mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-10 00:27:02 +02:00
Code Issues Projects Releases Wiki Activity
4,886 Commits 2,838 Branches 445 Tags 444 MiB
192b9f361e
Commit Graph

118 Commits

Author SHA1 Message Date
Jeff Mitchell
192b9f361e Change an output to an error 2016-12-06 07:56:45 -05:00
Jeff Mitchell
fb9acace54 Minor ports 2016-12-05 12:28:12 -05:00
Jeff Mitchell
c91a7c51a2 Print the revision, if known, separately from the version. 
Also, indicate whether the build is dynamic or not.
 2016-11-27 19:28:35 -05:00
Jeff Mitchell
2b5fb353f3 Only add version sha if known 2016-11-27 19:16:44 -05:00
Jeff Mitchell
2a84f795f7 Add version sha to server startup output 2016-11-22 16:43:05 -05:00
Jeff Mitchell
24d2f39a7f Don't say mlock is supported on OSX when it isn't. (#2120) 
Fixes #2119
 2016-11-22 12:56:36 -05:00
matt maier
2cd3cfd83e Vendor circonus (#2082) 2016-11-10 16:17:55 -05:00
Jeff Mitchell
601b1b6958 Make listener shutdown more synchronous (#1985) 2016-10-10 13:18:19 -04:00
Jeff Mitchell
81cdd76a5c Adds HUP support for audit log files to close and reopen. (#1953) 
Adds HUP support for audit log files to close and reopen. This makes it
much easier to deal with normal log rotation methods.

As part of testing this I noticed that HUP and other items that come out
of command/server.go are going to stderr, which is where our normal log
lines go. This isn't so much problematic with our normal output but as
we officially move to supporting other formats this can cause
interleaving issues, so I moved those to stdout instead.
 2016-09-30 12:04:50 -07:00
Jeff Mitchell
ad62b32ff0 Rejig where the reload functions live 2016-09-30 00:07:22 -04:00
Jeff Mitchell
721d103f68 Fix parsing env var, needed to be in the helper too 2016-09-23 13:20:26 -04:00
Evan Phoenix
d5038f34b0 Advertise the cluster_(id|name) in the Scada handshake (#1906) 2016-09-23 10:55:51 -04:00
Jeff Mitchell
0358a4b161 Use VAULT_LOG_FORMAT as an analogue to LOGXI_FORMAT 2016-09-22 17:22:02 -04:00
Jeff Mitchell
941b066780 Add support for PGP encrypting the initial root token. (#1883) 2016-09-13 18:42:24 -04:00
Vishal Nayak
30e199cccf Merge pull request #1836 from hashicorp/truncate-version-string 
Remove the string 'Vault' from version information
 2016-09-01 20:23:26 -04:00
vishalnayak
ee26c7e7b6 Remove the string 'Vault' from version information 2016-09-01 14:54:04 -04:00
Jeff Mitchell
392565fe01 Remove hex output from keys; standardize on B64 for CLI output. This (#1831) 
aligns with all other interactions which use B64 encoding for bytes.
 2016-09-01 12:59:15 -04:00
Jeff Mitchell
d40277a18f Plumb through the ability to set the storage read cache size. (#1784) 
Plumb through the ability to set the storage read cache size.

Fixes #1772
 2016-08-26 10:27:06 -04:00
Jeff Mitchell
d5fcc1b74f Don't validate a dev listen address as that makes a proper Docker 
entrypoint difficult.

Fixes #1762
 2016-08-23 08:34:43 -04:00
Jeff Mitchell
68345eb770 Convert to logxi 2016-08-21 18:13:37 -04:00
Jeff Mitchell
edd6379466 Clustering enhancements (#1747) 2016-08-19 11:03:53 -04:00
Jeff Mitchell
e20eaea59f Force dev on when dev-ha is on 2016-08-19 08:29:34 -04:00
Jeff Mitchell
ed48b008ce Provide base64 keys in addition to hex encoded. (#1734) 
* Provide base64 keys in addition to hex encoded.

Accept these at unseal/rekey time.

