[Backport release/3.4.x] fix(vault): fix several issues in vault and refactor the vault code base #11521
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ase (#11402) ### Summary - Make DAOs to fallback to empty string when resolving Vault references fail - Use node level mutex when rotation references - Refresh references on config changes - Update plugin referenced values only once per request - Pass only the valid config options to vault implementations - Resolve multi-value secrets only once when rotating them - Do not start vault secrets rotation timer on control planes - Re-enable negative caching - Reimplement the kong.vault.try function - Remove references from rotation in case their configuration has changed #### Commits before squashing them (it turned out difficult to split last refactoring commit) - tests(vault): should be able to detect new references when plugin config changes - fix(schema): process auto fields to default to empty string on resolve failures - fix(schema): use pairs to adjust_field_for_context with arrays and sets - perf(plugin-iterator): vault.update only once per request on global iterator - docs(vault): mark local functions with local-attribute - fix(vault): use node level mutex instead of a thread level semaphore - fix(vault): add validation back as the yielding is fixed - refactor(vault): move parse_reference close to is_reference - fix(vault): refresh secrets on flush in timer - refactor(vault): refactor the vault local update function - chore(vault): add cooperative yielding on secret rotation - fix(vault): no event handlers or rotation timer on control planes - refactor(vault): cache key generation and parsing - chore(vault): rename get_subfield to extract_key_from_json_string - chore(vault): rename flush_and_refresh to handle_vault_crud_event - refactor(vault): refactor vault code base Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit fd64029)
|
@bungle Why is this going onto |
github-actions
bot
added
the
author/community
hanshuebner
approved these changes
Sep 20, 2023
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport fd64029 from #11402.