mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-05-05 04:16:31 +02:00
Code Issues Projects Releases Wiki Activity

VAULT-36565 CE changes (#30925)

Browse Source
This commit is contained in:
Violet Hynes 2025-06-09 16:54:36 -04:00 committed by GitHub
parent 370beb6946
commit 70b8c31bae
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
vault/auth.go
View File

@ -19,6 +19,7 @@ import (
"github.com/hashicorp/vault/sdk/helper/consts"
"github.com/hashicorp/vault/sdk/helper/jsonutil"
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/vault/vault/observations"
"github.com/hashicorp/vault/vault/plugincatalog"
)
@ -248,6 +249,18 @@ func (c *Core) enableCredentialInternal(ctx context.Context, entry *MountEntry,
if c.logger.IsInfo() {
c.logger.Info("enabled credential backend", "path", entry.Path, "type", entry.Type, "version", entry.RunningVersion)
}
err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountAuthEnable, ns, map[string]interface{}{
"path": entry.Path,
"local_mount": entry.Local,
"type": entry.Type,
"accessor": entry.Accessor,
"version": entry.RunningVersion,
})
if err != nil {
c.logger.Error("failed to record observation after enabling credential backend", "path", entry.Path, "error", err)
}
return nil
}
@ -380,6 +393,17 @@ func (c *Core) disableCredentialInternal(ctx context.Context, path string, updat
c.logger.Info("disabled credential backend", "path", path)
}
err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountAuthDisable, ns, map[string]interface{}{
"path": path,
"local_mount": entry.Local,
"type": entry.Type,
"accessor": entry.Accessor,
"version": entry.RunningVersion,
})
if err != nil {
c.logger.Error("failed to record observation after disabling auth backend", "path", path, "error", err)
}
return nil
}

24
vault/mount.go
View File

@ -25,6 +25,7 @@ import (
"github.com/hashicorp/vault/sdk/helper/jsonutil"
"github.com/hashicorp/vault/sdk/helper/pluginutil"
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/vault/vault/observations"
"github.com/hashicorp/vault/vault/plugincatalog"
"github.com/mitchellh/copystructure"
)
@ -784,6 +785,18 @@ func (c *Core) mountInternal(ctx context.Context, entry *MountEntry, updateStora
if c.logger.IsInfo() {
c.logger.Info("successful mount", "namespace", entry.Namespace().Path, "path", entry.Path, "type", entry.Type, "version", entry.RunningVersion)
}
err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountSecretsEnable, ns, map[string]interface{}{
"path": entry.Path,
"local_mount": entry.Local,
"type": entry.Type,
"accessor": entry.Accessor,
"version": entry.RunningVersion,
})
if err != nil {
c.logger.Error("failed to record observation after enabling mount backend", "path", entry.Path, "error", err)
}
return nil
}
@ -967,6 +980,17 @@ func (c *Core) unmountInternal(ctx context.Context, path string, updateStorage b
c.logger.Info("successfully unmounted", "path", path, "namespace", ns.Path)
}
err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountSecretsDisable, ns, map[string]interface{}{
"path": entry.Path,
"local_mount": entry.Local,
"type": entry.Type,
"accessor": entry.Accessor,
"version": entry.RunningVersion,
})
if err != nil {
c.logger.Error("failed to record observation after enabling mount backend", "path", entry.Path, "error", err)
}
return nil
}

4
vault/observations/observations_consts.go
View File

@ -11,4 +11,8 @@ const (
ObservationTypeLeaseLazyRevoke = "lease/lazy-revoke"
ObservationTypeLeaseRevocation = "lease/revoke"
ObservationTypePolicyACLEvaluation = "policy/acl/evaluation"
ObservationTypeMountAuthEnable = "mount/auth/enable"
ObservationTypeMountAuthDisable = "mount/auth/disable"
ObservationTypeMountSecretsEnable = "mount/secrets/enable"
ObservationTypeMountSecretsDisable = "mount/secrets/disable"
)