Same seal migration oss (#10224)

* Refactoring and test improvements.

* Support migrating from a given type of autoseal to that same type but with different parameters.
This commit is contained in:
Nick Cabatoff
2020-10-23 14:16:04 -04:00
committed by GitHub
parent c787c97cec
commit f7c384fd4c
12 changed files with 684 additions and 560 deletions

View File

@@ -1100,7 +1100,9 @@ func (c *ServerCommand) Run(args []string) int {
Logger: c.logger.Named("shamir"),
}),
})
wrapper, sealConfigError = configutil.ConfigureWrapper(configSeal, &infoKeys, &info, sealLogger)
var sealInfoKeys []string
var sealInfoMap = map[string]string{}
wrapper, sealConfigError = configutil.ConfigureWrapper(configSeal, &sealInfoKeys, &sealInfoMap, sealLogger)
if sealConfigError != nil {
if !errwrap.ContainsType(sealConfigError, new(logical.KeyNotFoundError)) {
c.UI.Error(fmt.Sprintf(
@@ -1116,12 +1118,18 @@ func (c *ServerCommand) Run(args []string) int {
})
}
var infoPrefix = ""
if configSeal.Disabled {
unwrapSeal = seal
infoPrefix = "Old "
} else {
barrierSeal = seal
barrierWrapper = wrapper
}
for _, k := range sealInfoKeys {
infoKeys = append(infoKeys, infoPrefix+k)
info[infoPrefix+k] = sealInfoMap[k]
}
// Ensure that the seal finalizer is called, even if using verify-only
defer func() {
@@ -1570,7 +1578,7 @@ CLUSTER_SYNTHESIS_COMPLETE:
// Vault cluster with multiple servers is configured with auto-unseal but is
// uninitialized. Once one server initializes the storage backend, this
// goroutine will pick up the unseal keys and unseal this instance.
if !core.IsInSealMigration() {
if !core.IsInSealMigrationMode() {
go func() {
for {
err := core.UnsealWithStoredKeys(context.Background())