROVEMENTS:
BUG FIXES: BUG FIXES:
* auth/userpass: Fix minor timing issue that could leak the presence of a
username [GH-5614]
* cli: Fix panic that could occur if parameters were not provided [GH-5603]
* core: Migration from autounseal to shamir will clean up old keys [GH-5671] * core: Migration from autounseal to shamir will clean up old keys [GH-5671]
* core: Fix buggy behavior if trying to remount into a namespace
* identity: Fix duplication of entity alias entity during alias transfer
between entities [GH-5733]
* secrets/azure: Fix valid roles being rejected for duplicate ids despite * secrets/azure: Fix valid roles being rejected for duplicate ids despite
having distinct scopes having distinct scopes
[[GH-16]](https://github.com/hashicorp/vault-plugin-secrets-azure/pull/16) [[GH-16]](https://github.com/hashicorp/vault-plugin-secrets-azure/pull/16)
* secrets/kv: Disallow empty paths on a `kv put` while accepting empty paths * secrets/kv: Disallow empty paths on a `kv put` while accepting empty paths
for all other operations for backwards compatibility for all other operations for backwards compatibility
[[GH-19]](https://github.com/hashicorp/vault-plugin-secrets-kv/pull/19) [[GH-19]](https://github.com/hashicorp/vault-plugin-secrets-kv/pull/19)
* ui: Fix bug where editing secrets as JSON doesn't save properly [GH-5660]
* agent: Fix issue when specifying two file sinks [GH-5610]
* ui: Fix bug where `sys/leases/revoke` required 'sudo' capability to show * ui: Fix bug where `sys/leases/revoke` required 'sudo' capability to show
the revoke button in the UI [GH-5647] the revoke button in the UI [GH-5647]
* ui: Fix issue where certain pages wouldn't render in a namespace [GH-5692] * ui: Fix issue where certain pages wouldn't render in a namespace [GH-5692]
## 0.11.5 (November 12th, 2018)
BUG FIXES:
* auth/userpass: Fix minor timing issue that could leak the presence of a
username [GH-5614]
* cli: Fix panic that could occur if parameters were not provided [GH-5603]
* core: Fix buggy behavior if trying to remount into a namespace
* identity: Fix duplication of entity alias entity during alias transfer
between entities [GH-5733]
* ui: Fix bug where editing secrets as JSON doesn't save properly [GH-5660]
* ui: Fix issue where IE 11 didn't render the UI and also had a broken form * ui: Fix issue where IE 11 didn't render the UI and also had a broken form
when trying to use tool/hash [GH-5714] when trying to use tool/hash [GH-5714]
* agent: Fix issue when specifying two file sinks [GH-5610]
* autounseal/alicloud: Fix issue interacting with the API
* autounseal/azure: Fix key version tracking
## 1.0.0-beta1 (October 23rd, 2018) ## 1.0.0-beta1 (October 23rd, 2018)

2
vendor/github.com/hashicorp/vault-plugin-auth-gcp/plugin/path_role.go generated vendored
View File

@@ -289,7 +289,7 @@ func (b *GcpAuthBackend) pathRoleRead(ctx context.Context, req *logical.Request,
resp := make(map[string]interface{}) resp := make(map[string]interface{})
if role.RoleType != "" { if role.RoleType != "" {
resp["role"] = role.RoleType resp["type"] = role.RoleType
} }
if role.ProjectId != "" { if role.ProjectId != "" {
resp["project_id"] = role.ProjectId resp["project_id"] = role.ProjectId

14
vendor/github.com/hashicorp/vault-plugin-auth-kubernetes/Gopkg.lock generated vendored
View File

