diff --git a/changelog/16956.txt b/changelog/16956.txt new file mode 100644 index 000000000..8912f727f --- /dev/null +++ b/changelog/16956.txt @@ -0,0 +1,3 @@ +```release-note:bug +core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. +``` diff --git a/vault/token_store_util_common.go b/vault/token_store_util_common.go index 235e2d216..a10bb83a8 100644 --- a/vault/token_store_util_common.go +++ b/vault/token_store_util_common.go @@ -38,6 +38,9 @@ func (ts *TokenStore) loadSSCTokensGenerationCounter(ctx context.Context) error } func (ts *TokenStore) UpdateSSCTokensGenerationCounter(ctx context.Context) error { + if err := ts.loadSSCTokensGenerationCounter(ctx); err != nil { + return err + } ts.sscTokensGenerationCounter.Counter += 1 if ts.sscTokensGenerationCounter.Counter <= 0 { // Don't store the 0 value