secrets/pki: Maintaining running count of certificates will be turned off by default.
To re-enable keeping these metrics available on the tidy status endpoint, enable
maintain_stored_certificate_counts on tidy-config, to also publish them to the
metrics consumer, enable publish_stored_certificate_count_metrics . [GH-18186]
CHANGES:
auth/alicloud: Updated plugin from v0.14.0 to v0.15.0 [GH-20758]
auth/azure: Updated plugin from v0.13.0 to v0.15.0 [GH-20816]
auth/centrify: Updated plugin from v0.14.0 to v0.15.1 [GH-20745]
auth/gcp: Updated plugin from v0.15.0 to v0.16.0 [GH-20725]
auth/jwt: Updated plugin from v0.15.0 to v0.16.0 [GH-20799]
auth/kubernetes: Update plugin to v0.16.0 [GH-20802]
core: Bump Go version to 1.20.5.
core: Remove feature toggle for SSCTs, i.e. the env var VAULT_DISABLE_SERVER_SIDE_CONSISTENT_TOKENS. [GH-20834]
core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [GH-20826]
database/couchbase: Updated plugin from v0.9.0 to v0.9.2 [GH-20764]
database/redis-elasticache: Updated plugin from v0.2.0 to v0.2.1 [GH-20751]
replication (enterprise): Add a new parameter for the update-primary API call
that allows for setting of the primary cluster addresses directly, instead of
via a token.
secrets/ad: Updated plugin from v0.10.1-0.20230329210417-0b2cdb26cf5d to v0.16.0 [GH-20750]
secrets/alicloud: Updated plugin from v0.5.4-beta1.0.20230330124709-3fcfc5914a22 to v0.15.0 [GH-20787]
secrets/aure: Updated plugin from v0.15.0 to v0.16.0 [GH-20777]
secrets/database/mongodbatlas: Updated plugin from v0.9.0 to v0.10.0 [GH-20882]
secrets/database/snowflake: Updated plugin from v0.7.0 to v0.8.0 [GH-20807]
secrets/gcp: Updated plugin from v0.15.0 to v0.16.0 [GH-20818]
secrets/keymgmt: Updated plugin to v0.9.1
secrets/kubernetes: Update plugin to v0.5.0 [GH-20802]
secrets/mongodbatlas: Updated plugin from v0.9.1 to v0.10.0 [GH-20742]
secrets/pki: Allow issuance of root CAs without AIA, when templated AIA information includes issuer_id. [GH-21209]
secrets/pki: Warning when issuing leafs from CSRs with basic constraints. In the future, issuance of non-CA leaf certs from CSRs with asserted IsCA Basic Constraints will be prohibited. [GH-20654]
FEATURES:
AWS Static Roles: The AWS Secrets Engine can manage static roles configured by users. [GH-20536]
Automated License Utilization Reporting: Added automated license
utilization reporting, which sends minimal product-license metering
data
to HashiCorp without requiring you to manually collect and report them.
Environment Variables through Vault Agent: Introducing a new process-supervisor mode for Vault Agent which allows injecting secrets as environment variables into a child process using a new env_template configuration stanza. The process-supervisor configuration can be generated with a new vault agent generate-config helper tool. [GH-20530]
MongoDB Atlas Database Secrets: Adds support for client certificate credentials [GH-20425]
MongoDB Atlas Database Secrets: Adds support for generating X.509 certificates on dynamic roles for user authentication [GH-20882]
NEW PKI Workflow in UI: Completes generally available rollout of new PKI UI that provides smoother mount configuration and a more guided user experience [GH-pki-ui-improvements]
ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [HSEC-2023-17]
BREAKING CHANGES:
secrets/pki: Maintaining running count of certificates will be turned off by default.
To re-enable keeping these metrics available on the tidy status endpoint, enable
maintain_stored_certificate_counts on tidy-config, to also publish them to the
metrics consumer, enable publish_stored_certificate_count_metrics . [GH-18186]
CHANGES:
auth/alicloud: Updated plugin from v0.14.0 to v0.15.0 [GH-20758]
auth/azure: Updated plugin from v0.13.0 to v0.15.0 [GH-20816]
auth/centrify: Updated plugin from v0.14.0 to v0.15.1 [GH-20745]
auth/gcp: Updated plugin from v0.15.0 to v0.16.0 [GH-20725]
auth/jwt: Updated plugin from v0.15.0 to v0.16.0 [GH-20799]
auth/kubernetes: Update plugin to v0.16.0 [GH-20802]
core: Bump Go version to 1.20.5.
