Convergent Encryption v2: New keys in transit using convergent mode will
use a new nonce derivation mechanism rather than require the user to supply
a nonce. While not explicitly increasing security, it minimizes the
likelihood that a user will use the mode improperly and impact the security
of their keys. Keys in convergent mode that were created in v0.6.1 will
continue to work with the same mechanism (user-supplied nonce).
etcd HA off by default: Following in the footsteps of dynamodb, the
etcd storage backend now requires that ha_enabled be explicitly
specified in the configuration file. The backend currently has known broken
HA behavior, so this flag discourages use by default without explicitly
enabling it. If you are using this functionality, when upgrading, you should
set ha_enabled to "true"before starting the new versions of Vault.
Default/Max lease/token TTLs are now 32 days: In previous versions of Vault
the default was 30 days, but moving it to 32 days allows some operations
(e.g. reauthenticating, renewing, etc.) to be performed via a monthly cron
job.
AppRole Secret ID endpoints changed: Secret ID and Secret ID accessors are
no longer part of request URLs. The GET and DELETE operations are now moved
to new endpoints (/lookup and /destroy) which consumes the input from
the body and not the URL.
AppRole requires at least one constraint: previously it was sufficient to
turn off all AppRole authentication constraints (secret ID, CIDR block) and
use the role ID only. It is now required that at least one additional
constraint is enabled. Existing roles are unaffected, but any new roles or
updated roles will require this.
Reading wrapped responses from cubbyhole/response is deprecated. The
sys/wrapping/unwrap endpoint should be used instead as it provides
additional security, auditing, and other benefits. The ability to read
directly will be removed in a future release.
Request Forwarding is now on by default: in 0.6.1 this required toggling on,
but is now enabled by default. This can be disabled via the
"disable_clustering" parameter in Vault's
config, or per-request
with the X-Vault-No-Request-Forwarding header.
In prior versions a bug caused the bound_iam_role_arn value in the
aws-ec2 authentication backend to actually use the instance profile ARN.
This has been corrected, but as a result there is a behavior change. To
match using the instance profile ARN, a new parameter
bound_iam_instance_profile_arn has been added. Existing roles will
automatically transfer the value over to the correct parameter, but the next
time the role is updated, the new meanings will take effect.
FEATURES:
Secret ID CIDR Restrictions in AppRole: Secret IDs generated under an
approle can now specify a list of CIDR blocks from where the requests to
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps github.com/hashicorp/vault/sdk from 0.6.1 to 0.6.2.
Changelog
Sourced from github.com/hashicorp/vault/sdk's changelog.
... (truncated)
Commits
22619b6
Cut version 0.6.2d7615b0
Don't use quoted identifier for the usernamef911375
Update upgrade guide9c30bf0
changelog++37df43d
Postgres revocation sql, beta mode (#1972)5394fc7
Prep for 0.6.2261cc52
Post-review fixes for file/zk recursive empty prefix delete2af3c49
changelog++fd234e4
changelog++2711249
Merge pull request #1964 from mesosphere/prozlach/nested_secrets_handling_fixDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)