CHANGELOG-pre-v1.10.md
SECURITY:
BUG FIXES:
SECURITY:
CHANGES:
BUG FIXES:
SECURITY:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
leasId to leaseId in the "Copy Credentials" section of "Generate AWS Credentials" [GH-15685]CHANGES:
IMPROVEMENTS:
BUG FIXES:
username_as_alias is set
has been fixed. The previous behavior would make a request to the LDAP server to
get user_attr before discarding it and using the username instead. This would
make it impossible for a user to connect if this attribute was missing or had
multiple values, even though it would not be used anyway. This has been fixed
and the username is now used without making superfluous LDAP searches. [GH-15525]BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
use_microsoft_graph_api to use the Microsoft
Graph API by default. [GH-14130]IMPROVEMENTS:
allow_wildcard_certificates) [GH-14238]BUG FIXES:
alias_name_source [GH-13925]root_password_ttl of zero. [GH-14130]IMPROVEMENTS:
custom_metadata to be empty. [GH-13395]BUG FIXES:
form_post response mode. [GH-13492]contained_db, rather than just a string. [GH-13469]CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
aerospike-client-go to v5.6.0. [GH-12165]BUG FIXES:
nonce parameter optional for the Authorization Endpoint of OIDC providers. [GH-13231]CHANGES:
disable_iss_validation defaults to true. #127 [GH-12975]* to permit any extension to be specified by an end-user. [GH-12847]FEATURES:
/) and also on API endpoints (/v1/*) [GH-12485]read access to the metadata endpoint. [GH-12907]/<mount>/data/:path kv-v2
endpoint through HTTP PATCH. A new patch ACL capability has been added and
is required to make such requests. [GH-12687]local auth mounts will
generate identity entities for the tokens issued. The aliases of the entity
resulting from local auth mounts (local-aliases), will be scoped by the cluster.
This means that the local-aliases will never leave the geographical boundary of
the cluster where they were issued. This is something to be mindful about for
those who have implemented local auth mounts for complying with GDPR guidelines.SECURITY:
IMPROVEMENTS:
role/:name/secret-id-accessor/lookup endpoint now returns a 404 status code when the secret_id_accessor cannot be found [GH-12788]skip_browser CLI option to allow users to skip opening the default browser during the authentication flow. [GH-12876]allowed_policies_glob and disallowed_policies_glob fields to token roles to allow glob matching of policies [GH-7277]main.well-known/keys endpoint that are being used by roles to sign/verify tokens. [GH-12780]external-source: "vault" metadata value for Consul registration. [GH-12163]reference field to batch items, and propogate it to the responseDEPRECATIONS:
BUG FIXES:
unexpected fault address panic when using persistent cache. [GH-12534]form_post as the oidc_response_mode. [GH-12265]prem build.vault operator raft snapshot save. [GH-12388]addr_type=public_v6 in auto-join [GH-12366]BUG FIXES:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
IMPROVEMENTS:
allow_wildcard_certificates) [GH-14238]BUG FIXES:
IMPROVEMENTS:
BUG FIXES:
form_post response mode. [GH-13494]CHANGES:
CHANGES:
SECURITY:
BUG FIXES:
SECURITY:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
IMPROVEMENTS:
BUG FIXES:
unexpected fault address panic when using persistent cache. [GH-12534]vault operator raft snapshot save. [GH-12388]CHANGES:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
external-source: "vault" metadata value for Consul registration. [GH-12163]BUG FIXES:
form_post as the oidc_response_mode. [GH-12258]CHANGES:
exit_on_retry_failure, within the new top-level stanza, template_config, can
be set to true in order to cause agent to exit. Note that for agent to exit if
template.error_on_missing_key is set to true, exit_on_retry_failure must
