Skip to content

Commit 0062f57

Browse files
kpcraigkpcraig
authored
add utc callout to rotation fields (#1075)
This doc change is related to hashicorp/vault-enterprise#9942
2 parents cb7c0fa + a9cb7a6 commit 0062f57

File tree

9 files changed

+42
-8
lines changed

9 files changed

+42
-8
lines changed

‎content/vault/global/partials/important-changes/summary-tables/1_19.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ Introduced | Recommendations | Edition | Change
2323
1.19.0 | No | All | [Transit support for Ed25519ph and Ed25519ctx signatures](/vault/docs/v1.19.x/updates/important-changes#ed25519)
2424
1.19.1 | **Yes** | All | [Strict validation for Azure auth login requests](/vault/docs/v1.19.x/updates/important-changes#strict-azure)
2525
1.19.9 | No | All | [JSON Payload Limits](/vault/docs/v1.19.x/updates/important-changes#json-limits)
26+
1.19.11 | **Yes** | Enterprise | [Rotation manager schedule strings in UTC](/vault/docs/v1.19.x/updates/important-changes#rotation-manager-utc)
2627

2728

2829
### Known issues

‎content/vault/global/partials/important-changes/summary-tables/1_20.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Introduced | Recommendations | Edition | Change
1616
1.20.0 | **Yes** | All | [Key pair authentication for Snowflake DB secrets engine](/vault/docs/v1.20.x/updates/important-changes#snowflake-keypair-auth)
1717
1.20.0 | **Yes** | All | [Audience warning for Kubernetes authentication roles](#k8-audience-warning)
1818
1.20.3 | No | All | [JSON Payload Limits](/vault/docs/v1.20.x/updates/important-changes#json-limits)
19-
19+
1.20.5 | **Yes** | All | [Rotation manager schedule strings in UTC](/vault/docs/v1.20.x/updates/important-changes#rotation-manager-utc)
2020

2121

2222
### Known issues

‎content/vault/global/partials/important-changes/summary-tables/1_21.mdx‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@ Introduced | Recommendations | Edition | Change
77

88
### New behavior
99

10-
None.
10+
Introduced | Recommendations | Edition | Change
11+
---------- | --------------- | ---------- | ------
12+
1.21.0 | **Yes** | Enterprise | [Rotation manager schedule strings in UTC](/vault/docs/v1.21.x/updates/important-changes#rotation-manager-utc)
13+
1114

1215
### Known issues
1316

‎content/vault/v1.19.x/content/docs/updates/important-changes.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,17 @@ If you use `file` audit devices, you need to:
160160
1. Use non-executable file modes (e.g., 0644, 0666) for log files.
161161

162162

163+
### Rotation manager schedule strings in UTC ((#rotation-manager-utc))
164+
165+
| Change | Affected version | Vault edition
166+
| ------------ | ---------------- | -------------
167+
| New behavior | 1.19.11+ | Enterprise
168+
169+
Vault interprets `rotation_schedule` strings relative to UTC to match the
170+
behavior of static role rotations in the database plugin. Old rotations use
171+
their existing schedule until you manually update rotation with an API call.
172+
173+
163174
## Breaking changes
164175

165176
@include '../../../global/partials/important-changes/breaking-changes/cve-2025-6000.mdx'

‎content/vault/v1.19.x/content/partials/rotationfields.mdx‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
defining the schedule on which Vault should rotate the root token. Standard
99
cron-style time format uses five fields to define the minute, hour, day of
1010
month, month, and day of week respectively. For example, `0 0 * * SAT` tells
11-
Vault to rotate the root token every Saturday at 00:00. **You must set one of
11+
Vault to rotate the root token every Saturday at 00:00. In 1.19.11 or later,
12+
Vault interprets the schedule in UTC. **You must set one of
1213
`rotation_schedule` or `rotation_period`, but cannot set both**.
1314
- `rotation_window` `(string/integer: 0)` – <EnterpriseAlert product="vault" inline />
1415
The maximum amount of time, in seconds, allowed to complete

‎content/vault/v1.20.x/content/docs/updates/important-changes.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,17 @@ You would then authenticate with the command below.
231231
$ vault write auth/kubernetes/login role=demo audience="my_audience" jwt=...
232232
```
233233

234+
235+
### Rotation manager schedue strings in UTC ((#rotation-manager-utc))
236+
237+
| Change | Affected version | Vault edition
238+
| ------------ | ---------------- | -------------
239+
| New behavior | 1.20.5+ | Enterprise
240+
241+
Vault interprets `rotation_schedule` strings relative to UTC to match the
242+
behavior of static role rotations in the database plugin. Old rotations use
243+
their existing schedule until you manually update rotation with an API call.
244+
234245
---
235246

236247

‎content/vault/v1.20.x/content/partials/rotationfields.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
defining the schedule on which Vault should rotate the root token. Standard
99
cron-style time format uses five fields to define the minute, hour, day of
1010
month, month, and day of week respectively. For example, `0 0 * * SAT` tells
11-
Vault to rotate the root token every Saturday at 00:00. **You must set one of
12-
`rotation_schedule` or `rotation_period`, but cannot set both**.
11+
Vault to rotate the root token every Saturday at 00:00. In 1.20.5 or later, Vault interprets the schedule in UTC.
12+
**You must set one of `rotation_schedule` or `rotation_period`, but cannot set both**.
1313
- `rotation_window` `(string/integer: 0)` – <EnterpriseAlert product="vault" inline />
1414
The maximum amount of time, in seconds, allowed to complete
1515
a rotation when a scheduled token rotation occurs. If Vault cannot rotate the

‎content/vault/v1.21.x (rc)/content/docs/updates/important-changes.mdx‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,15 @@ more information.
5252

5353
## New behavior
5454

55-
None.
55+
### Rotation manager schedule strings in UTC ((#rotation-manager-utc))
5656

57+
| Change | Affected version | Vault edition
58+
| ------------ | ---------------- | -------------
59+
| New behavior | 1.21.0+ | Enterprise
60+
61+
Vault interprets `rotation_schedule` strings relative to UTC to match the
62+
behavior of static role rotations in the database plugin. Old rotations use
63+
their existing schedule until you manually update rotation with an API call.
5764

5865
## Known issues
5966

‎content/vault/v1.21.x (rc)/content/partials/rotationfields.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
defining the schedule on which Vault should rotate the root token. Standard
99
cron-style time format uses five fields to define the minute, hour, day of
1010
month, month, and day of week respectively. For example, `0 0 * * SAT` tells
11-
Vault to rotate the root token every Saturday at 00:00. **You must set one of
12-
`rotation_schedule` or `rotation_period`, but cannot set both**.
11+
Vault to rotate the root token every Saturday at 00:00. Vault interprets the schedule in UTC.
12+
**You must set one of `rotation_schedule` or `rotation_period`, but cannot set both**.
1313
- `rotation_window` `(string/integer: 0)` – <EnterpriseAlert product="vault" inline />
1414
The maximum amount of time, in seconds, allowed to complete
1515
a rotation when a scheduled token rotation occurs. If Vault cannot rotate the

0 commit comments

Comments
 (0)