@@ -2,8 +2,7 @@
[[projects]] [[projects]]
branch = "master" digest = "1:a69ab3f1445ffd4815add4bd31ba05b65b3b9fec1ade5057d5d717f30e6efd6d"
digest = "1:e26170d7ec7d444d7b74a5b1dbd6437fd8e552d27efce9327f733311737c4ae9"
name = "github.com/SermoDigital/jose" name = "github.com/SermoDigital/jose"
packages = [ packages = [
".", ".",
@@ -12,7 +11,8 @@
"jwt", "jwt",
] ]
pruneopts = "UT" pruneopts = "UT"
revision = "803625baeddc3526d01d321b5066029f53eafc81" revision = "f6df55f235c24f236d11dbcf665249a59ac2021f"
version = "1.1"
[[projects]] [[projects]]
branch = "master" branch = "master"
@@ -23,16 +23,17 @@
revision = "7fddfc383310abc091d79a27f116d30cf0424032" revision = "7fddfc383310abc091d79a27f116d30cf0424032"
[[projects]] [[projects]]
digest = "1:b12a893d64eb4c4c1980240c5706026032f505fef4ecd7d4cbfa2ed60ecd40c9" branch = "master"
digest = "1:fb6bb07f738b9ec248ffa7b737dd983df2028001ebd0dad29dfb0830576cef12"
name = "github.com/briankassouf/jose" name = "github.com/briankassouf/jose"
packages = [ packages = [
".",
"crypto", "crypto",
"jws", "jws",
"jwt", "jwt",
] ]
pruneopts = "UT" pruneopts = "UT"
revision = "f6df55f235c24f236d11dbcf665249a59ac2021f" revision = "d2569464773f2b9de32e57a79d87318bca5b56c0"
version = "1.1"
[[projects]] [[projects]]
digest = "1:34e709f36fd4f868fb00dbaf8a6cab4c1ae685832d392874ba9d7c5dec2429d1" digest = "1:34e709f36fd4f868fb00dbaf8a6cab4c1ae685832d392874ba9d7c5dec2429d1"
@@ -433,7 +434,6 @@
analyzer-name = "dep" analyzer-name = "dep"
analyzer-version = 1 analyzer-version = 1
input-imports = [ input-imports = [
"github.com/SermoDigital/jose/jws",
"github.com/briankassouf/jose/crypto", "github.com/briankassouf/jose/crypto",
"github.com/briankassouf/jose/jws", "github.com/briankassouf/jose/jws",
"github.com/briankassouf/jose/jwt", "github.com/briankassouf/jose/jwt",

7
vendor/github.com/hashicorp/vault-plugin-auth-kubernetes/Gopkg.toml generated vendored
View File

@@ -24,14 +24,9 @@
# go-tests = true # go-tests = true
# unused-packages = true # unused-packages = true
[[constraint]]
branch = "master"
name = "github.com/SermoDigital/jose"
[[constraint]] [[constraint]]
name = "github.com/briankassouf/jose" name = "github.com/briankassouf/jose"
version = "1.1.0" branch = "master"
[[constraint]] [[constraint]]
branch = "master" branch = "master"

2
vendor/github.com/hashicorp/vault-plugin-auth-kubernetes/README.md generated vendored
View File

@@ -1,4 +1,4 @@
# Vault Plugin: Kubernetes Auth Backend # Vault Plugin: Kubernetes Auth Backend [![Build Status](https://travis-ci.org/hashicorp/vault-plugin-auth-kubernetes.svg?branch=master)](https://travis-ci.org/hashicorp/vault-plugin-auth-kubernetes)
This is a standalone backend plugin for use with [Hashicorp Vault](https://www.github.com/hashicorp/vault). This is a standalone backend plugin for use with [Hashicorp Vault](https://www.github.com/hashicorp/vault).
This plugin allows for Kubernetes Service Accounts to authenticate with Vault. This plugin allows for Kubernetes Service Accounts to authenticate with Vault.

