mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-07 23:27:01 +02:00
2ffe49aab0
* wip * wip * Got it 'working', but not happy about cleanliness yet * Switch to a dedicated defaultSeal with recovery keys This is simpler than trying to hijack SealAccess as before. Instead, if the operator has requested recovery unseal mode (via a flag in the seal stanza), we new up a shamir seal with the recovery unseal key path instead of the auto seal. Then everything proceeds as if you had a shamir seal to begin with. * Handle recovery rekeying * changelog * Revert go.mod redirect * revert multi-blob info * Dumb nil unmarshal target * More comments * Update vault/seal.go Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com> * Update changelog/18683.txt Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com> * pr feedback * Fix recovery rekey, which needs to fetch root keys and restore them under the new recovery split * Better comment on recovery seal during adjustSealMigration * Make it possible to migrate from an auto-seal in recovery mode to shamir * Fix sealMigrated to account for a recovery seal * comments * Update changelog/18683.txt Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com> * Address PR feedback * Refactor duplicated migration code into helpers, using UnsealRecoveryKey/RecoveryKey where appropriate * Don't shortcut the reast of seal migration * get rid of redundant transit server cleanup Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
77 lines
2.1 KiB
Go
77 lines
2.1 KiB
Go
package api
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
)
|
|
|
|
func (c *Sys) InitStatus() (bool, error) {
|
|
return c.InitStatusWithContext(context.Background())
|
|
}
|
|
|
|
func (c *Sys) InitStatusWithContext(ctx context.Context) (bool, error) {
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
defer cancelFunc()
|
|
|
|
r := c.c.NewRequest(http.MethodGet, "/v1/sys/init")
|
|
|
|
resp, err := c.c.rawRequestWithContext(ctx, r)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var result InitStatusResponse
|
|
err = resp.DecodeJSON(&result)
|
|
return result.Initialized, err
|
|
}
|
|
|
|
func (c *Sys) Init(opts *InitRequest) (*InitResponse, error) {
|
|
return c.InitWithContext(context.Background(), opts)
|
|
}
|
|
|
|
func (c *Sys) InitWithContext(ctx context.Context, opts *InitRequest) (*InitResponse, error) {
|
|
ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
|
|
defer cancelFunc()
|
|
|
|
r := c.c.NewRequest(http.MethodPut, "/v1/sys/init")
|
|
if err := r.SetJSONBody(opts); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
resp, err := c.c.rawRequestWithContext(ctx, r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var result InitResponse
|
|
err = resp.DecodeJSON(&result)
|
|
return &result, err
|
|
}
|
|
|
|
type InitRequest struct {
|
|
SecretShares int `json:"secret_shares"`
|
|
SecretThreshold int `json:"secret_threshold"`
|
|
StoredShares int `json:"stored_shares"`
|
|
PGPKeys []string `json:"pgp_keys"`
|
|
RecoveryShares int `json:"recovery_shares"`
|
|
RecoveryThreshold int `json:"recovery_threshold"`
|
|
RecoveryPGPKeys []string `json:"recovery_pgp_keys"`
|
|
RootTokenPGPKey string `json:"root_token_pgp_key"`
|
|
UnsealRecoveryDisabled bool `json:"disable_unseal_recovery"`
|
|
}
|
|
|
|
type InitStatusResponse struct {
|
|
Initialized bool
|
|
}
|
|
|
|
type InitResponse struct {
|
|
Keys []string `json:"keys"`
|
|
KeysB64 []string `json:"keys_base64"`
|
|
RecoveryKeys []string `json:"recovery_keys"`
|
|
RecoveryKeysB64 []string `json:"recovery_keys_base64"`
|
|
RootToken string `json:"root_token"`
|
|
UnsealRecoveryAvailable bool `json:"unseal_recovery_available"`
|
|
}
|