luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Add the Tokenization/Rotation persistence issue as a Known Issue (#19542) 

* Note the known issue with rotation interaction with tokenization key policy persistence

* typo
This commit is contained in:
Scott Miller 2023-03-15 09:42:02 -05:00 committed by GitHub
parent fdd38deb49
commit de31641aea
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
website/content/docs/upgrading/upgrade-to-1.10.x.mdx
View File

@ -91,6 +91,8 @@ to understand how the built-in resources are used in the system.
@include 'raft-panic-old-tls-key.mdx'
@include 'tokenization-rotation-persistence.mdx'
### Errors returned by perf standbys lagging behind active node with Consul storage
The introduction of [Server Side Consistent Tokens](/vault/docs/faq/ssct) means that

2
website/content/docs/upgrading/upgrade-to-1.11.x.mdx
View File

@ -26,3 +26,5 @@ API path by setting the [bool config option](/vault/api-docs/secret/databases/el
## Known Issues
@include 'raft-retry-join-failure.mdx'
@include 'tokenization-rotation-persistence.mdx'

2
website/content/docs/upgrading/upgrade-to-1.12.x.mdx
View File

@ -180,3 +180,5 @@ As a workaround, OCSP POST requests can be used which are unaffected.
#### Impacted Versions
Affects version 1.12.3. A fix will be released in 1.12.4.
@include 'tokenization-rotation-persistence.mdx'

3
website/content/docs/upgrading/upgrade-to-1.13.x.mdx
View File

@ -29,3 +29,6 @@ The AliCloud auth plugin will now require the `role` parameter on login. This
has always been documented as a required field but the requirement will now be
enforced.
## Known Issues
@include 'tokenization-rotation-persistence.mdx'

14
website/content/partials/tokenization-rotation-persistence.mdx Normal file
View File

@ -0,0 +1,14 @@
### Rotation configuration persistence issue could lose Transform Tokenization key versions
A rotation performed manually or via automatic time based rotation after
restarting or leader change of Vault, where configuration of rotation was
changed since the initial configuration of the tokenization transform can
result in the loss of intermediate key versions. Tokenized values from
these versions would not be decodeable. It is recommended that customers
who have enabled automatic rotation disable it, and other customers avoid
key rotation until the upcoming fix.
#### Affected Versions
This issue affects Vault Enterprise with ADP versions 1.10.x and higher. A
fix will be released in Vault 1.11.9, 1.12.5, and 1.13.1.