be also set to true. Otherwise, the template engine will log an error but then
restart its internal runner. [GH-11775]FEATURES:
vault operator command to detect common issues with vault server setups.SECURITY:
IMPROVEMENTS:
api.Client through SetLogger. [GH-11696]prefix_filter to telemetry config [GH-12025]rotate-role endpoint to allow rotations of service accounts. [GH-11942]SocketTimeout, ConnectTimeout, and ServerSelectionTimeout [GH-11600]DEPRECATIONS:
/gcp/token/:roleset and /gcp/key/:roleset paths for generating
secrets for rolesets. Use /gcp/roleset/:roleset/token and /gcp/roleset/:roleset/key instead. [GH-12023]BUG FIXES:
v0.1.0 to
bring in a verification key caching fix. [GH-11784]vault list and vault kv list with output format other than table. [GH-12031]pem_bundle and pem_json didn't work for CA-only configurations [GH-11861]SetCredentials wasn't falling back to using RotateRootCredentials if SetCredentials is Unimplemented [GH-11585]SECURITY:
BUG FIXES:
IMPROVEMENTS:
BUG FIXES:
form_post response mode. [GH-13493]CHANGES:
BUG FIXES:
SECURITY:
BUG FIXES:
SECURITY:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
unexpected fault address panic when using persistent cache. [GH-12534]vault operator raft snapshot save. [GH-12388]SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
pem_bundle and pem_json didn't work for CA-only configurations [GH-11861]CHANGES:
IMPROVEMENTS:
BUG FIXES:
v0.1.0 to
bring in a verification key caching fix. [GH-11784]SECURITY:
CHANGES:
IMPROVEMENTS:
SocketTimeout, ConnectTimeout, and ServerSelectionTimeout [GH-11600]BUG FIXES:
SetCredentials wasn't falling back to using RotateRootCredentials if SetCredentials is Unimplemented [GH-11585]SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
CHANGES:
max_backoff parameter,
which defaults to 5 minutes. [GH-10964]/auth/aws/identity-whitelist has been
updated to/auth/aws/identity-accesslist). The old and new endpoints are aliases,
sharing the same underlying data. The legacy endpoint names are considered deprecated
and will be removed in a future release (not before Vault 1.9). The complete list of
endpoint changes is available in the AWS Auth API docs.FEATURES:
max_age role parameter and auth_time claim validation. [GH-10919]IMPROVEMENTS:
vault.retry stanza that allows specifying number of retries on failure; this applies both to templating and proxied requests. [GH-11113]secret_id_ttl as part of its response. [GH-10826]trace) as a periodic output. [GH-10609]BUG FIXES:
bound_claims validation for provider-specific group and user info fetching. [GH-10546]jwks_url change. [GH-10919]jwt_supported_algs were not being validated for JWT auth using
jwks_url and jwt_validation_pubkeys. [GH-10919]name [GH-10] [GH-10952]purgeInterval and
staleAge are set appropriately. [GH-10536]private_key field when reading database plugin config [GH-10416]azure_blob_environment, which should have had as a default AZUREPUBLICCLOUD.stores parameter on the legacy pathDEPRECATIONS:
BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
BUG FIXES:
SetCredentials wasn't falling back to using RotateRootCredentials if SetCredentials is Unimplemented [GH-11585]SECURITY:
CHANGES:
IMPROVEMENTS:
trace) as a periodic output. [GH-10609]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
azure_blob_environment, which should have had as a default AZUREPUBLICCLOUD.SECURITY:
IMPROVEMENTS:
BUG FIXES:
bound_claims validation for provider-specific group and user info fetching. [GH-10546]purgeInterval and
staleAge are set appropriately. [GH-10536]private_key field when reading database plugin config [GH-10416]stores parameter on the legacy pathNOTE:
Binaries for 32-bit macOS (i.e. the darwin_386 build) will no longer be published. This target was dropped in the latest version of the Go compiler.
