mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-09-02 12:31:08 +02:00
Code Issues Projects Releases Wiki Activity

vault: create upgrade path in HA mode

Browse Source
This commit is contained in:
Armon Dadgar 2015-05-28 16:43:15 -07:00
parent 7d0a72d9d6
commit fa9c85dbaf
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
vault/logical_system.go
View File

@ -750,11 +750,28 @@ func (b *SystemBackend) handleKeyStatus(
// handleRotate is used to trigger a key rotation // handleRotate is used to trigger a key rotation
func (b *SystemBackend) handleRotate( func (b *SystemBackend) handleRotate(
req *logical.Request, data *framework.FieldData) (*logical.Response, error) { req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
if err := b.Core.barrier.Rotate(); err != nil { // Rotate to the new term
newTerm, err := b.Core.barrier.Rotate()
if err != nil {
b.Backend.Logger().Printf("[ERR] sys: failed to create new encryption key: %v", err) b.Backend.Logger().Printf("[ERR] sys: failed to create new encryption key: %v", err)
return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
} }
b.Backend.Logger().Printf("[INFO] sys: installed new encryption key") b.Backend.Logger().Printf("[INFO] sys: installed new encryption key")
// In non-HA mode, we need to an upgrade path for the standby instances
if b.Core.ha != nil {
// Create the upgrade path to the new term
if err := b.Core.barrier.CreateUpgrade(newTerm); err != nil {
b.Backend.Logger().Printf("[ERR] sys: failed to create new upgrade for key term %d: %v", newTerm, err)
}
// Schedule the destroy of the upgrade path
time.AfterFunc(keyRotateGracePeriod, func() {
if err := b.Core.barrier.DestroyUpgrade(newTerm); err != nil {
b.Backend.Logger().Printf("[ERR] sys: failed to destroy upgrade for key term %d: %v", newTerm, err)
}
})
}
return nil, nil return nil, nil
} }