2
vendor/github.com/hashicorp/vault-plugin-auth-kubernetes/path_config.go generated vendored
View File

@@ -8,7 +8,7 @@ import (
"encoding/pem" "encoding/pem"
"errors" "errors"
"github.com/SermoDigital/jose/jws" "github.com/briankassouf/jose/jws"
"github.com/hashicorp/vault/logical" "github.com/hashicorp/vault/logical"
"github.com/hashicorp/vault/logical/framework" "github.com/hashicorp/vault/logical/framework"
) )

81
vendor/github.com/hashicorp/vault-plugin-auth-kubernetes/path_login.go generated vendored
View File

@@ -21,9 +21,9 @@ import (
var ( var (
// expectedJWTIssuer is used to verify the iss header on the JWT. // expectedJWTIssuer is used to verify the iss header on the JWT.
expectedJWTIssuer string = "kubernetes/serviceaccount" expectedJWTIssuer = "kubernetes/serviceaccount"
uidJWTClaimKey string = "kubernetes.io/serviceaccount/service-account.uid" uidJWTClaimKey = "kubernetes.io/serviceaccount/service-account.uid"
// errMismatchedSigningMethod is used if the certificate doesn't match the // errMismatchedSigningMethod is used if the certificate doesn't match the
// JWT's expected signing method. // JWT's expected signing method.
@@ -108,20 +108,20 @@ func (b *kubeAuthBackend) pathLogin() framework.OperationFunc {
NumUses: role.NumUses, NumUses: role.NumUses,
Period: role.Period, Period: role.Period,
Alias: &logical.Alias{ Alias: &logical.Alias{
Name: serviceAccount.UID, Name: serviceAccount.uid(),
}, },
InternalData: map[string]interface{}{ InternalData: map[string]interface{}{
"role": roleName, "role": roleName,
}, },
Policies: role.Policies, Policies: role.Policies,
Metadata: map[string]string{ Metadata: map[string]string{
"service_account_uid": serviceAccount.UID, "service_account_uid": serviceAccount.uid(),
"service_account_name": serviceAccount.Name, "service_account_name": serviceAccount.name(),
"service_account_namespace": serviceAccount.Namespace, "service_account_namespace": serviceAccount.namespace(),
"service_account_secret_name": serviceAccount.SecretName, "service_account_secret_name": serviceAccount.SecretName,
"role": roleName, "role": roleName,
}, },
DisplayName: fmt.Sprintf("%s-%s", serviceAccount.Namespace, serviceAccount.Name), DisplayName: fmt.Sprintf("%s-%s", serviceAccount.namespace(), serviceAccount.name()),
LeaseOptions: logical.LeaseOptions{ LeaseOptions: logical.LeaseOptions{
Renewable: true, Renewable: true,
TTL: role.TTL, TTL: role.TTL,
@@ -187,14 +187,14 @@ func (b *kubeAuthBackend) parseAndValidateJWT(jwtStr string, role *roleStorageEn
// verify the namespace is allowed // verify the namespace is allowed
if len(role.ServiceAccountNamespaces) > 1 || role.ServiceAccountNamespaces[0] != "*" { if len(role.ServiceAccountNamespaces) > 1 || role.ServiceAccountNamespaces[0] != "*" {
if !strutil.StrListContains(role.ServiceAccountNamespaces, sa.Namespace) { if !strutil.StrListContains(role.ServiceAccountNamespaces, sa.namespace()) {
return errors.New("namespace not authorized") return errors.New("namespace not authorized")
} }
} }
// verify the service account name is allowed // verify the service account name is allowed
if len(role.ServiceAccountNames) > 1 || role.ServiceAccountNames[0] != "*" { if len(role.ServiceAccountNames) > 1 || role.ServiceAccountNames[0] != "*" {
if !strutil.StrListContains(role.ServiceAccountNames, sa.Name) { if !strutil.StrListContains(role.ServiceAccountNames, sa.name()) {
return errors.New("service account name not authorized") return errors.New("service account name not authorized")
} }
} }
@@ -280,10 +280,57 @@ func (b *kubeAuthBackend) parseAndValidateJWT(jwtStr string, role *roleStorageEn
// serviceAccount holds the metadata from the JWT token and is used to lookup // serviceAccount holds the metadata from the JWT token and is used to lookup
// the JWT in the kubernetes API and compare the results. // the JWT in the kubernetes API and compare the results.
type serviceAccount struct { type serviceAccount struct {
Name string `mapstructure:"kubernetes.io/serviceaccount/service-account.name"` Name string `mapstructure:"kubernetes.io/serviceaccount/service-account.name"`
UID string `mapstructure:"kubernetes.io/serviceaccount/service-account.uid"` UID string `mapstructure:"kubernetes.io/serviceaccount/service-account.uid"`
SecretName string `mapstructure:"kubernetes.io/serviceaccount/secret.name"` SecretName string `mapstructure:"kubernetes.io/serviceaccount/secret.name"`
Namespace string `mapstructure:"kubernetes.io/serviceaccount/namespace"` Namespace string `mapstructure:"kubernetes.io/serviceaccount/namespace"`
Aud []string `mapstructure:"aud"`
// the JSON returned from reviewing a Projected Service account has a
// different structure, where the information is in a sub-structure instead of
// at the top level
Kubernetes *projectedServiceToken `mapstructure:"kubernetes.io"`
Expiration int64 `mapstructure:"exp"`
IssuedAt int64 `mapstructure:"iat"`
}
// uid returns the UID for the service account, preferring the projected service
// account value if found
func (s *serviceAccount) uid() string {
if s.Kubernetes != nil && s.Kubernetes.ServiceAccount != nil {
return s.Kubernetes.ServiceAccount.UID
}
return s.UID
}
// name returns the name for the service account, preferring the projected
// service account value if found. This is "default" for projected service
// accounts
func (s *serviceAccount) name() string {
if s.Kubernetes != nil && s.Kubernetes.ServiceAccount != nil {
return s.Kubernetes.ServiceAccount.Name
}
return s.Name
}
// namespace returns the namespace for the service account, preferring the
// projected service account value if found
func (s *serviceAccount) namespace() string {
if s.Kubernetes != nil {
return s.Kubernetes.Namespace
}
return s.Namespace
}
type projectedServiceToken struct {
Namespace string `mapstructure:"namespace"`
Pod *projectedServiceAccountPod `mapstructure:"pod"`
ServiceAccount *projectedServiceAccountPod `mapstructure:"serviceaccount"`
}
type projectedServiceAccountPod struct {
Name string `mapstructure:"name"`
UID string `mapstructure:"uid"`
} }
// lookup calls the TokenReview API in kubernetes to verify the token and secret // lookup calls the TokenReview API in kubernetes to verify the token and secret
@@ -296,13 +343,13 @@ func (s *serviceAccount) lookup(jwtStr string, tr tokenReviewer) error {
// Verify the returned metadata matches the expected data from the service // Verify the returned metadata matches the expected data from the service
// account. // account.
if s.Name != r.Name { if s.name() != r.Name {
return errors.New("JWT names did not match") return errors.New("JWT names did not match")
} }
if s.UID != r.UID { if s.uid() != r.UID {
return errors.New("JWT UIDs did not match") return errors.New("JWT UIDs did not match")
} }
if s.Namespace != r.Namespace { if s.namespace() != r.Namespace {
return errors.New("JWT namepaces did not match") return errors.New("JWT namepaces did not match")
} }