CHANGES:
error_on_missing_key in the template config will cause agent to immediately exit on failure. In order to make agent properly exit due to continuous failure from template rendering errors, the old behavior of indefinitely restarting the template server is now changed to exit once the default retry attempt of 12 times (with exponential backoff) gets exhausted. [GH-9670]FEATURES:
IMPROVEMENTS:
approle.metadata.role_name property [GH-9529]BoundIamPrincipalARNs and include role name on error messages on check failure [GH-10036]disable_mlock. [GH-9931]rotate-root now supports POST requests like other secret engines [GH-70]BUG FIXES:
vault operator raft snapshot [GH-9894]SECURITY:
CHANGES:
BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
IMPROVEMENTS:
BUG FIXES:
password_policy setting was not using correct key when ad/config was read [GH-71]SECURITY:
IMPROVEMENTS:
BUG FIXES:
disable_fast_negotiation not being set on the auth method when configured by user. [GH-9892]NOTE:
All security content from 1.5.2, 1.5.1, 1.4.5, 1.4.4, 1.3.9, 1.3.8, 1.2.6, and 1.2.5 has been made fully open source, and the git tags for 1.5.3, 1.4.6, 1.3.10, and 1.2.7 will build correctly for open source users.
BUG FIXES:
NOTE:
Includes correct license in the HSM binary.
NOTE:
OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the Vault UI. Enterprise binaries are not affected.
KNOWN ISSUES:
SECURITY:
KNOWN ISSUES:
CHANGES:
tidy_revoked_certs is set to true. This will result in certificate entries being immediately removed, as opposed to awaiting until its NotAfter time. Note that this only affects certificates that have been already revoked. [GH-9609]IMPROVEMENTS:
allowed_domains_template parameter that enables the use of identity templating within the allowed_domains parameter. [GH-8509]BUG FIXES:
idle state.CHANGES:
credentials_file config option has been removed. The GOOGLE_APPLICATION_CREDENTIALS environment variable
or default credentials may be used instead [GH-9424]max_entry_size config that will limit
the total size in bytes of any entry committed via raft. It defaults to "1048576" (1MiB). [GH-9027]id will no longer allow periods (.) as part of the input string.
The final generated token value may contain periods, such as the s. prefix for service token
indication. [GH-8646]token_policies , identity policies within identity_policies, and the full policy set within policies. [GH-8535]FEATURES:
IMPROVEMENTS:
iss validation [GH-91]vault operator raft join command. [GH-9060]vault monitor, for tailing server logs in the console. [GH-8477]Sys.ReloadPlugin, and CLI command, vault plugin reload, for reloading plugins. [GH-8777]key_version in their responses [GH-9100]BUG FIXES:
token_scopes of a roleset. [GH-90]make static-dist. [GH-9277]BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
NOTE:
All security content from 1.5.2, 1.5.1, 1.4.5, 1.4.4, 1.3.9, 1.3.8, 1.2.6, and 1.2.5 has been made fully open source, and the git tags for 1.5.3, 1.4.6, 1.3.10, and 1.2.7 will build correctly for open source users.
BUG FIXES:
NOTE:
Includes correct license in the HSM binary.
NOTE:
OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the Vault UI. Enterprise binaries are not affected.
KNOWN ISSUES:
SECURITY:
KNOWN ISSUES:
BUG FIXES:
IMPROVEMENTS:
IMPROVEMENTS:
BUG FIXES:
token_scopes of a roleset. [GH-9277]SECURITY:
IMPROVEMENTS:
leader_ca_cert_file, leader_client_cert_file, and
leader_client_key_file parameters to read and parse TLS certificate information from paths on disk.
Existing non-path based parameters will continue to work, but their values will need to be provided as a
single-line string with newlines delimited by \n. [GH-8894]vault status CLI command and the sys/leader API now contain the committed and applied
raft indexes. [GH-9011]BUG FIXES:
sys/internal/ui/mounts/:path is now namespace-aware. This fixes an issue
with vault kv subcommands that had namespaces provided in the path returning permission denied all the time.
