mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-06 06:37:02 +02:00
0b9157156f
* upgrade hcl dependency on api pkg
This upgrades the hcl dependency for the API pkg,
and adapts its usage so users of our API pkg are
not affected. There's no good way of communicating
a warning via a library call so we don't.
The tokenHelper which is used by all Vault CLI
commands in order to create the Vault client, as
well as directly used by the login and server
commands, is implemented on the api pkg, so this
upgrade also affects all of those commands. Seems
like this was only moved to the api pkg because
the Terraform provider uses it, and I thought
creating a full copy of all those files back under
command would be too much spaghetti.
Also leaving some TODOs to make next deprecation
steps easier.
* upgrade hcl dependency in vault and sdk pkgs
* upgrade hcl dependency in vault and sdk pkgs
* add CLI warnings to commands that take a config
- vault agent (unit test on CMD warning)
- vault proxy (unit test on CMD warning)
- vault server (no test for the warning)
- vault operator diagnose (no tests at all, uses the
same function as vault server
* ignore duplicates on ParseKMSes function
* Extend policy parsing functions and warn on policy store
* Add warning on policy fmt with duplicate attributes
* Add warnings when creating/updating policy with duplicate HCL attrs
* Add log warning when switchedGetPolicy finds duplicate attrs
Following operations can trigger this warning when they run into a policy
with duplicate attributes:
* replication filtered path namespaces invalidation
* policy read API
* building an ACL (for many different purposes like most authZ operations)
* looking up DR token policies
* creating a token with named policies
* when caching the policies for all namespaces during unseal
* Print log warnings when token inline policy has duplicate attrs
No unit tests on these as new test infra would have to be built on all.
Operations affected, which will now print a log warning when the retrieved
token has an inline policy with duplicate attributes:
* capabilities endpoints in sys mount
* handing events under a subscription with a token with duplicate
attrs in inline policies
* token used to create another token has duplicate attrs in inline
policies (sudo check)
* all uses of fetchACLTokenEntryAndEntity when the request uses a
token with inline policies with duplicate attrs. Almost all reqs
are subject to this
* when tokens are created with inline policies (unclear exactly how that
can happen)
* add changelog and deprecation notice
* add missing copywrite notice
* fix copy-paste mistake
good thing it was covered by unit tests
* Fix manual parsing of telemetry field in SharedConfig
This commit in the hcl library was not in the
v1.0.1-vault-5 version we're using but is
included in v1.0.1-vault-7:
|
||
|---|---|---|
| .. | ||
| auth | ||
| cliconfig | ||
| test-fixtures | ||
| tokenhelper | ||
| .copywrite.hcl | ||
| api_test.go | ||
| auth_test.go | ||
| auth_token.go | ||
| auth.go | ||
| client_test.go | ||
| client.go | ||
| go.mod | ||
| go.sum | ||
| hcl_dup_attr_deprecation.go | ||
| help.go | ||
| kv_test.go | ||
| kv_v1.go | ||
| kv_v2.go | ||
| kv.go | ||
| LICENSE | ||
| lifetime_watcher.go | ||
| logical.go | ||
| output_policy_test.go | ||
| output_policy.go | ||
| output_string.go | ||
| plugin_helpers.go | ||
| plugin_runtime_types.go | ||
| plugin_types_test.go | ||
| plugin_types.go | ||
| pluginruntimetype_enumer.go | ||
| README.md | ||
| renewbehavior_enumer.go | ||
| renewer_test.go | ||
| replication_status.go | ||
| request_test.go | ||
| request.go | ||
| response.go | ||
| secret_test.go | ||
| secret.go | ||
| ssh_agent_test.go | ||
| ssh_agent.go | ||
| ssh.go | ||
| sudo_paths_test.go | ||
| sudo_paths.go | ||
| sys_audit.go | ||
| sys_auth.go | ||
| sys_capabilities.go | ||
| sys_config_cors.go | ||
| sys_generate_root.go | ||
| sys_hastatus.go | ||
| sys_health.go | ||
| sys_init.go | ||
| sys_leader.go | ||
| sys_leases.go | ||
| sys_mfa.go | ||
| sys_monitor.go | ||
| sys_mounts_test.go | ||
| sys_mounts.go | ||
| sys_plugins_runtimes_test.go | ||
| sys_plugins_runtimes.go | ||
| sys_plugins_test.go | ||
| sys_plugins.go | ||
| sys_policy.go | ||
| sys_raft.go | ||
| sys_rekey.go | ||
| sys_rotate.go | ||
| sys_seal.go | ||
| sys_stepdown.go | ||
| sys_ui_custom_message_test.go | ||
| sys_ui_custom_message.go | ||
| sys_utilization_report.go | ||
| sys.go | ||
Vault API
This provides the github.com/hashicorp/vault/api package which contains code useful for interacting with a Vault server.
For examples of how to use this module, see the vault-examples repo. For a step-by-step walkthrough on using these client libraries, see the developer quickstart.