2
vendor/github.com/hashicorp/vault-plugin-secrets-ad/plugin/role.go generated vendored
View File

@@ -14,7 +14,7 @@ type backendRole struct {
func (r *backendRole) Map() map[string]interface{} { func (r *backendRole) Map() map[string]interface{} {
m := map[string]interface{}{ m := map[string]interface{}{
"service_account_name": r.ServiceAccountName, "service_account_name": r.ServiceAccountName,
"ttl": r.TTL, "ttl": r.TTL,
} }
var unset time.Time var unset time.Time

2
vendor/github.com/hashicorp/vault-plugin-secrets-azure/path_roles.go generated vendored
View File

@@ -161,7 +161,7 @@ func (b *azureSecretBackend) pathRoleUpdate(ctx context.Context, req *logical.Re
err := jsonutil.DecodeJSON([]byte(roles.(string)), &parsedRoles) err := jsonutil.DecodeJSON([]byte(roles.(string)), &parsedRoles)
if err != nil { if err != nil {
return logical.ErrorResponse("invalid Azure role definitions"), nil return logical.ErrorResponse(fmt.Sprintf("error parsing Azure roles '%s': %s", roles.(string), err.Error())), nil
} }
role.AzureRoles = parsedRoles role.AzureRoles = parsedRoles
} }