[GH-8962]CHANGES:
account_id and auth_type [GH-8783]ha_storage to be specified if raft is set as the storage type. [GH-8707]IMPROVEMENTS:
vault.identity.num_entities metric [GH-8816]delete-version-after to be reset to 0 via the CLI [GH-8635]BUG FIXES:
token_bound_cidrs being ignored due to incorrect key provided [GH-8826]vault debug with the config target is ran during this time.
[GH-8755]vault login to ensure permissions and ownership are set correctly [GH-8867]respondError calls [GH-8796]key_info when a scoping namespace is also provided.disable_clustering was set to true on Raft storage cluster [GH-8784]CHANGES:
FEATURES:
service_registration configuration stanza, that allows for service registration to be configured separately from the storage backend. For more, see #7887.IMPROVEMENTS:
form_post response mode [GH-98]metrics_prefix [GH-8340]client_id for identity tokens [GH-8165]last_performance_wal, last_dr_wal,
and connection_state valuesreplication/dr/secondary/recover
APIBUG FIXES:
default_role to match the role case convention [GH-100]yarn run test:oss [GH-8035]NOTE:
All security content from 1.5.2, 1.5.1, 1.4.5, 1.4.4, 1.3.9, 1.3.8, 1.2.6, and 1.2.5 has been made fully open source, and the git tags for 1.5.3, 1.4.6, 1.3.10, and 1.2.7 will build correctly for open source users.
BUG FIXES:
NOTE:
Includes correct license in the HSM binary.
NOTE:
OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the Vault UI. Enterprise binaries are not affected.
KNOWN ISSUES:
SECURITY:
KNOWN ISSUES:
BUG FIXES:
SECURITY:
BUG FIXES:
CHANGES:
account_id and auth_type [GH-8783]IMPROVEMENTS:
SECURITY:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
.box-radio height to min-height to prevent overflow issues [GH-8065]IMPROVEMENTS:
exit-after-auth via the CLI [GH-7920]request_timeout configuration option to prevent connection
requests from hanging [GH-7909]request_timeout configuration option to prevent connection
requests from hanging [GH-59]connection_url from enviornment
variable VAULT_PG_CONNECTION_URL [GH-7937]enable_hostname_label option to telemetry stanza [GH-7902]BUG FIXES:
exit_after_auth [GH-7899]sts_endpoint by adding
a sts_region parameter [GH-7922]generate-public-key endpoint to list of allowed endpoints
for existing DR secondariesoperator migrate operations [GH-7966]CHANGES:
cluster_cipher_suites
config flag to tls12.FEATURES:
debug, is added that allows
operators to retrieve debugging information related to a particular Vault
node. Operators can use this simple workflow to capture triaging information,
which can then be consumed programmatically or by support and engineering teams.
It has the abilitity to probe for config, host, metrics, pprof, server status,
and replication status.sys/raw API calls to perform surgical corrections to the data
store. Bad storage state can be caused by bugs. However, this is usually
observed when known (and fixed) bugs are hit by older versions of Vault.auth/token/renew-accessor endpoint if the caller's token has
permission to access that endpoint.IMPROVEMENTS:
skip_flush
parameter indicating all the changes should not be flushed while the tree is
locked.sys/host-info endpoint for querying information about
the host [GH-7330]sys/pprof/ that allows profiling
information to be extracted [GH-7473]sys/seal-status now has a storage_type field denoting what type of
storage
the cluster is configured to usesys/internal/counters/tokens endpoint, that counts the
total number of active service token accessors in the shared token storage.
[GH-7541]sys/config/state/sanitized that
returns the configuration state of the server. It excludes config values
from storage, ha_storage, and seal stanzas and some values
from telemetry due to potential sensitive entries in those fields.BUG FIXES:
vault login [GH-7508]namespace list command with JSON formatting
always returned an empty object [GH-7705]VAULT_CLIENT_TIMEOUT value. [GH-7469]standbyok and
perfstandbyok rather than simply using their presence as a key to flip on
that behavior [GH-7323]wrapped_token query param will work with redirect_to and
will automatically log in as intended [GH-7398]delete_version_after is configured [GH-7685]NOTE:
All security content from 1.5.2, 1.5.1, 1.4.5, 1.4.4, 1.3.9, 1.3.8, 1.2.6, and 1.2.5 has been made fully open source, and the git tags for 1.5.3, 1.4.6, 1.3.10, and 1.2.7 will build correctly for open source users.
