cd86226845
In some situations, it can be impossible to revoke leases (for instance, if someone has gone and manually removed users created by Vault). This can not only cause Vault to cycle trying to revoke them, but it also prevents mounts from being unmounted, leaving them in a tainted state where the only operations allowed are to revoke (or rollback), which will never successfully complete. This adds a new endpoint that works similarly to `revoke-prefix` but ignores errors coming from a backend upon revocation (it does not ignore errors coming from within the expiration manager, such as errors accessing the data store). This can be used to force Vault to abandon leases. Like `revoke-prefix`, this is a very sensitive operation and requires `sudo`. It is implemented as a separate endpoint, rather than an argument to `revoke-prefix`, to ensure that control can be delegated appropriately, as even most administrators should not normally have this privilege. Fixes #1135
46 lines
953 B
Go
46 lines
953 B
Go
package api
|
|
|
|
func (c *Sys) Renew(id string, increment int) (*Secret, error) {
|
|
r := c.c.NewRequest("PUT", "/v1/sys/renew/"+id)
|
|
|
|
body := map[string]interface{}{"increment": increment}
|
|
if err := r.SetJSONBody(body); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
resp, err := c.c.RawRequest(r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
return ParseSecret(resp.Body)
|
|
}
|
|
|
|
func (c *Sys) Revoke(id string) error {
|
|
r := c.c.NewRequest("PUT", "/v1/sys/revoke/"+id)
|
|
resp, err := c.c.RawRequest(r)
|
|
if err == nil {
|
|
defer resp.Body.Close()
|
|
}
|
|
return err
|
|
}
|
|
|
|
func (c *Sys) RevokePrefix(id string) error {
|
|
r := c.c.NewRequest("PUT", "/v1/sys/revoke-prefix/"+id)
|
|
resp, err := c.c.RawRequest(r)
|
|
if err == nil {
|
|
defer resp.Body.Close()
|
|
}
|
|
return err
|
|
}
|
|
|
|
func (c *Sys) RevokeForce(id string) error {
|
|
r := c.c.NewRequest("PUT", "/v1/sys/revoke-force/"+id)
|
|
resp, err := c.c.RawRequest(r)
|
|
if err == nil {
|
|
defer resp.Body.Close()
|
|
}
|
|
return err
|
|
}
|