github
/
consul
mirror of https://github.com/hashicorp/consul
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #12793 from hashicorp/jm/vault-ns-auth 

Set vault namespaces on vault client prior to logging in
pull/11588/merge
Mark Anderson 2022-04-14 18:11:30 -07:00 committed by GitHub
parent 319a0a08cd 8ad9bf8a7a
commit 25ef2eaa7f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changelog/12793.txt Normal file
View File

@ -0,0 +1,5 @@
```release-note:bug
The Connect CA Vault system now sets the Namespace (if present) prior
to attempting to login to Vault. This means the AuthMethod needs to
be in the specified namespace. Previously the AuthMethod needed to be
in the root namespace to work.

15
agent/connect/ca/provider_vault.go
View File

@ -103,6 +103,14 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
return err return err
} }
// We don't want to set the namespace if it's empty to prevent potential
// unknown behavior (what does Vault do with an empty namespace). The Vault
// client also makes sure the inputs are not empty strings so let's do the
// same.
if config.Namespace != "" {
client.SetNamespace(config.Namespace)
}
if config.AuthMethod != nil { if config.AuthMethod != nil {
loginResp, err := vaultLogin(client, config.AuthMethod) loginResp, err := vaultLogin(client, config.AuthMethod)
if err != nil { if err != nil {
@ -112,13 +120,6 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
} }
client.SetToken(config.Token) client.SetToken(config.Token)
// We don't want to set the namespace if it's empty to prevent potential
// unknown behavior (what does Vault do with an empty namespace). The Vault
// client also makes sure the inputs are not empty strings so let's do the
// same.
if config.Namespace != "" {
client.SetNamespace(config.Namespace)
}
v.config = config v.config = config
v.client = client v.client = client
v.isPrimary = cfg.IsPrimary v.isPrimary = cfg.IsPrimary