luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity
open-vault/vault
History
Seth Vargo c3f1043c24 Reduce required permissions for the GCPCKMS auto-unsealer (#5999) 
This changes the behavior of the GCPCKMS auto-unsealer setup to attempt
encryption instead of a key lookup. Key lookups are a different API
method not covered by roles/cloudkms.cryptoKeyEncrypterDecrypter. This
means users must grant an extended scope to their service account
(granting the ability to read key data) which only seems to be used to
validate the existence of the key.

Worse, the only roles that include this permission are overly verbose
(e.g. roles/viewer which gives readonly access to everything in the
project and roles/cloudkms.admin which gives full control over all key
operations). This leaves the user stuck between choosing to create a
custom IAM role (which isn't fun) or grant overly broad permissions.

By changing to an encrypt call, we get better verification of the unseal
permissions and users can reduce scope to a single role.
 		2019-01-04 16:29:31 -05:00
..
external_tests Remove token store paths with token/accessors in URLs (#5773) 2018-11-19 16:58:19 -05:00
seal Reduce required permissions for the GCPCKMS auto-unsealer (#5999) 2019-01-04 16:29:31 -05:00
acl.go The big one (#5346) 2018-09-17 23:03:00 -04:00
acl_test.go Remove namespace.TestContext and namespace.TestNamespace (#5682) 2018-11-05 11:11:32 -05:00
acl_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
audit.go perf-standby: Fix audit table upgrade on standbys (#5811) 2018-11-19 10:21:53 -08:00
audit_broker.go The big one (#5346) 2018-09-17 23:03:00 -04:00
audit_test.go Remove namespace.TestContext and namespace.TestNamespace (#5682) 2018-11-05 11:11:32 -05:00
audited_headers.go Errwrap everywhere (#4252) 2018-04-05 11:49:21 -04:00
audited_headers_test.go Add context to the NewSalt function (#4102) 2018-03-08 11:21:11 -08:00
auth.go Revert deprecated plugin var names (#5822) 2018-11-19 15:23:48 -08:00
auth_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
barrier.go Spelling (#4119) 2018-03-20 14:54:10 -04:00
barrier_access.go Fix compile 2018-01-19 05:31:55 -05:00
barrier_aes_gcm.go Fix panic when storage value is nil (#5724) 2018-11-07 14:10:08 -08:00
barrier_aes_gcm_test.go Move logic around a bit to avoid holding locks when not necessary (#5277) 2018-09-05 11:49:32 -04:00
barrier_test.go Add context to storage backends and wire it through a lot of places (#3817) 2018-01-19 01:44:44 -05:00
barrier_view.go The big one (#5346) 2018-09-17 23:03:00 -04:00
barrier_view_test.go The big one (#5346) 2018-09-17 23:03:00 -04:00
barrier_view_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
capabilities.go Fix Capabilities check when in a child namespace (#5406) 2018-09-26 15:10:36 -07:00
capabilities_test.go The big one (#5346) 2018-09-17 23:03:00 -04:00
cluster.go The big one (#5346) 2018-09-17 23:03:00 -04:00
cluster_test.go use constant where x-vault-token was still hardcoded (#5392) 2018-09-25 09:34:40 -07:00
cluster_tls.go The big one (#5346) 2018-09-17 23:03:00 -04:00
core.go Default seal type to Shamir on older seal configs (#5956) 2018-12-13 16:44:56 -08:00
core_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
core_util.go Wrap storage calls with encoding checks (#5819) 2018-11-19 13:13:16 -08:00
cors.go Add support for token passed Authorization Bearer header (#5397) 2018-10-01 10:33:21 -07:00
dynamic_system_view.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
expiration.go Simplify base62.Random (#5982) 2018-12-20 07:40:01 -08:00
expiration_integ_test.go Don't call LeaseExtend on login renewal paths when period is provided (#3803) 2018-01-18 12:19:18 -05:00
expiration_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
expiration_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
generate_root.go Deprecate SHA1 in token store (#770) 2018-10-17 13:23:04 -07:00
generate_root_test.go Simplify base62.Random (#5982) 2018-12-20 07:40:01 -08:00
ha.go Batch tokens (#755) 2018-10-15 12:56:24 -04:00
identity_lookup.go The big one (#5346) 2018-09-17 23:03:00 -04:00
identity_lookup_test.go The big one (#5346) 2018-09-17 23:03:00 -04:00
identity_store.go Case insensitive identity names (#5404) 2018-10-19 12:47:26 -07:00
identity_store_aliases.go Test for issue 5729 (#5750) 2018-11-13 11:16:10 -05:00
identity_store_aliases_test.go Test for issue 5729 (#5750) 2018-11-13 11:16:10 -05:00
identity_store_entities.go Update group memberships when entity is deleted (#5786) 2018-11-15 20:07:45 -05:00
identity_store_entities_test.go Update group memberships when entity is deleted (#5786) 2018-11-15 20:07:45 -05:00
identity_store_group_aliases.go The big one (#5346) 2018-09-17 23:03:00 -04:00
identity_store_group_aliases_test.go Case insensitive identity names (#5404) 2018-10-19 12:47:26 -07:00
identity_store_groups.go Support operating on entities and groups by their names (#5355) 2018-09-25 12:28:28 -07:00
identity_store_groups_test.go Update group memberships when entity is deleted (#5786) 2018-11-15 20:07:45 -05:00
identity_store_schema.go Case insensitive identity names (#5404) 2018-10-19 12:47:26 -07:00
identity_store_structs.go Case insensitive identity names (#5404) 2018-10-19 12:47:26 -07:00
