* [CI-only] Update RedHat registry tag
There are a few changes being made to RedHat's registry on October 20, 2022 that affect the way images need to be tagged prior to being pushed to the registry. This PR changes the tag to conform to the new standard.
We have other work queued up in crt-workflows-common and actions-docker-build to support the other required changes.
This PR should be merged to `main` and all release branches on or after October 20, 2022, and MUST be merged before your next production release. Otherwise, the automation to push to the RedHat registry will not work.
----
A detailed list of changes shared from RedHat (as an FYI):
The following changes will occur for container certification projects that leverage the Red Hat hosted registry [[registry.connect.redhat.com](http://registry.connect.redhat.com/)] for image distribution:
- All currently published images are migrating to a NEW, Red Hat hosted quay registry. Partners do not have to do anything for this migration, and this will not impact customers. The registry will still utilize [registry.connect.redhat.com](http://registry.connect.redhat.com/) as the registry URL.
- The registry URL currently used to push, tag, and certify images, as well as the registry login key, will change. You can see these changes under the “Images” tab of the container certification project. You will now see a [quay.io](http://quay.io/) address and will no longer see [scan.connect.redhat.com](http://scan.connect.redhat.com/).
- Partners will have the opportunity to auto-publish images by selecting “Auto-publish” in the Settings tab of your certification project. This will automatically publish images that pass all certification tests.
- For new container image projects, partners will have the option to host within their own chosen image registry while using [registry.connect.redhat.com](http://registry.connect.redhat.com/) as a proxy address. This means the end user can authenticate to the Red Hat registry to pull a partner image without having to provide additional authentication to the partner’s registry.
* docker: update redhat_tag
Co-authored-by: Sam Salisbury <samsalisbury@gmail.com>
Since 1.9 k8s auth method supports setting Name reported by auth method to Service Account name which is not reflected in this doc
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
* runs ember-cli-update to 4.4.0
* updates yarn.lock
* updates dependencies causing runtime errors (#17135)
* Inject Store Service When Accessed Implicitly (#17345)
* adds codemod for injecting store service
* adds custom babylon parser with decorators-legacy plugin for jscodeshift transforms
* updates inject-store-service codemod to only look for .extend object expressions and adds recast options
* runs inject-store-service codemod on js files
* replace query-params helper with hash (#17404)
* Updates/removes dependencies throwing errors in Ember 4.4 (#17396)
* updates ember-responsive to latest
* updates ember-composable-helpers to latest and uses includes helper since contains was removed
* updates ember-concurrency to latest
* updates ember-cli-clipboard to latest
* temporary workaround for toolbar-link component throwing errors for using params arg with LinkTo
* adds missing store injection to auth configure route
* fixes issue with string-list component throwing error for accessing prop in same computation
* fixes non-iterable query params issue in mfa methods controller
* refactors field-to-attrs to handle belongsTo rather than fragments
* converts mount-config fragment to belongsTo on auth-method model
* removes ember-api-actions and adds tune method to auth-method adapter
* converts cluster replication attributes from fragment to relationship
* updates ember-data, removes ember-data-fragments and updates yarn to latest
* removes fragments from secret-engine model
* removes fragment from test-form-model
* removes commented out code
* minor change to inject-store-service codemod and runs again on js files
* Remove LinkTo positional params (#17421)
* updates ember-cli-page-object to latest version
* update toolbar-link to support link-to args and not positional params
* adds replace arg to toolbar-link component
* Clean up js lint errors (#17426)
* replaces assert.equal to assert.strictEqual
* update eslint no-console to error and disables invididual intended uses of console
* cleans up hbs lint warnings (#17432)
* Upgrade bug and test fixes (#17500)
* updates inject-service codemod to take arg for service name and runs for flashMessages service
* fixes hbs lint error after merging main
* fixes flash messages
* updates more deps
* bug fixes
* test fixes
* updates ember-cli-content-security-policy and prevents default form submission throwing errors
* more bug and test fixes
* removes commented out code
* fixes issue with code-mirror modifier sending change event on setup causing same computation error
* Upgrade Clean Up (#17543)
* updates deprecation workflow and filter
* cleans up build errors, removes unused ivy-codemirror and sass and updates ember-cli-sass and node-sass to latest
* fixes control groups test that was skipped after upgrade
* updates control group service tests
* addresses review feedback
* updates control group service handleError method to use router.currentURL rather that transition.intent.url
* adds changelog entry
* VAULT-8719 Support data array for alias clash error response so UI can understand error
* VAULT-8719 Changelog
* VAULT-8719 Update alias mount update logic
* VAULT-8719 Further restrict IsError()
The SSH secrets engine previously split the `validPrincipals` field
on comma, then if user templating is enabled, evaluated the
templates on each substring. This meant the identity template was only
ever allowed to return a single principal. There are use cases
where it would be helpful for identity metadata to contain a list
of valid principals and for the identity template to be able to inject
all of those as valid principals.