48
vendor/vendor.json vendored
View File

@@ -1403,14 +1403,14 @@
{ {
"checksumSHA1": "NRGHY73VI2kEgy+FSDOuSsixS4k=", "checksumSHA1": "NRGHY73VI2kEgy+FSDOuSsixS4k=",
"path": "github.com/hashicorp/vault-plugin-auth-alicloud", "path": "github.com/hashicorp/vault-plugin-auth-alicloud",
"revision": "1c2bb0abe14ed980276707b1d572dd280da69d86", "revision": "f278a59ca3e8aeafeda7cb9a14e8815359d25fcd",
"revisionTime": "2018-10-03T22:48:59Z" "revisionTime": "2018-11-09T18:06:36Z"
}, },
{ {
"checksumSHA1": "xdrSQoX7B7Hr4iWm9T2+5wHVpHQ=", "checksumSHA1": "xdrSQoX7B7Hr4iWm9T2+5wHVpHQ=",
"path": "github.com/hashicorp/vault-plugin-auth-alicloud/tools", "path": "github.com/hashicorp/vault-plugin-auth-alicloud/tools",
"revision": "1c2bb0abe14ed980276707b1d572dd280da69d86", "revision": "f278a59ca3e8aeafeda7cb9a14e8815359d25fcd",
"revisionTime": "2018-10-03T22:48:59Z" "revisionTime": "2018-11-09T18:06:36Z"
}, },
{ {
"checksumSHA1": "ojr0r/jmutGEhftDXiHthCCwpIA=", "checksumSHA1": "ojr0r/jmutGEhftDXiHthCCwpIA=",
@@ -1425,10 +1425,10 @@
"revisionTime": "2018-08-16T20:11:31Z" "revisionTime": "2018-08-16T20:11:31Z"
}, },
{ {
"checksumSHA1": "/Jn1UXwpf4RVqNhxyUT275WMQzQ=", "checksumSHA1": "pJC3V+AR+Khd/TpvekLf1ZRU7rA=",
"path": "github.com/hashicorp/vault-plugin-auth-gcp/plugin", "path": "github.com/hashicorp/vault-plugin-auth-gcp/plugin",
"revision": "d57adfb30a2e65659bdb83e632a6d4e6690e2e86", "revision": "86f7837fd8102347f7a10e3f0ad275e5a256863c",
"revisionTime": "2018-10-12T20:41:23Z" "revisionTime": "2018-10-25T21:28:40Z"
}, },
{ {
"checksumSHA1": "tt3FtyjXgdBI9Mb43UL4LtOZmAk=", "checksumSHA1": "tt3FtyjXgdBI9Mb43UL4LtOZmAk=",
@@ -1437,46 +1437,46 @@
"revisionTime": "2018-10-31T19:59:42Z" "revisionTime": "2018-10-31T19:59:42Z"
}, },
{ {
"checksumSHA1": "hrJZzU9iG2ixRu2hOdPgN7wa48c=", "checksumSHA1": "8J4z30a2oTqSPQYOaT4j/jiZuNE=",
"path": "github.com/hashicorp/vault-plugin-auth-kubernetes", "path": "github.com/hashicorp/vault-plugin-auth-kubernetes",
"revision": "8bfe988b36157168563f726887da232af94ee87f", "revision": "5328b889a921243d6e19cda38fb2c31a48cba2b2",
"revisionTime": "2018-08-16T20:15:54Z" "revisionTime": "2018-11-01T19:05:09Z"
}, },
{ {
"checksumSHA1": "pNERL2s72vwnApekzTLxGsvkyNU=", "checksumSHA1": "PmhyvCKVlEMEP6JO31ozW+CBIiE=",
"path": "github.com/hashicorp/vault-plugin-secrets-ad/plugin", "path": "github.com/hashicorp/vault-plugin-secrets-ad/plugin",
"revision": "d8a0991deac4006068826a99b82d8274aa119161", "revision": "540c0b6f1f113a1c6bdaa130a35ee8530c072b5a",
"revisionTime": "2018-08-20T22:27:10Z" "revisionTime": "2018-11-09T18:28:34Z"
}, },
{ {
"checksumSHA1": "GOxdFElG31lXWgKFG9aqpDcG47M=", "checksumSHA1": "GOxdFElG31lXWgKFG9aqpDcG47M=",
