mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-24 16:11:08 +02:00
3b31b3e939
Verify vault secret integrity in unauthenticated I/O streams (audit log, STDOUT/STDERR via the systemd journal) by scanning the text with Vault Radar. We search for both known and unknown secrets by using an index of KVV2 values and also by radar's built-in heuristics for credentials, secrets, and keys. The verification has been added to many scenarios where a slight time increase is allowed, as we now have to install Vault Radar and scan the text. In practice this adds less than 10 seconds to the overall duration of a scenario. In the in-place upgrade scenario we explicitly exclude this verification when upgrading from a version that we know will fail the check. We also make the verification opt-in so as to not require a Vault Radar license to run Enos scenarios, though it will always be enabled in CI. As part of this we also update our enos workflow to utilize secret values from our self-hosted Vault when executing in the vault-enterprise repo context. Signed-off-by: Ryan Cragun <me@ryan.ec>
40 lines
1.2 KiB
Bash
40 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Copyright (c) HashiCorp, Inc.
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
set -e
|
|
|
|
fail() {
|
|
echo "$1" 1>&2
|
|
exit 1
|
|
}
|
|
|
|
[[ -z "$ARTIFACT_NAME" ]] && fail "ARTIFACT_NAME env variable has not been set"
|
|
|
|
if [ "${ARTIFACT_NAME##*.}" == "zip" ]; then
|
|
echo "Skipped removing unit file because new artifact is a zip bundle"
|
|
exit 0
|
|
fi
|
|
|
|
# Get the unit file for the vault.service that is running. If it's not in /etc/systemd then it
|
|
# should be a package provided unit file so we don't need to delete anything.
|
|
#
|
|
# Note that we use -p instead of -P so that we support ancient amzn 2 systemctl.
|
|
if ! unit_path=$(systemctl show -p FragmentPath vault | cut -d = -f2 2>&1); then
|
|
echo "Skipped removing unit file because and existing path could not be found: $unit_path"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$unit_path" == *"/etc/systemd"* ]]; then
|
|
if [ -f "$unit_path" ]; then
|
|
echo "Removing old systemd unit file: $unit_path"
|
|
if ! out=$(sudo rm "$unit_path" 2>&1); then
|
|
fail "Failed to remove old unit file: $unit_path: $out"
|
|
fi
|
|
else
|
|
echo "Skipped removing old systemd unit file because it no longer exists: $unit_path"
|
|
fi
|
|
else
|
|
echo "Skipped removing old systemd unit file because it was not created in /etc/systemd/: $unit_path"
|
|
fi
|