BUG FIXES:
NOTE:
Includes correct license in the HSM binary.
NOTE:
OSS binaries of 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the Vault UI. Enterprise binaries are not affected.
KNOWN ISSUES:
SECURITY:
KNOWN ISSUES:
BUG FIXES:
SECURITY:
CHANGES:
sts_endpoint is configured, Vault Agent and the CLI
should provide the corresponding region via the region parameter (which
already existed as a CLI parameter, and has now been added to Agent). The
automatic region detection added to the CLI and Agent in 1.2 has been removed.IMPROVEMENTS:
BUG FIXES:
VAULT_CLIENT_TIMEOUT value. [GH-7469]response_types_supported to identity token
.well-known/openid-configuration response [GH-7533]FEATURES:
IMPROVEMENTS:
BUG FIXES:
leader_ca_cert in the join request [GH-7393]CHANGES:
IMPROVEMENTS:
BUG FIXES:
token_type string was not being
correctly handled as TokenTypeDefault [GH-7273]BUG FIXES:
aws and
alicloud auth methods [GH-7238]CHANGES:
period, explicit_max_ttl, and
bound_cidrs will continue to work, with priority being given to the
token_ prefixed versions of those parameters. They will also be returned
when doing a read on the role if they were used to provide values initially;
however, in Vault 1.4 if period or explicit_max_ttl is zero they will no
longer be returned. (explicit_max_ttl was already not returned if empty.)\r becomes %0D, \x00 becomes
%00, and so on).sdk/ submodule. A
couple of functions have also moved from plugin helper code to the api/
submodule. If you are a plugin author, take a look at some of our official
plugins and the paths they are importing for guidance.period and policies will continue to work,
with priority being given to the token_ prefixed versions of those
parameters. They will also be returned when doing a read on the role if they
were used to provide values initially."default" is no longer automatically added to the policies
parameter. This was a no-op since it would always be added anyways by
Vault's core; however, this can now be explicitly disabled with the new
token_no_default_policy field.bound_cidr_list is no longer returned when reading a rolemax_open_connections
rather than 2.FEATURES:
api.IMPROVEMENTS:
namespace parameter, which sets the default namespace
for the auto-auth functionality [GH-6988]DeleteWithData
[GH-7139]verbose_oidc_logging role parameter has been added to help
troubleshoot OIDC configuration [GH-57]bound_claims will now match received claims that are lists if any element
of the list is one of the expected values [GH-50]nbf and exp are now configurable, as is clock skew
leeway [GH-53]path-help now allows -format=json to be specified, which will
output OpenAPI [GH-7006]vault delete operations
[GH-7139]vault servercommand. [GH-6840]-dev-no-store-token to allow dev servers to not store the
generated token at the tokenhelper location [GH-7104]max_open_connections for DB plugins to 4
[GH-7093]delete_version_after parameter, which takes a
duration and can be set on the mount and/or the metadata for a specific key
[GH-7005]path parameter allows selecting the path within a bucket
for Vault data [GH-7157]BUG FIXES:
NOTE:
Although 1.1.4 was tagged, we realized very soon after the tag was publicly pushed that an intended fix was accidentally left out. As a result, 1.1.4 was not officially announced and 1.1.5 should be used as the release after 1.1.3.
IMPROVEMENTS:
BUG FIXES:
use_pre111_group_cn_behavior flag to allow recovering from
a regression caused by a bug fix starting in 1.1.1 [GH-7208]IMPROVEMENTS:
BUG FIXES:
x-vault-unauthenticated value in OpenAPI for a number of
endpoints [GH-6654]root instead of root/ as the
namespace header valuehttps:// address even if schema not specified
[GH-6602]This is a bug fix release containing the two items below. It is otherwise unchanged from 1.1.1.