Also fix a bug where backup would not be honored when doing a rekey with
no operation currently ongoing.
 2016-08-15 16:01:15 -04:00
Jeff Mitchell
645540012f Request forwarding (#1721) 
Add request forwarding.
 2016-08-15 09:42:42 -04:00
Jeff Mitchell
32b39e808b Close the shutdown channel instead of sending a value down 2016-08-01 11:58:45 -04:00
vishalnayak
577cd9de35 Address review feedback 2016-08-01 11:15:25 -04:00
vishalnayak
5318130ba2 Make the defer statement of waitgroup to execute last 2016-08-01 10:24:27 -04:00
vishalnayak
461c30969e Sharing shutdown message with physical consul backend 2016-07-31 10:09:16 -04:00
vishalnayak
13c4bbf9d7 Add waitgroup wait to allow physical consul to deregister checks 2016-07-30 13:17:29 -04:00
vishalnayak
e5c61509d6 Remove global name/id. Make only cluster name configurable. 2016-07-26 10:01:35 -04:00
vishalnayak
55cf44bc91 Storing local and global cluster name/id to storage and returning them in health status 2016-07-26 02:32:42 -04:00
matt maier
a1b50427f2 Circonus integration for telemetry metrics 2016-07-22 15:49:23 -04:00
Jeff Mitchell
a347917044 Turn off DynamoDB HA by default. 
The semantics are wonky and have caused issues from people not reading
docs. It can be enabled but by default is off.
 2016-07-18 13:19:58 -04:00
Bill Monkman
64d72672ff #1486 : Fixed sealed and leader checks for consul backend 2016-06-03 16:00:31 -07:00
Jeff Mitchell
d32283ba49 Initial Atlas listener implementation 2016-06-02 14:05:47 -04:00
vishalnayak
cbf7ccb73d Prioritize dev flags over its env vars 2016-06-01 12:21:29 -04:00
Jeff Mitchell
17d02aa46e Merge branch 'master-oss' into f-vault-service 2016-05-04 17:20:00 -04:00
Jeff Mitchell
4268158c82 Properly handle sigint/hup 2016-05-03 14:30:58 -04:00
Jeff Mitchell
b5b8ac8686 Ensure seal finalizing happens even when using verify-only 2016-04-28 14:06:05 -04:00
Sean Chittenden
eedd7f0c39 Change the interface of ServiceDiscovery 
Instead of passing state, signal that the state has changed and provide a callback handler that can query Core.
 2016-04-28 11:05:18 -07:00
Sean Chittenden
455b76828f Add a *log.Logger argument to physical.Factory 
Logging in the backend is a good thing.  This is a noisy interface change but should be a functional noop.
 2016-04-25 20:10:32 -07:00
Sean Chittenden
9647f2e067 Collapse UpdateAdvertiseAddr() into RunServiceDiscovery() 2016-04-25 18:01:13 -07:00
Sean Chittenden
53dd43650e Various refactoring to clean up code organization 
Brought to you by: Dept of 2nd thoughts before pushing enter on `git push`
 2016-04-25 18:01:13 -07:00
Sean Chittenden
c0bbeba5ad Teach Vault how to register with Consul 
Vault will now register itself with Consul.  The active node can be found using `active.vault.service.consul`.  All standby vaults are available via `standby.vault.service.consul`.  All unsealed vaults are considered healthy and available via `vault.service.consul`.  Change in status and registration is event driven and should happen at the speed of a write to Consul (~network RTT + ~1x fsync(2)).

