* NewCore tech debt refactoring
* addExtraCredentialBackends
* singletonMounts => mountTypeToken instead of 'token'
* NewCore tests support ent backend addition
* PR feedback
* reorder method calls
* mounthPath___ standardization
* Try to be more explicit about the min number of backends
* Include cluster listener
* explicit declaration of events before assignment
* Removed nil checking
* resolve conflicts
* create custom type for disable-replication-status-endpoints context key
make use of custom context key type in middleware function
* clean up code to remove various compiler warnings
unnecessary return statement
if condition that is always true
fix use of deprecated ioutil.NopCloser
empty if block
* remove unused unexported function
* clean up code
remove unnecessary nil check around a range expression
* clean up code
removed redundant return statement
* use http.StatusTemporaryRedirect constant instead of literal integer
* create custom type for context key for max_request_size parameter
* create custom type for context key for original request path
* adds codemod for transforming button element to hds component
* runs button codemod on kmip and kubernetes enginges
* manully updates kuberenetes roles button
* runs button codemod on ldap engine
* manually updates remaining ldap buttons
* updates button codemod to check if all child nodes were included in text arg construction
* runs button codemod on kv engine
* adds comment for future kv button update
* Update ui/lib/kv/addon/components/page/secret/details.hbs
Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
* updates remaining instance of toolbar-link class on button and adds class name transform to button codemod
* adds display inline override to hds button
* updates hds button display override to inline-flex
* updates ldap account check in button to tertiary
* updates ldap library check out icon to tertiary and adds icon
---------
Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
Teach stubmaker how to work with methods, not just funcs. Fix some stubs defined in #23557 which either had the wrong signature or needed to be public.
* CI: Pre-emptively delete logs dir after cache restore in test-collect-reports (#23600)
* Fix OktaNumberChallenge (#23565)
* remove arg
* changelog
* exclude changelog in verifying doc/ui PRs (#23601)
* Audit: eventlogger sink node reopen on SIGHUP (#23598)
* ensure nodes are asked to reload audit files on SIGHUP
* added changelog
* Capture errors emitted from all nodes during proccessing of audit pipelines (#23582)
* Update security-scan.yml
* Listeners: Redaction only for TCP (#23592)
* redaction should only work for TCP listeners, also fix bug that allowed custom response headers for unix listeners
* fix failing test
* updates from PR feedback
* fix panic when unlocking unlocked user (#23611)
* VAULT-18307: update rotation period for aws static roles on update (#23528)
* add disable_replication_status_endpoints tcp listener config parameter
* add wrapping handler for disabled replication status endpoints setting
* adapt disable_replication_status_endpoints configuration parsing code to refactored parsing code
* refactor configuration parsing code to facilitate testing
* fix a panic when parsing configuration
* update refactored configuration parsing code
* fix merge corruption
* add changelog file
* document new TCP listener configuration parameter
* make sure disable_replication_status_endpoints only has effect on TCP listeners
* use active voice for explanation of disable_replication_status_endpoints
* fix minor merge issue
---------
Co-authored-by: Kuba Wieczorek <kuba.wieczorek@hashicorp.com>
Co-authored-by: Angel Garbarino <Monkeychip@users.noreply.github.com>
Co-authored-by: Hamid Ghaf <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: Peter Wilson <peter.wilson@hashicorp.com>
Co-authored-by: Mark Collao <106274486+mcollao-hc@users.noreply.github.com>
Co-authored-by: davidadeleon <56207066+davidadeleon@users.noreply.github.com>
Co-authored-by: kpcraig <3031348+kpcraig@users.noreply.github.com>
* known issue documentation for Vault 1.15 related to file audit device - log rotation
* fix caps in URL anchor
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
* PR feedback
* Warning not Important tag
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* changes to known issue doc
* changes to known issue doc - 2
---------
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* redaction should only work for TCP listeners, also fix bug that allowed custom response headers for unix listeners
* fix failing test
* updates from PR feedback
* Correct the post-unseal meaning of the seal status type
And at the same time add a RecoverySealType to the response which preserves the old meaning.