This change inverts the order of processing. First the template
is evaluated, and then the resulting string is split on commas.
This allows the identity template to return a single comma-separated
string with multiple permitted principals.
There is a potential security implication here, that if a user is
allowed to update their own identity metadata, they may be able to
elevate privileges where previously this was not possible.
Fixes#11038
* Clarify language around PSS CSR issues
Also point out that PKCS#11 tokens have the same problem.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Update website/content/docs/secrets/pki/considerations.mdx
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
[`govulncheck`](https://go.dev/blog/vuln) reports that the `api` package
has a call chain that includes
`golang.org/x/net/http/httpguts.HeaderValuesContainsToken`, a vulnerable
function.
* dynamically render the secretlistheader in the parent route.
* start getting form setup even without openAPi working
* add in create and cancel
* making openAPI work
* add default openAPI params
* wip for new component with two radio options a ttl and input
* handle createRecord on pki-roles-form
* remove tooltips and cleanup
* move formfieldgroupsloop back to non addon
* cleanup
* move secretListHeader
* broadcast from radioSelectTtlOrString to parent
* cleanup
* hide tooltips
* pass through sub text to stringArray
* Add conditional for keybits and keyType
* set defaults for keyBits ... 🤮
* fix some small issues
* more info form field typ
* show only label and subText
* wip context switch 🤮
* fix dontShowLabel
* getting css grid setup
* more on flex groups
* adding the second chunk to key usage
* serialize the post for key_usage
* finish for ext_key_usage
* clean up
* fix snack_case issue
* commit for working state, next trying to remove form-field-group-loops because it's causing issues.
* remove usage of formfieldgroupsloop because of issues with css grid and conditionals
* clean up
* remove string-list helpText changes for tooltip removal because that should be it's own pr.
* clarification from design and backend.
* small cleanup
* pull key_usage and ext_key_usage out of the model and into a component
* clean up
* clean up
* restructure css grid:
* clean up
* broke some things
* fix error when roles list returned 404
* claires feedback
* cleanup
* clean up
* Add tests for zlint-clean CA building
This test ensures that we can consistently pass ZLint's CA linting
tests on a root certificate generated by Vault. In particular, nominal
requirements are placed on the structure on the issuer's Subject, which
we supply, and the remaining requirements pass.
The one exception is we include both RFC and CA/BF BR lints in the
default zlint checks; this means ECDSA P-521 (which isn't accepted by
Mozilla's root store policies) is rejected, so we ignore to lints
related to that.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add options to copy to/from container, fix stopping
Stopping the container takes a bit of time for some unknown reason so
I've instead opted to shorten the sleep in the zlint tests to avoid
consuming resources too long after the test finish.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Make zlint tests execute in parallel
This improves the overall test time of the zlint tests, making the
container build up front once (provisioning zlint), and then copying the
cert into the new container image later.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* make fmt
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