Healthy/active:

```
curl -X GET 'http://127.0.0.1:8500/v1/health/service/vault?pretty' && echo;
[
    {
        "Node": {
            "Node": "vm1",
            "Address": "127.0.0.1",
            "TaggedAddresses": {
                "wan": "127.0.0.1"
            },
            "CreateIndex": 3,
            "ModifyIndex": 20
        },
        "Service": {
            "ID": "vault:127.0.0.1:8200",
            "Service": "vault",
            "Tags": [
                "active"
            ],
            "Address": "127.0.0.1",
            "Port": 8200,
            "EnableTagOverride": false,
            "CreateIndex": 17,
            "ModifyIndex": 20
        },
        "Checks": [
            {
                "Node": "vm1",
                "CheckID": "serfHealth",
                "Name": "Serf Health Status",
                "Status": "passing",
                "Notes": "",
                "Output": "Agent alive and reachable",
                "ServiceID": "",
                "ServiceName": "",
                "CreateIndex": 3,
                "ModifyIndex": 3
            },
            {
                "Node": "vm1",
                "CheckID": "vault-sealed-check",
                "Name": "Vault Sealed Status",
                "Status": "passing",
                "Notes": "Vault service is healthy when Vault is in an unsealed status and can become an active Vault server",
                "Output": "",
                "ServiceID": "vault:127.0.0.1:8200",
                "ServiceName": "vault",
                "CreateIndex": 19,
                "ModifyIndex": 19
            }
        ]
    }
]
```

Healthy/standby:

```
[snip]
        "Service": {
            "ID": "vault:127.0.0.2:8200",
            "Service": "vault",
            "Tags": [
                "standby"
            ],
            "Address": "127.0.0.2",
            "Port": 8200,
            "EnableTagOverride": false,
            "CreateIndex": 17,
            "ModifyIndex": 20
        },
        "Checks": [
            {
                "Node": "vm2",
                "CheckID": "serfHealth",
                "Name": "Serf Health Status",
                "Status": "passing",
                "Notes": "",
                "Output": "Agent alive and reachable",
                "ServiceID": "",
                "ServiceName": "",
                "CreateIndex": 3,
                "ModifyIndex": 3
            },
            {
                "Node": "vm2",
                "CheckID": "vault-sealed-check",
                "Name": "Vault Sealed Status",
                "Status": "passing",
                "Notes": "Vault service is healthy when Vault is in an unsealed status and can become an active Vault server",
                "Output": "",
                "ServiceID": "vault:127.0.0.2:8200",
                "ServiceName": "vault",
                "CreateIndex": 19,
                "ModifyIndex": 19
            }
        ]
    }
]
```

Sealed:

```
        "Checks": [
            {
                "Node": "vm2",
                "CheckID": "serfHealth",
                "Name": "Serf Health Status",
                "Status": "passing",
                "Notes": "",
                "Output": "Agent alive and reachable",
                "ServiceID": "",
                "ServiceName": "",
                "CreateIndex": 3,
                "ModifyIndex": 3
            },
            {
                "Node": "vm2",
                "CheckID": "vault-sealed-check",
                "Name": "Vault Sealed Status",
                "Status": "critical",
                "Notes": "Vault service is healthy when Vault is in an unsealed status and can become an active Vault server",
                "Output": "Vault Sealed",
                "ServiceID": "vault:127.0.0.2:8200",
                "ServiceName": "vault",
                "CreateIndex": 19,
                "ModifyIndex": 38
            }
        ]
```
 2016-04-25 18:01:13 -07:00
Sean Chittenden
bd5305e470 Stub out service discovery functionality 
Hook asynchronous notifications into Core to change the status of vault based on its active/standby, and sealed/unsealed status.
 2016-04-25 18:00:54 -07:00
Sean Chittenden
f2dc2f636e Comment nits 2016-04-25 18:00:54 -07:00
Sean Chittenden
bc570e74f3 Fix SIGINT handling. 
No signal handler was setup to receive SIGINT.  I didn't investigate to
see if signal(2) mask was setup (ala `SIG_IGN`) or if sigprocmask(2) is
being used, but in either case, the correct behavior is to capture and
treat SIGINT the same as SIGTERM.  At some point in the future these two
signals may affect the running process differently, but we will clarify
that difference in the future.
 2016-04-15 10:03:22 -07:00
Jeff Mitchell
94d6b3ce94 Add Finalize method to seal. 2016-04-14 20:37:34 +00:00
Jeff Mitchell
d273a051c7 Check for seal status when initing and change logic order to avoid defer 2016-04-14 01:13:59 +00:00
Sean Chittenden
ffe34bf375 Reinstall the mlockall(2) command 
Requested by: jefferai
 2016-04-05 13:58:26 -07:00