search

jonasvinther / medusa

A cli tool for importing and exporting Hashicorp Vault secrets
MIT License
482 stars 62 forks source link

Bump github.com/hashicorp/vault/api/auth/kubernetes from 0.6.0 to 0.7.0 #163

Open dependabot[bot] opened 5 months ago

dependabot[bot] commented 5 months ago

Bumps github.com/hashicorp/vault/api/auth/kubernetes from 0.6.0 to 0.7.0.

Changelog

Sourced from github.com/hashicorp/vault/api/auth/kubernetes's changelog.

0.7.0 (March 21th, 2017)

SECURITY:

  • Common name not being validated when exclude_cn_from_sans option used in pki backend: When using a role in the pki backend that specified the exclude_cn_from_sans option, the common name would not then be properly validated against the role's constraints. This has been fixed. We recommend any users of this feature to upgrade to 0.7 as soon as feasible.

DEPRECATIONS/CHANGES:

  • List Operations Always Use Trailing Slash: Any list operation, whether via the GET or LIST HTTP verb, will now internally canonicalize the path to have a trailing slash. This makes policy writing more predictable, as it means clients will no longer work or fail based on which client they're using or which HTTP verb they're using. However, it also means that policies allowing list capability must be carefully checked to ensure that they contain a trailing slash; some policies may need to be split into multiple stanzas to accommodate.
  • PKI Defaults to Unleased Certificates: When issuing certificates from the PKI backend, by default, no leases will be issued. If you want to manually revoke a certificate, its serial number can be used with the pki/revoke endpoint. Issuing leases is still possible by enabling the generate_lease toggle in PKI role entries (this will default to true for upgrades, to keep existing behavior), which will allow using lease IDs to revoke certificates. For installations issuing large numbers of certificates (tens to hundreds of thousands, or millions), this will significantly improve Vault startup time since leases associated with these certificates will not have to be loaded; however note that it also means that revocation of a token used to issue certificates will no longer add these certificates to a CRL. If this behavior is desired or needed, consider keeping leases enabled and ensuring lifetimes are reasonable, and issue long-lived certificates via a different role with leases disabled.

FEATURES:

  • Replication (Enterprise): Vault Enterprise now has support for creating a multi-datacenter replication set between clusters. The current replication offering is based on an asynchronous primary/secondary (1:N) model that replicates static data while keeping dynamic data (leases, tokens) cluster-local, focusing on horizontal scaling for high-throughput and high-fanout deployments.
  • Response Wrapping & Replication in the Vault Enterprise UI: Vault Enterprise UI now supports looking up and rotating response wrapping tokens, as well as creating tokens with arbitrary values inside. It also now supports replication functionality, enabling the configuration of a replication set in the UI.
  • Expanded Access Control Policies: Access control policies can now specify allowed and denied parameters -- and, optionally, their values -- to

... (truncated)

Commits
  • 614deac Cut version 0.7.0
  • 89160f8 Bump for 0.7 release
  • 3f67ab4 Ensure CN check is made when exclude_cn_from_sans is used
  • a5d1808 Always include a hash of the public key and "vault" (to know where it (#2498)
  • 6f84f7f Adding allow_user_key_ids field to SSH role config (#2494)
  • 02921e8 Fix layout for replication
  • db814ce changelog++
  • 5252de6 Bump test timeout
  • 688104e Allow roles to specify whether CSR SANs should be used instead of (#2489)
  • 38d70b7 Vault_Enterprise_WWW (#2327)
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)