mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-01-06 01:01:53 +01:00
Code Issues Projects Releases Wiki Activity

sdk/rotation: Prevent rotation attempts on read-only storage (#10762) (#11160) (#11348)

Browse Source 
* sdk/rotation: Prevent rotation attempts on read-only storage

Rotation is a write operation that mutates both Vault's storage
and an external resource. Attempting this on a read-only node
(like in a performance secondary cluster) will fail.

This check preempts the rotation to prevent a split-brain scenario
where the external credential is changed but Vault's storage
cannot be updated.

* changelog

* fix failing test

Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
This commit is contained in:
Vault Automation 2025-12-15 12:07:41 -05:00 committed by GitHub
parent 8c5ae09b03
commit c5ea9f7b2f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changelog/_10762.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:improvement
sdk/rotation: Prevent rotation attempts on read-only storage
```

5
sdk/framework/backend.go
View File

@ -725,6 +725,11 @@ func (b *Backend) handleRotation(ctx context.Context, req *logical.Request) (*lo
return nil, logical.ErrUnsupportedOperation
}
// rotation is a write operation, so we short-circuit the request
if !b.WriteSafeReplicationState() {
return nil, logical.ErrReadOnly
}
err := b.RotateCredential(ctx, req)
if err != nil {
return nil, err