hashicorp / hashicorp/vault-ruby

VaultEnt 1.12: sys.init method is no longer parsing options correctly for transit unseal types

Open
#278 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Ruby
Stars
354
Forks
138
PR merge metrics
No merged PRs in 30d

Description

We use a transit node and auto-unseal for our Vault infrastructure.
We have code that initializes vault as such:
`Vault.sys.init({:recovery_shares => 5, :recovery_threshold => 3})`

This has been working since implementation in the 1.11.x branch of Vault.

We recently upgraded to Vault Enterprise 1.12.1 and it seems like these options are no longer being parsed correctly. Even though we are still passing in recovery_shares as the init option, the values are no longer being parsed by the API and it thinks we are trying to use secret_shares for a transit seal????

```
Vault.sys.init({:recovery_shares => 5, :recovery_threshold => 3})

=> #
irb(main):032:0> Vault.sys.init({:recovery_shares => 5, :recovery_threshold => 3})
Traceback (most recent call last):
8: from /usr/bin/irb:23:in `'
7: from /usr/bin/irb:23:in `load'
6: from /usr/share/gems/gems/irb-1.2.3/exe/irb:11:in `'
5: from (irb):32
4: from /home/rethridge/.gem/ruby/gems/vault-0.17.0/lib/vault/api/sys/init.rb:70:in `init'
3: from /home/rethridge/.gem/ruby/gems/vault-0.17.0/lib/vault/client.rb:206:in `put'
2: from /home/rethridge/.gem/ruby/gems/vault-0.17.0/lib/vault/client.rb:300:in `request'
1: from /home/rethridge/.gem/ruby/gems/vault-0.17.0/lib/vault/client.rb:411:in `error'
Vault::HTTPClientError (The Vault server at `https://si-vault-mainline-01.infra.bwi:8200' responded with a 400.)
Any additional information the server supplied is shown below:

* parameters secret_shares,secret_threshold not applicable to seal type transit

Please refer to the documentation for help.
```

We downgraded back to Vault Enterprise 1.11.4 and the library works again as expected:

```
Vault.sys.init({:recovery_shares => 5, :recovery_threshold => 3})
=> #
```

I know you see the root token above, but this is a sandbox so it does not matter

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with lib/vault/api/sys/init.rb at the init call shown in the traceback, then inspect the request path through lib/vault/client.rb. Reproduce against Vault Enterprise 1.12.1 using a transit seal and compare the request behavior with 1.11.4. Done means recovery_shares and recovery_threshold are accepted for transit unseal without producing the secret_shares or secret_threshold error.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.