Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: support for VAULT_TLS_SERVER_NAME #1145

Merged
merged 2 commits into from
Apr 20, 2022
Merged

feat: support for VAULT_TLS_SERVER_NAME #1145

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b27921d
feat: support for VAULT_TLS_SERVER_NAME
greut Aug 11, 2021
154f2d4
Update vault/provider.go
benashz Apr 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 10 additions & 3 deletions vault/provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,12 @@ func Provider() *schema.Provider {
DefaultFunc: schema.EnvDefaultFunc("VAULT_SKIP_VERIFY", false),
Description: "Set this to true only if the target Vault server is an insecure development instance.",
},
"tls_server_name": {
Type: schema.TypeString,
Optional: true,
DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultTLSServerName, ""),
Description: "Name to use as the SNI host when connecting via TLS.",
},
"max_lease_ttl_seconds": {
Type: schema.TypeInt,
Optional: true,
Expand Down Expand Up @@ -789,9 +795,10 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
}

err := clientConfig.ConfigureTLS(&api.TLSConfig{
CACert: d.Get("ca_cert_file").(string),
CAPath: d.Get("ca_cert_dir").(string),
Insecure: d.Get("skip_tls_verify").(bool),
CACert: d.Get("ca_cert_file").(string),
CAPath: d.Get("ca_cert_dir").(string),
Insecure: d.Get("skip_tls_verify").(bool),
TLSServerName: d.Get("tls_server_name").(string),

ClientCert: clientAuthCert,
ClientKey: clientAuthKey,
Expand Down
3 changes: 3 additions & 0 deletions website/docs/index.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,9 @@ variables in order to keep credential information out of the configuration.
that Terraform can be tricked into writing secrets to a server controlled
by an intruder. May be set via the `VAULT_SKIP_VERIFY` environment variable.

* `tls_server_name` - (Optional) Name to use as the SNI host when connecting
via TLS. May be set via the `VAULT_TLS_SERVER_NAME` environment variable.

* `skip_child_token` - (Optional) Set this to `true` to disable
creation of an intermediate ephemeral Vault token for Terraform to
use. Enabling this is strongly discouraged since it increases
Expand Down