"path": "github.com/hashicorp/vault-plugin-secrets-ad/plugin/client", "path": "github.com/hashicorp/vault-plugin-secrets-ad/plugin/client",
"revision": "d8a0991deac4006068826a99b82d8274aa119161", "revision": "540c0b6f1f113a1c6bdaa130a35ee8530c072b5a",
"revisionTime": "2018-08-20T22:27:10Z" "revisionTime": "2018-11-09T18:28:34Z"
}, },
{ {
"checksumSHA1": "RaH2xTkjaToCk+RoPhap7I66ibo=", "checksumSHA1": "RaH2xTkjaToCk+RoPhap7I66ibo=",
"path": "github.com/hashicorp/vault-plugin-secrets-ad/plugin/util", "path": "github.com/hashicorp/vault-plugin-secrets-ad/plugin/util",
"revision": "d8a0991deac4006068826a99b82d8274aa119161", "revision": "540c0b6f1f113a1c6bdaa130a35ee8530c072b5a",
"revisionTime": "2018-08-20T22:27:10Z" "revisionTime": "2018-11-09T18:28:34Z"
}, },
{ {
"checksumSHA1": "VLXyxS5dEoiWTSFmpMJIz+Pwtmw=", "checksumSHA1": "VLXyxS5dEoiWTSFmpMJIz+Pwtmw=",
"path": "github.com/hashicorp/vault-plugin-secrets-alicloud", "path": "github.com/hashicorp/vault-plugin-secrets-alicloud",
"revision": "4272d944e495635b30fcabf70dd71a9355b798a9", "revision": "2aee79cc5cbf1bbca654dbc594f809cafc19cd8d",
"revisionTime": "2018-10-03T22:47:18Z" "revisionTime": "2018-11-09T18:14:53Z"
}, },
{ {
"checksumSHA1": "dqduixICi6NeyLNRCDdw62t1LFU=", "checksumSHA1": "dqduixICi6NeyLNRCDdw62t1LFU=",
"path": "github.com/hashicorp/vault-plugin-secrets-alicloud/clients", "path": "github.com/hashicorp/vault-plugin-secrets-alicloud/clients",
"revision": "4272d944e495635b30fcabf70dd71a9355b798a9", "revision": "2aee79cc5cbf1bbca654dbc594f809cafc19cd8d",
"revisionTime": "2018-10-03T22:47:18Z" "revisionTime": "2018-11-09T18:14:53Z"
}, },
{ {
"checksumSHA1": "f7Ul8JZy98iiDLRN5j9/6jbq9jc=", "checksumSHA1": "Zr5xVeEJxmlBLWgaUq5rRRIuryE=",
"path": "github.com/hashicorp/vault-plugin-secrets-azure", "path": "github.com/hashicorp/vault-plugin-secrets-azure",
"revision": "824f07d5c72f72bb6d983c07d8fba2ab72bd45b8", "revision": "26e517ba4190bab20ebb28336921434f96093250",
"revisionTime": "2018-10-24T21:21:15Z" "revisionTime": "2018-11-08T17:16:20Z"
}, },
{ {
"checksumSHA1": "tFP1EEyVlomSSx46NHDZWGPzUz0=", "checksumSHA1": "tFP1EEyVlomSSx46NHDZWGPzUz0=",

2
version/version_base.go
View File

@@ -7,5 +7,5 @@ func init() {
// A pre-release marker for the version. If this is "" (empty string) // A pre-release marker for the version. If this is "" (empty string)
// then it means that it is a final release. Otherwise, this is a pre-release // then it means that it is a final release. Otherwise, this is a pre-release
// such as "dev" (in development), "beta", "rc1", etc. // such as "dev" (in development), "beta", "rc1", etc.
VersionPrerelease = "beta1" VersionPrerelease = "beta2"
} }