5d17f9b142
* Add ability to clean up host keys for dynamic keys This adds a new endpoint, tidy/dynamic-keys that removes any stale host keys still present on the mount. This does not clean up any pending dynamic key leases and will not remove these keys from systems with authorized hosts entries created by Vault. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add documentation Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add changelog entry Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> --------- Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
43 lines
1.2 KiB
Go
43 lines
1.2 KiB
Go
package ssh
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
const keysStoragePrefix = "keys/"
|
|
|
|
func pathCleanupKeys(b *backend) *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "tidy/dynamic-keys",
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
logical.DeleteOperation: b.handleCleanupKeys,
|
|
},
|
|
HelpSynopsis: `This endpoint removes the stored host keys used for the removed Dynamic Key feature, if present.`,
|
|
HelpDescription: `For more information, refer to the API documentation.`,
|
|
}
|
|
}
|
|
|
|
func (b *backend) handleCleanupKeys(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
|
names, err := req.Storage.List(ctx, keysStoragePrefix)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to list keys for removal: %w", err)
|
|
}
|
|
|
|
for index, name := range names {
|
|
keyPath := keysStoragePrefix + name
|
|
if err := req.Storage.Delete(ctx, keyPath); err != nil {
|
|
return nil, fmt.Errorf("unable to delete key %v of %v: %w", index+1, len(names), err)
|
|
}
|
|
}
|
|
|
|
return &logical.Response{
|
|
Data: map[string]interface{}{
|
|
"message": fmt.Sprintf("Removed %v of %v host keys.", len(names), len(names)),
|
|
},
|
|
}, nil
|
|
}
|