* Update cert metadata docs
- Add missing enterprise notices on parameters and titles
- Mention that the metadata parameter is a base64 encoded string
- Tweak the no_store_metadata description
- Update some entries within the PKI considerations page
* Add serial_number to read certificate metadata sample response
* Update fields sign-verbatim is affected by the specified role
* add note around CRL rotation not occuring on revoke if auto_rebuild is enabled
A note to clarify that revocation will not trigger a rotation of the CRL if auto_rebuild of the CRL is set to true/enabled.
* fix links
fix links
* Update pki.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update pki.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---------
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* PKI: Change sign-intermediate to truncate notAfter by default
- The PKI sign-intermediate API allowed an end-user to request a TTL
value that would extend beyond the signing issuer's notAfter. This would
generate an invalid CA chain when properly validated.
- We are now changing the default behavior to truncate the returned certificate
to the signing issuer's notAfter.
- End-users can get the old behavior by configuring the signing issuer's
leaf_not_after_behavior field to permit, and call sign-intermediary
with the new argument enforce_leaf_not_after_behavior to true. The
new argument could also be used to enforce an error instead of truncating
behavior if the signing issuer's leaf_not_after_behavior is set to err.
* Add cl
* Add cl and upgrade note
* Apply suggestions from code review
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---------
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Document tokenization DELETE
* typo
* Update website/content/api-docs/secret/transform.mdx
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
---------
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
* Docs: New parameter for the K8s Secrets roles
* Fix: Apply text correction from review
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
---------
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
Co-authored-by: Peter Wilson <peter.wilson@hashicorp.com>
* PKI EST docs
Initial draft of the PKI EST setup and API docs for feedback
* Add missing enable_sentinel_parsing param to API docs
* Update grammar
* Some API doc feedback
* Note about dedicated auth mounts
* Additional PR feedback
---------
Co-authored-by: Scott G. Miller <smiller@hashicorp.com>
* Add note around OCSP GET request issue
- Fix some broken TOC links
- Add a note in the api-docs and in the considerations page
around Vault having issues with OCSP GET requests and that
POST requests should be preferred.
- Add existing known issue to all branches that are affected.
* Fix links to partial file for 1.12 and 1.13 upgrade docs
- Noticed that our documentation was out of date, we allow 8192
bit RSA keys to be used as an argument to the various PKI
issuer/key creation APIs.
- Augument some unit tests to verify this continues to work
* updated the LIST identity/entity-alias/id endpoint docs to reflect new data returned
* Update website/content/api-docs/secret/identity/entity-alias.mdx
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
* Update website/content/api-docs/secret/identity/entity-alias.mdx
Co-authored-by: Max Bowsher <maxbowsher@gmail.com>
---------
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
Co-authored-by: Max Bowsher <maxbowsher@gmail.com>
* Add api-docs for PKI CIEPS sign-intermediate
- This adds the CIEPS sign-intermediate api-docs and tweaks the existing CIEPS apis to mark the policy url argument as optional.
* Define CIEPS in the first use per section
* Add metadata policy requirement for KV-V2 list.mdx
Customer requested change as our API docs page does not state the token policy must have access to metadata in the policy when listing KV-V2 secrets. I let them know it exists here: https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2#acl-rules, in the ACL section, but they wanted to have it added to the API docs as well.
* Update website/content/api-docs/secret/kv/kv-v2.mdx
---------
Co-authored-by: Violet Hynes <violet.hynes@hashicorp.com>
* Clarify wording, add missing expiration fields
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add API docs on CIEPS configuration
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Fix ToC, headers to include EnterpriseAlert
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Update website/content/api-docs/secret/pki.mdx
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
* Update website/content/api-docs/secret/pki.mdx
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
---------
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
* imprv: Add a parameter to allow ExtKeyUsage field usage from a role
* chore: Add the changelog entry
* imprv: Reword UI and changelog
* doc: Add allow_role_extkeyusage in parameter list
* imprv: Align variable names with existing fields/codebase
* Add unit test and tweak some labels
---------
Co-authored-by: Steve Clark <steven.clark@hashicorp.com>
* Refactor `identity/mfa/method/*` endpoints to fix bad OpenAPI
There is a problem with how the `identity/mfa/method/*` endpoints are
defined, resulting in incorrect OpenAPI generation.
I raised hashicorp/vault-client-go#180 to track a consequence, and
opened #20873 which explains the problem and adds a log message to
detect it.
This PR is now the fix.
It's actually quite an interesting problem, that has come about through
some particular implementation choices, in Vault's first/only case where
REST API objects are created by writing to the collection URL, and have
their ID allocated by the server, instead of the client.
The triggering cause of the malfunction was trying to have a single
framework.Path struct instance which optionally includes or excludes the
method_id path parameter, and also another framework.Path struct
instance handling list operations.
The fix is to simplify the path regexes, and have one framework.Path
which handles the method_id being present, and one that handles it being
absent.
The diff is somewhat large, because the affected code had been
copy/pasted four times (TOTP, Okta, Duo, PingID) - so I took the
opportunity to fix the duplication, creating appropriate helper methods
so that the quadruplicated code could be re-unified.
* Revise documentation
This update refactors how the documentation presents these endpoints to
users, both for clarity, and to align with the new structure of the
code.
From a user perspective, it clears up some unclear presentation of when
the `method_id` parameter should and should not be present, adds
a missing description of the response to create requests, and changes
the `method_id` parameter name to be used consistently (rather than `id`
in some cases, unlike the actual code/OpenAPI).
* Fix incorrect acronym (review fix)
* Accept suggestion of tweaked grammar in documentation
Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com>
* Add changelog
---------
Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com>