BUG FIXES:
SECURITY:
CHANGES:
/login path [GH-38]+. +* is now illegal in
policy paths. The previous behavior simply selected any matching
segment-wildcard path that matched. [GH-6532]IMPROVEMENTS:
BUG FIXES:
oidc_scopes parameter was not being included in
the response to a role read request [GH-35]uri_sans param in when not using CSR parameters [GH-6505]/+/ segments) [GH-6525]CHANGES:
groups_claim_delimiter_pattern field has been removed. If the
groups claim is not at the top level, it can now be specified as a
JSONPointer.FEATURES:
vault login command.+ character to enable
wild card matching for a single directory in the path definition.IMPROVEMENTS:
auth enable command.BUG FIXES:
bound_claims validation across all login pathsbound_audiences validation during non-OIDC logins to accept
any matched audience, as documented and handled in OIDC logins [GH-30]operator migrate command will no longer hang on empty key names
[GH-6371]batch_input parameter [GH-5875]sys/internal/ui/mounts will no longer return secret or auth mounts
that have been filtered. Similarly, sys/internal/ui/mount/:path will
return a error response if a filtered mount path is requested. [GH-6412]SECURITY:
CHANGES:
FEATURES:
-output-curl-string
flag to print out an equivalent cURL command.IMPROVEMENTS:
BUG FIXES:
Get method will now return an Entry object with
the Key member correctly populated with the full path that was requested
instead of just the last path element [GH-6044]SECURITY:
bound_cidrs, the list of
CIDRs would not be propagated to the child token, allowing the child token
to be used from any address.CHANGES:
credential_type instead of credential_types
to match role input. If a legacy role that can supply more than one
credential type, they will be concatenated with a ,.X-Vault-Namespace will perform the request on the root namespace. This is
equivalent to providing an empty value. Creating a namespace called "root" in
the root namespace is disallowed.FEATURES:
IMPROVEMENTS:
BUG FIXES:
LIST HTTP verb
(necessary to get the right method into the wrapping lookup function) and
not then modifying it to a GET; although this is officially the verb Vault
uses for listing and it's fully legal to use custom verbs, since many WAFs
and API gateways choke on anything outside of RFC-standardized verbs we fall
back to GET [GH-6026]-delete-backup when it
should show -backup-delete [GH-5981]credential_type match the output type (string, not
array) [GH-5972]SECURITY:
"", that statement would be executed
verbatim, resulting in a lack of actual revocation but success for the
operation. Vault will now strip empty statements from any provided; as a
result if an empty statement is provided, it will behave as if no statement
is provided, falling back to the default revocation statement.CHANGES:
IMPROVEMENTS:
BUG FIXES:
fullscreen
command - [GH-5909]SECURITY:
CHANGES:
s. and batch tokens start with b..
Existing tokens will still work (they are all of service type and will be
considered as such). Prefixing allows us to be more efficient when consuming
a token, which keeps the critical path of requests faster.auth/token that allow specifying a token or accessor in the
URL have been removed. These have been deprecated since March 2016 and
undocumented, but were retained for backwards compatibility. They shouldn't
be used due to the possibility of those paths being logged, so at this point
they are simply being removed.options map on backends will now upsert any provided
values, and keep any of the existing values in place if not provided. The
options map itself cannot be unset once it's set, but the keypairs within the
map can be unset if an empty value is provided, with the exception of the
version keypair which is handled differently for KVv2 purposes.regenerate_key instead of generate_key.type field when configuring plugins, this can be "auth",
"database", or "secret".FEATURES:
IMPROVEMENTS:
BUG FIXES:
-policy-override flag [GH-5826]kv put while accepting empty paths
for all other operations for backwards compatibility
[GH-19]sys/leases/revoke required 'sudo' capability to show
the revoke button in the UI [GH-5647]