-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
plugins: Handle mount/enable for shadowed builtins #17879
Conversation
6b18d0a
to
fc7419d
Compare
5d67bae
to
a92ff97
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not a full review, just spotted one thing though that looked odd to me
a43dc69
to
3dea37d
Compare
76c0fa2
to
c1346b1
Compare
7c4064a
to
cb4460a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One of my comments poses some questions and isn't really actionable feedback. I need to do a bit of hacking around/research, or happy to pair on that bit whenever you're available.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't know enough about plugins to be able to leave a review that's worth much.
73da5df
to
d5a5e45
Compare
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 1 Ignored Deployment
|
575ce08
to
cd76ff2
Compare
* Allow mounting external plugins with same name/type as deprecated builtins * Add some go tests for deprecation status handling * Move timestamp storage to post-unseal * Add upgrade-aware deprecation shutdown and tests
* Allow mounting external plugins with same name/type as deprecated builtins * Add some go tests for deprecation status handling * Move timestamp storage to post-unseal * Add upgrade-aware deprecation shutdown and tests
* Allow mounting external plugins with same name/type as deprecated builtins * Add some go tests for deprecation status handling * Move timestamp storage to post-unseal * Add upgrade-aware deprecation shutdown and tests
This PR adds some handling for shadowed builtins (external plugins with the same name/type as a builtin plugin). Also includes some test improvements and a more official coreConfig for the
PendingRemoval
environment variable.In an effort to address concerns around post-upgrade unseals, this PR also introduces a more forgiving deprecation handling framework. In the event that Vault is unsealing for the first time (or has never successfully unsealed in the past), we shutdown to prevent drift from the pre-upgrade state. If Vault has already been unsealed with the deprecated entry, we continue to mount the data, but skip the backend initialization. This allows the data to be preserved and gives the operator a chance to remediate any issues on the newer version of Vault.
This resolves VAULT-9372 and VAULT-11863.