diff --git a/changelog/10708.txt b/changelog/10708.txt new file mode 100644 index 000000000..a33bfb078 --- /dev/null +++ b/changelog/10708.txt @@ -0,0 +1,3 @@ +```release-note:bug +metrics: Protect emitMetrics from panicking during post-seal +``` \ No newline at end of file diff --git a/vault/core_metrics.go b/vault/core_metrics.go index 3d24c2edd..c7d829566 100644 --- a/vault/core_metrics.go +++ b/vault/core_metrics.go @@ -259,6 +259,13 @@ func (c *Core) findKvMounts() []*kvMount { c.mountsLock.RLock() defer c.mountsLock.RUnlock() + // emitMetrics doesn't grab the statelock, so this code might run during or after the seal process. + // Therefore, we need to check if c.mounts is nil. If we do not, emitMetrics will panic if this is + // run after seal. + if c.mounts == nil { + return mounts + } + for _, entry := range c.mounts.Entries { if entry.Type == "kv" { version, ok := entry.Options["version"]