diff --git a/content/vault/global/partials/policies/list-allowed-parameters.mdx b/content/vault/global/partials/policies/list-allowed-parameters.mdx index 3abf79ddff..de7aa94499 100644 --- a/content/vault/global/partials/policies/list-allowed-parameters.mdx +++ b/content/vault/global/partials/policies/list-allowed-parameters.mdx @@ -29,11 +29,3 @@ Additionally, Vault does not treat comma-separated strings in request parameters as lists when evaluating `allowed_parameters` and `denied_parameters`. For instance, configuring `denied_parameters` as `"Z": ["C", "D", ["C"], ["D"], ["C", "D"], ["D", "C"]]` does not block requests that set `"Z": "C,D"` or `"Z": "D,C"` - - - -Vault addressed the unexpected behavior of -`allowed_parameters` and `denied_parameters` in 1.21.x with -more intuitive list processing. - - diff --git a/content/vault/v1.16.x/content/docs/concepts/policies.mdx b/content/vault/v1.16.x/content/docs/concepts/policies.mdx index bf5fe2c42b..a8b92e8acf 100644 --- a/content/vault/v1.16.x/content/docs/concepts/policies.mdx +++ b/content/vault/v1.16.x/content/docs/concepts/policies.mdx @@ -575,6 +575,15 @@ path "secret/foo" { @include '../../../global/partials/policies/list-allowed-parameters.mdx' + + +Vault 1.21.x introduced a more intuitive list processing for `allowed_parameters` +and `denied_parameters`. You can enable the intuitive list processing behavior +for Vault 1.16.x by upgrading to 1.16.28 or later and setting the +`VAULT_NEW_PER_ELEMENT_MATCHING_ON_LIST` environment variable. + + + ### Required response wrapping TTLs These parameters can be used to set minimums/maximums on TTLs set by clients diff --git a/content/vault/v1.17.x/content/docs/concepts/policies.mdx b/content/vault/v1.17.x/content/docs/concepts/policies.mdx index 4bc39149ab..dd7db13e37 100644 --- a/content/vault/v1.17.x/content/docs/concepts/policies.mdx +++ b/content/vault/v1.17.x/content/docs/concepts/policies.mdx @@ -582,6 +582,15 @@ path "secret/foo" { @include '../../../global/partials/policies/list-allowed-parameters.mdx' + + +Vault 1.21.x introduced a more intuitive list processing for `allowed_parameters` +and `denied_parameters`. You can enable the intuitive list processing behavior +for Vault by upgrading to 1.19.12 or later and setting the +`VAULT_NEW_PER_ELEMENT_MATCHING_ON_LIST` environment variable. + + + ### Required response wrapping TTLs These parameters can be used to set minimums/maximums on TTLs set by clients diff --git a/content/vault/v1.18.x/content/docs/concepts/policies.mdx b/content/vault/v1.18.x/content/docs/concepts/policies.mdx index 4bc39149ab..dd7db13e37 100644 --- a/content/vault/v1.18.x/content/docs/concepts/policies.mdx +++ b/content/vault/v1.18.x/content/docs/concepts/policies.mdx @@ -582,6 +582,15 @@ path "secret/foo" { @include '../../../global/partials/policies/list-allowed-parameters.mdx' + + +Vault 1.21.x introduced a more intuitive list processing for `allowed_parameters` +and `denied_parameters`. You can enable the intuitive list processing behavior +for Vault by upgrading to 1.19.12 or later and setting the +`VAULT_NEW_PER_ELEMENT_MATCHING_ON_LIST` environment variable. + + + ### Required response wrapping TTLs These parameters can be used to set minimums/maximums on TTLs set by clients diff --git a/content/vault/v1.19.x/content/docs/concepts/policies.mdx b/content/vault/v1.19.x/content/docs/concepts/policies.mdx index 4bc39149ab..4960d513f9 100644 --- a/content/vault/v1.19.x/content/docs/concepts/policies.mdx +++ b/content/vault/v1.19.x/content/docs/concepts/policies.mdx @@ -582,6 +582,15 @@ path "secret/foo" { @include '../../../global/partials/policies/list-allowed-parameters.mdx' + + +Vault 1.21.x introduced a more intuitive list processing for `allowed_parameters` +and `denied_parameters`. You can enable the intuitive list processing behavior +for Vault 1.19.x by upgrading to 1.19.12 or later and setting the +`VAULT_NEW_PER_ELEMENT_MATCHING_ON_LIST` environment variable. + + + ### Required response wrapping TTLs These parameters can be used to set minimums/maximums on TTLs set by clients diff --git a/content/vault/v1.20.x/content/docs/concepts/policies.mdx b/content/vault/v1.20.x/content/docs/concepts/policies.mdx index 79aac1e1db..8e8d9316ce 100644 --- a/content/vault/v1.20.x/content/docs/concepts/policies.mdx +++ b/content/vault/v1.20.x/content/docs/concepts/policies.mdx @@ -584,6 +584,15 @@ path "secret/foo" { @include '../../../global/partials/policies/list-allowed-parameters.mdx' + + +Vault 1.21.x introduced a more intuitive list processing for `allowed_parameters` +and `denied_parameters`. You can enable the intuitive list processing behavior +for Vault 1.20.x by upgrading to 1.20.6 or later and setting the +`VAULT_NEW_PER_ELEMENT_MATCHING_ON_LIST` environment variable. + + + ### Required response wrapping TTLs These parameters can be used to set minimums/maximums on TTLs set by clients