mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-07 07:07:05 +02:00
c6da02962d
* Add a configuration flag for enabling multiseal (Seal HA), CE side * imports * no quotes * get rid of dep on ent config * Abstract enableMultiSeal for a build time switch * license headers * wip * gate physical seal gen fetch by a param * docs tweak, remove core flag * updates from the ent pr * update stub * update test fixtures for enable_multiseal * use accessor * add a test fixture for non-multiseal diagnose * remove debugging crtuch * Do handle phys seal gen info even if multiseal is off, in order to facilitate enable/disable safeties * more enabled flag handling * Accept seal gen info if we were previously disabled, and persist it * update unit test * Validation happens postUnseal, so this test is invalid * Dont continue setting conf if seal loading fails during SIGHUP * Update website/content/docs/configuration/seal/seal-ha.mdx Thanks, that does sound much clearer Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com> * use validation if previous gen was enabled * unit test update * stub SetMultisealEnabled * bring over more changes from ent * this was an unfix --------- Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
56 lines
1001 B
Go
56 lines
1001 B
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build !enterprise
|
|
|
|
package server
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/hcl/hcl/ast"
|
|
)
|
|
|
|
type entConfig struct{}
|
|
|
|
func (ec *entConfig) parseConfig(list *ast.ObjectList, source string) error {
|
|
return nil
|
|
}
|
|
|
|
func (ec entConfig) Merge(ec2 entConfig) entConfig {
|
|
result := entConfig{}
|
|
return result
|
|
}
|
|
|
|
func (ec entConfig) Sanitized() map[string]interface{} {
|
|
return nil
|
|
}
|
|
|
|
func (c *Config) checkSealConfig() error {
|
|
if len(c.Seals) == 0 {
|
|
return nil
|
|
}
|
|
|
|
if len(c.Seals) > 2 {
|
|
return fmt.Errorf("seals: at most 2 seals can be provided: received %d", len(c.Seals))
|
|
}
|
|
|
|
disabledSeals := 0
|
|
for _, seal := range c.Seals {
|
|
if seal.Disabled {
|
|
disabledSeals++
|
|
}
|
|
}
|
|
|
|
if len(c.Seals) > 1 && disabledSeals == len(c.Seals) {
|
|
return errors.New("seals: seals provided but all are disabled")
|
|
}
|
|
|
|
if disabledSeals < len(c.Seals)-1 {
|
|
return errors.New("seals: only one seal can be enabled")
|
|
}
|
|
|
|
return nil
|
|
}
|