Skip to content

Commit 885770e

Browse files
fairclothjmschavis
andauthored
Apply suggestions from code review
Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
1 parent 9e6abb5 commit 885770e

File tree

2 files changed

+28
-35
lines changed

2 files changed

+28
-35
lines changed

content/vault/v1.19.x/content/docs/updates/important-changes.mdx

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -472,32 +472,29 @@ Snowflake database.
472472

473473
| Change | Affected version | Fixed version |
474474
| :--- | :--- | :--- |
475-
| Known issue | 1.20.x, 1.19.x | None |
475+
| Known issue | 1.19.0 | None |
476476

477-
Write operations targeting a local auth mount on a performance replication secondary
478-
cluster are incorrectly forwarded to the primary cluster for processing. This
479-
prevents the independent configuration of local mounts on secondary clusters.
477+
Vault incorrectly forwards write operations targeting a local authentication
478+
mounts on a performance replication secondary to the primary cluster for
479+
processing. Forwarding the request prevents independent configuration of local
480+
mounts on secondary clusters for the following authentication methods:
480481

481-
The following auth methods are affected:
482482
- Azure
483483
- GCP
484484
- AWS
485485
- LDAP
486486

487-
This behavior leads to two distinct failure modes. If a local auth mount with the
488-
same path exists on the primary, the write operation is incorrectly applied to
489-
the primary's mount. If the auth mount path does not exist on the primary, the
490-
secondary cluster panics with a `nil pointer dereference` error, causing the
491-
Vault node to crash.
487+
Incorrect forwarding leads to two distinct failure modes:
488+
489+
1. If a local auth mount with the same path exists on the primary, Vault
490+
incorrectly applies the write operation to the primary node mount.
491+
492+
1. If the auth mount path does not exist on the primary, the secondary cluster
493+
panics with a `nil pointer dereference` error and the Vault node crashes.
492494

493-
As a result, it is not possible to maintain independent configurations for
494-
local mounts that share the same path across a primary and its secondaries.
495-
Furthermore, attempting to use unique paths on the secondary that do not exist
496-
on the primary leads to a panic as Vault will forward the request.
497495

498496
#### Recommendation
499497

500-
There is currently no known workaround for this issue. Do not attempt to
501-
configure local auth mounts on performance replication secondaries until a fix
502-
is available.
498+
Do not attempt to configure local auth mounts on performance replication
499+
secondaries.
503500

content/vault/v1.20.x/content/docs/updates/important-changes.mdx

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -357,32 +357,28 @@ prevent duplicate password rotations on the LDAP server.
357357

358358
| Change | Affected version | Fixed version |
359359
| :--- | :--- | :--- |
360-
| Known issue | 1.20.x, 1.19.x | None |
360+
| Known issue | 1.20.0+ | None |
361361

362-
Write operations targeting a local auth mount on a performance replication secondary
363-
cluster are incorrectly forwarded to the primary cluster for processing. This
364-
prevents the independent configuration of local mounts on secondary clusters.
362+
Vault incorrectly forwards write operations targeting a local authentication
363+
mounts on a performance replication secondary to the primary cluster for
364+
processing. Forwarding the request prevents independent configuration of local
365+
mounts on secondary clusters for the following authentication methods:
365366

366-
The following auth methods are affected:
367367
- Azure
368368
- GCP
369369
- AWS
370-
- LDAP
370+
- LDA
371371

372-
This behavior leads to two distinct failure modes. If a local auth mount with the
373-
same path exists on the primary, the write operation is incorrectly applied to
374-
the primary's mount. If the auth mount path does not exist on the primary, the
375-
secondary cluster panics with a `nil pointer dereference` error, causing the
376-
Vault node to crash.
372+
Incorrect forwarding leads to two distinct failure modes:
377373

378-
As a result, it is not possible to maintain independent configurations for
379-
local mounts that share the same path across a primary and its secondaries.
380-
Furthermore, attempting to use unique paths on the secondary that do not exist
381-
on the primary leads to a panic as Vault will forward the request.
374+
1. If a local auth mount with the same path exists on the primary, Vault
375+
incorrectly applies the write operation to the primary node mount.
376+
377+
1. If the auth mount path does not exist on the primary, the secondary cluster
378+
panics with a `nil pointer dereference` error and the Vault node crashes.
382379

383380
#### Recommendation
384381

385-
There is currently no known workaround for this issue. Do not attempt to
386-
configure local auth mounts on performance replication secondaries until a fix
387-
is available.
382+
Do not attempt to configure local auth mounts on performance replication
383+
secondaries.
388384

0 commit comments

Comments
 (0)