Updated the CLI to display both when relevant.
* changelog
* no longer needed
* Don't need this field either, which fixes unit tests
* fix unit tests
* implement user lockout logger
* formatting
* make user lockout log interval configurable
* create func to get locked user count, and fix potential deadlock
* fix test
* fix test
* add changelog
* VAULT-19237 Add mount_type to secret response
* VAULT-19237 changelog
* VAULT-19237 make MountType generic
* VAULT-19237 clean up comment
* VAULT-19237 update changelog
* VAULT-19237 update test, remove mounttype from wrapped responses
* VAULT-19237 fix a lot of tests
* VAULT-19237 standby test
* ensure -log-level is added to core config (#23017)
* Feature/document tls servername (#22714)
* Add Raft TLS Helm examples
Co-authored-by: Pascal Reeb <pascal.reeb@adfinis.com>
---------
* Clean up unused CRL entries when issuer is removed (#23007)
* Clean up unused CRL entries when issuer is removed
When a issuer is removed, the space utilized by its CRL was not freed,
both from the CRL config mapping issuer IDs to CRL IDs and from the
CRL storage entry. We thus implement a two step cleanup, wherein
orphaned CRL IDs are removed from the config and any remaining full
CRL entries are removed from disk.
This relates to a Consul<->Vault interop issue (#22980), wherein Consul
creates a new issuer on every leadership election, causing this config
to grow. Deleting issuers manually does not entirely solve this problem
as the config does not fully reclaim space used in this entry.
Notably, an observation that when deleting issuers, the CRL was rebuilt
on secondary clusters (due to the invalidation not caring about type of
the operation); for consistency and to clean up the unified CRLs, we
also need to run the rebuild on the active primary cluster that deleted
the issuer as well.
This approach does allow cleanup on existing impacted clusters by simply
rebuilding the CRL.
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add test case on CRL removal
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add changelog entry
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
---------
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
* UI: Handle control group error on SSH (#23025)
* Handle control group error on SSH
* Add changelog
* Fix enterprise failure of TestCRLIssuerRemoval (#23038)
This fixes the enterprise failure of the test
```
=== FAIL: builtin/logical/pki TestCRLIssuerRemoval (0.00s)
crl_test.go:1456:
Error Trace: /home/runner/actions-runner/_work/vault-enterprise/vault-enterprise/builtin/logical/pki/crl_test.go:1456
Error: Received unexpected error:
Global, cross-cluster revocation queue cannot be enabled when auto rebuilding is disabled as the local cluster may not have the certificate entry!
Test: TestCRLIssuerRemoval
Messages: failed enabling unified CRLs on enterprise
```
* fix LDAP auto auth changelog (#23027)
* VAULT-19233 First part of caching static secrets work
* VAULT-19233 update godoc
* VAULT-19233 invalidate cache on non-GET
* VAULT-19233 add locking to proxy cache writes
* VAULT-19233 add caching of capabilities map, and some additional test coverage
* VAULT-19233 Additional testing
* VAULT-19233 namespaces for cache ids
* VAULT-19233 cache-clear testing and implementation
* VAULT-19233 adjust format, add more tests
* VAULT-19233 some more docs
* VAULT-19233 Add RLock holding for map access
* VAULT-19233 PR comments
* VAULT-19233 Different table for capabilities indexes
* VAULT-19233 keep unique for request path
* VAULT-19233 passthrough for non-v1 requests
* VAULT-19233 some renames/PR comment updates
* VAULT-19233 remove type from capabilities index
* VAULT-19233 remove obsolete capabilities
* VAULT-19233 remove erroneous capabilities
* VAULT-19233 woops, missed a test
* VAULT-19233 typo
* VAULT-19233 add custom error for cachememdb
* VAULT-19233 fix cachememdb test
---------
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Chris Capurso <1036769+ccapurso@users.noreply.github.com>
Co-authored-by: Andreas Gruhler <andreas.gruhler@adfinis.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
