open-vault/command/server
Scott Miller 25960fd034
Add the ability to unseal using recovery keys via an explicit seal option. (#18683)
* wip

* wip

* Got it 'working', but not happy about cleanliness yet

* Switch to a dedicated defaultSeal with recovery keys

This is simpler than trying to hijack SealAccess as before.  Instead, if the operator
has requested recovery unseal mode (via a flag in the seal stanza), we new up a shamir
seal with the recovery unseal key path instead of the auto seal.  Then everything proceeds
as if you had a shamir seal to begin with.

* Handle recovery rekeying

* changelog

* Revert go.mod redirect

* revert multi-blob info

* Dumb nil unmarshal target

* More comments

* Update vault/seal.go

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Update changelog/18683.txt

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* pr feedback

* Fix recovery rekey, which needs to fetch root keys and restore them under the new recovery split

* Better comment on recovery seal during adjustSealMigration

* Make it possible to migrate from an auto-seal in recovery mode to shamir

* Fix sealMigrated to account for a recovery seal

* comments

* Update changelog/18683.txt

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Address PR feedback

* Refactor duplicated migration code into helpers, using UnsealRecoveryKey/RecoveryKey where appropriate

* Don't shortcut the reast of seal migration

* get rid of redundant transit server cleanup

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
2023-01-24 14:57:56 -06:00
..
test-fixtures OSS PR for Config Changes PR (#18418) 2022-12-15 12:19:19 -08:00
config.go Add the ability to unseal using recovery keys via an explicit seal option. (#18683) 2023-01-24 14:57:56 -06:00
config_custom_response_headers_test.go
config_oss_test.go
config_telemetry_test.go
config_test.go Add experiment system + events experiment (#18682) 2023-01-16 16:07:18 +00:00
config_test_helpers.go Add experiment system + events experiment (#18682) 2023-01-16 16:07:18 +00:00
config_test_helpers_util.go
config_util.go
hcp_link_config_test.go Link OSS (#18228) 2022-12-08 15:02:18 -05:00
listener.go Server: add and support unix listener (UDS) (#18227) 2022-12-09 12:28:18 -08:00
listener_tcp.go
listener_tcp_test.go
listener_test.go Server: add and support unix listener (UDS) (#18227) 2022-12-09 12:28:18 -08:00
listener_unix.go Server: add and support unix listener (UDS) (#18227) 2022-12-09 12:28:18 -08:00
listener_unix_test.go Server: add and support unix listener (UDS) (#18227) 2022-12-09 12:28:18 -08:00
server_seal_transit_acc_test.go Use hashicorp mirror for container pulls (#17778) 2022-11-02 13:33:17 -04:00
tls_util.go Clean up dev cert construction (#17657) 2022-10-26 15:29:37 -04:00