core: Remove feature toggle for SSCTs, i.e. the env var VAULT_DISABLE_SERVER_SIDE_CONSISTENT_TOKENS. [GH-20834]
core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [GH-20826]
database/couchbase: Updated plugin from v0.9.0 to v0.9.2 [GH-20764]
database/redis-elasticache: Updated plugin from v0.2.0 to v0.2.1 [GH-20751]
replication (enterprise): Add a new parameter for the update-primary API call
that allows for setting of the primary cluster addresses directly, instead of
via a token.
secrets/ad: Updated plugin from v0.10.1-0.20230329210417-0b2cdb26cf5d to v0.16.0 [GH-20750]
secrets/alicloud: Updated plugin from v0.5.4-beta1.0.20230330124709-3fcfc5914a22 to v0.15.0 [GH-20787]
secrets/aure: Updated plugin from v0.15.0 to v0.16.0 [GH-20777]
secrets/database/mongodbatlas: Updated plugin from v0.9.0 to v0.10.0 [GH-20882]
secrets/database/snowflake: Updated plugin from v0.7.0 to v0.8.0 [GH-20807]
secrets/gcp: Updated plugin from v0.15.0 to v0.16.0 [GH-20818]
secrets/keymgmt: Updated plugin to v0.9.1
secrets/kubernetes: Update plugin to v0.5.0 [GH-20802]
secrets/mongodbatlas: Updated plugin from v0.9.1 to v0.10.0 [GH-20742]
secrets/pki: Allow issuance of root CAs without AIA, when templated AIA information includes issuer_id. [GH-21209]
secrets/pki: Warning when issuing leafs from CSRs with basic constraints. In the future, issuance of non-CA leaf certs from CSRs with asserted IsCA Basic Constraints will be prohibited. [GH-20654]
FEATURES:
AWS Static Roles: The AWS Secrets Engine can manage static roles configured by users. [GH-20536]
Automated License Utilization Reporting: Added automated license
utilization reporting, which sends minimal product-license metering
data
to HashiCorp without requiring you to manually collect and report them.
Environment Variables through Vault Agent: Introducing a new process-supervisor mode for Vault Agent which allows injecting secrets as environment variables into a child process using a new env_template configuration stanza. The process-supervisor configuration can be generated with a new vault agent generate-config helper tool. [GH-20530]
... (truncated)
Commits
13a649f backport of commit f12c1285599a1519273bfa68472c598b1fd635bf (#21348)
dd62be3 backport of commit 3908ec9dc44352548e08f4c86f9ad76c255ce493 (#21331)
0fc55a2 backport of commit d76424cb53c730da5410ec55bff3274a01212843 (#21328)
7733b6a backport of commit 3347e5d56b363e58e7be556cfd0875a210c2a2ec (#21326)
1990a8c backport of commit 30aac443d0037852b0a5e4b50d59a9bedc5e4445 (#21324)
15631d2 backport of commit a1fdf105b3cc2e88483f3fca27729fa06bfbfa7f (#21312)
a14ff6e backport of commit 41f392c43ff4c9077deb1d1640349b8ba867d139 (#21307)
0610df0 backport of commit 042dd57811c900c9f6e2c85b5460d50560f79105 (#21295)
2fd24b1 backport of commit 8cc7be234ac34ff0f703ab092a7314ba9e65b277 (#21293)
9e85fef backport of commit c5549cdac681676ae52ea173d737ee1c5d1949a2 (#21272)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps github.com/hashicorp/vault/api from 1.10.0 to 1.14.0.
Release notes
Sourced from github.com/hashicorp/vault/api's releases.
... (truncated)
Changelog
Sourced from github.com/hashicorp/vault/api's changelog.
... (truncated)
Commits
13a649fbackport of commit f12c1285599a1519273bfa68472c598b1fd635bf (#21348)dd62be3backport of commit 3908ec9dc44352548e08f4c86f9ad76c255ce493 (#21331)0fc55a2backport of commit d76424cb53c730da5410ec55bff3274a01212843 (#21328)7733b6abackport of commit 3347e5d56b363e58e7be556cfd0875a210c2a2ec (#21326)1990a8cbackport of commit 30aac443d0037852b0a5e4b50d59a9bedc5e4445 (#21324)15631d2backport of commit a1fdf105b3cc2e88483f3fca27729fa06bfbfa7f (#21312)a14ff6ebackport of commit 41f392c43ff4c9077deb1d1640349b8ba867d139 (#21307)0610df0backport of commit 042dd57811c900c9f6e2c85b5460d50560f79105 (#21295)2fd24b1backport of commit 8cc7be234ac34ff0f703ab092a7314ba9e65b277 (#21293)9e85fefbackport of commit c5549cdac681676ae52ea173d737ee1c5d1949a2 (#21272)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show