Fix hanging on empty keys during operator migrate (#6371)

command/operator_migrate.go

@@ -311,7 +311,9 @@ func dfsScan(ctx context.Context, source physical.Backend, cb func(ctx context.C
 			// remove List-triggering key and add children in reverse order
 			dfs = dfs[:len(dfs)-1]
 			for i := len(children) - 1; i >= 0; i-- {
-				dfs = append(dfs, key+children[i])
+				if children[i] != "" {
+					dfs = append(dfs, key+children[i])
+				}
 			}
 		} else {
 			err := cb(ctx, key)

command/operator_migrate_test.go

@@ -23,6 +23,8 @@ import (
 	"github.com/hashicorp/vault/vault"
 )
 
+const trailing_slash_key = "trailing_slash/"
+
 func init() {
 	rand.Seed(time.Now().UnixNano())
 }
@@ -209,6 +211,9 @@ storage_destination "dest_type2" {
 			return nil
 		})
 
+		delete(data, trailing_slash_key)
+		delete(data, "")
+
 		var keys []string
 		for key := range data {
 			keys = append(keys, key)
@@ -267,6 +272,11 @@ func generateData() map[string][]byte {
 	result[storageMigrationLock] = []byte{}
 	result[vault.CoreLockPath] = []byte{}
 
+	// Empty keys are now prevented in Vault, but older data sets
+	// might contain them.
+	result[""] = []byte{}
+	result[trailing_slash_key] = []byte{}
+
 	return result
 }
 
@@ -292,7 +302,7 @@ func compareStoredData(s physical.Backend, ref map[string][]byte, start string)
 			return err
 		}
 
-		if k == storageMigrationLock || k == vault.CoreLockPath {
+		if k == storageMigrationLock || k == vault.CoreLockPath || k == "" || strings.HasSuffix(k, "/") {
 			if entry == nil {
 				continue
 			}