luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Merge pull request #12793 from hashicorp/jm/vault-ns-auth 

Set vault namespaces on vault client prior to logging in
This commit is contained in:
Mark Anderson 2022-04-14 18:11:30 -07:00 committed by GitHub
parent da64d62000 fa2167a55f
commit aed99bc77f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changelog/12793.txt Normal file
View File

@ -0,0 +1,5 @@
```release-note:bug
The Connect CA Vault system now sets the Namespace (if present) prior
to attempting to login to Vault. This means the AuthMethod needs to
be in the specified namespace. Previously the AuthMethod needed to be
in the root namespace to work.

15
agent/connect/ca/provider_vault.go
View File

@ -103,6 +103,14 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
return err
}
// We don't want to set the namespace if it's empty to prevent potential
// unknown behavior (what does Vault do with an empty namespace). The Vault
// client also makes sure the inputs are not empty strings so let's do the
// same.
if config.Namespace != "" {
client.SetNamespace(config.Namespace)
}
if config.AuthMethod != nil {
loginResp, err := vaultLogin(client, config.AuthMethod)
if err != nil {
@ -112,13 +120,6 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
}
client.SetToken(config.Token)
// We don't want to set the namespace if it's empty to prevent potential
// unknown behavior (what does Vault do with an empty namespace). The Vault
// client also makes sure the inputs are not empty strings so let's do the
// same.
if config.Namespace != "" {
client.SetNamespace(config.Namespace)
}
v.config = config
v.client = client
v.isPrimary = cfg.IsPrimary