22c4ae5933
* See what it looks like to replace "master key" with "root key". There are two places that would require more challenging code changes: the storage path `core/master`, and its contents (the JSON-serialized EncodedKeyringtructure.) * Restore accidentally deleted line * Add changelog * Update root->recovery * Fix test Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
51 lines
1.3 KiB
Go
51 lines
1.3 KiB
Go
package vault
|
|
|
|
import (
|
|
"github.com/hashicorp/go-hclog"
|
|
wrapping "github.com/hashicorp/go-kms-wrapping"
|
|
aeadwrapper "github.com/hashicorp/go-kms-wrapping/wrappers/aead"
|
|
"github.com/hashicorp/vault/sdk/helper/logging"
|
|
"github.com/hashicorp/vault/vault/seal"
|
|
testing "github.com/mitchellh/go-testing-interface"
|
|
)
|
|
|
|
func NewTestSeal(t testing.T, opts *seal.TestSealOpts) Seal {
|
|
t.Helper()
|
|
if opts == nil {
|
|
opts = &seal.TestSealOpts{}
|
|
}
|
|
if opts.Logger == nil {
|
|
opts.Logger = logging.NewVaultLogger(hclog.Debug)
|
|
}
|
|
|
|
switch opts.StoredKeys {
|
|
case seal.StoredKeysSupportedShamirRoot:
|
|
newSeal := NewDefaultSeal(&seal.Access{
|
|
Wrapper: aeadwrapper.NewShamirWrapper(&wrapping.WrapperOptions{
|
|
Logger: opts.Logger,
|
|
}),
|
|
})
|
|
// Need StoredShares set or this will look like a legacy shamir seal.
|
|
newSeal.SetCachedBarrierConfig(&SealConfig{
|
|
StoredShares: 1,
|
|
SecretThreshold: 1,
|
|
SecretShares: 1,
|
|
})
|
|
return newSeal
|
|
case seal.StoredKeysNotSupported:
|
|
newSeal := NewDefaultSeal(&seal.Access{
|
|
Wrapper: aeadwrapper.NewShamirWrapper(&wrapping.WrapperOptions{
|
|
Logger: opts.Logger,
|
|
}),
|
|
})
|
|
newSeal.SetCachedBarrierConfig(&SealConfig{
|
|
StoredShares: 0,
|
|
SecretThreshold: 1,
|
|
SecretShares: 1,
|
|
})
|
|
return newSeal
|
|
default:
|
|
return NewAutoSeal(seal.NewTestSeal(opts))
|
|
}
|
|
}
|