identity_store_test.go Remove namespace.TestContext and namespace.TestNamespace (#5682) 2018-11-05 11:11:32 -05:00
identity_store_upgrade.go Add locking when adding aliases to existing entities (#4965) 2018-07-24 22:01:58 -04:00
identity_store_util.go Update group memberships when entity is deleted (#5786) 2018-11-15 20:07:45 -05:00
init.go Seal migration (OSS) (#781) 2018-10-22 23:34:02 -07:00
init_test.go The big one (#5346) 2018-09-17 23:03:00 -04:00
keyring.go Errwrap everywhere (#4252) 2018-04-05 11:49:21 -04:00
keyring_test.go Spelling (#4119) 2018-03-20 14:54:10 -04:00
logical_cubbyhole.go Update sys path definitions for OpenAPI (#5687) 2018-11-06 10:09:06 -08:00
logical_cubbyhole_test.go Add context to storage backends and wire it through a lot of places (#3817) 2018-01-19 01:44:44 -05:00
logical_passthrough.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
logical_passthrough_test.go Add context to storage backends and wire it through a lot of places (#3817) 2018-01-19 01:44:44 -05:00
logical_system.go Add operationId field to OpenAPI output (#5876) 2018-12-12 13:59:23 -08:00
logical_system_helpers.go The big one (#5346) 2018-09-17 23:03:00 -04:00
logical_system_integ_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
logical_system_paths.go Add operationId field to OpenAPI output (#5876) 2018-12-12 13:59:23 -08:00
logical_system_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
mount.go Revert deprecated plugin var names (#5822) 2018-11-19 15:23:48 -08:00
mount_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
mount_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
namespaces.go The big one (#5346) 2018-09-17 23:03:00 -04:00
plugin_catalog.go Continue on plugin registration error in dev mode (#5791) 2018-11-15 16:55:24 -08:00
plugin_catalog_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
plugin_reload.go Fix plugin reload when in a namespace (#5937) 2018-12-11 17:21:23 -08:00
policy.go The big one (#5346) 2018-09-17 23:03:00 -04:00
policy_store.go The big one (#5346) 2018-09-17 23:03:00 -04:00
policy_store_test.go The big one (#5346) 2018-09-17 23:03:00 -04:00
policy_store_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
policy_test.go Add a comment to retain misspelling 2018-11-13 13:30:42 -05:00
policy_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
rekey.go Reset rekey progress once threshold has been met (#5743) 2018-11-19 17:03:07 -08:00
rekey_test.go Reset rekey progress once threshold has been met (#5743) 2018-11-19 17:03:07 -08:00
replication_cluster_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
request_forwarding.go Logger cleanup (#5480) 2018-10-09 09:43:17 -07:00
request_forwarding_rpc.go Logger cleanup (#5480) 2018-10-09 09:43:17 -07:00
request_forwarding_rpc_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
request_forwarding_service.pb.go Fix compilation/protobuf 2018-09-22 17:58:39 -04:00
request_forwarding_service.proto The big one (#5346) 2018-09-17 23:03:00 -04:00
request_forwarding_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
request_handling.go Move some handle request functions up a level (#5889) 2018-12-03 14:35:20 -05:00
request_handling_test.go The big one (#5346) 2018-09-17 23:03:00 -04:00
request_handling_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
rollback.go The big one (#5346) 2018-09-17 23:03:00 -04:00
rollback_test.go Remove namespace.TestContext and namespace.TestNamespace (#5682) 2018-11-05 11:11:32 -05:00
router.go Deprecate SHA1 in token store (#770) 2018-10-17 13:23:04 -07:00
router_access.go The big one (#5346) 2018-09-17 23:03:00 -04:00
router_test.go Run all builtins as plugins (#5536) 2018-11-06 17:21:24 -08:00
seal.go Clean up stored barrier keys after migration to shamir (#5671) 2018-11-05 14:06:39 -05:00
seal_access.go Send initialized information via sys/seal-status (#5424) 2018-09-27 14:03:37 -07:00
seal_autoseal.go Remove pt value from error output 2018-12-03 09:19:16 -05:00
seal_test.go Use atomic values in seal to avoid some data races (#4040) 2018-02-23 17:18:48 -05:00
seal_testing.go The big one (#5346) 2018-09-17 23:03:00 -04:00
seal_testing_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
sealunwrapper.go [Review Only] Autoseal OSS port (#757) 2018-10-19 14:43:57 -07:00
sealunwrapper_test.go Seal migration (OSS) (#781) 2018-10-22 23:34:02 -07:00
testing.go Fix plugin reload when in a namespace (#5937) 2018-12-11 17:21:23 -08:00
testing_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
token_store.go Simplify base62.Random (#5982) 2018-12-20 07:40:01 -08:00
token_store_test.go Add `default-service`/`default-batch` to token store roles (#5711) 2018-11-07 09:45:09 -05:00
token_store_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00
ui.go adds ability to override default CSP with warning (#395) 2018-04-03 09:34:14 -05:00
ui_test.go Fix compilation and tests failures (#4254) 2018-04-03 14:07:43 -04:00
util.go Removed unused methods 2017-01-03 12:51:35 -05:00
util_test.go Utility Enhancements 2016-04-05 20:32:59 -04:00
wrapping.go The big one (#5346) 2018-09-17 23:03:00 -04:00
wrapping_util.go The big one (#5346) 2018-09-17 23:03:00 -04:00