Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add universal default key_bits value for PKI endpoints #13080

Merged
merged 6 commits into from Dec 13, 2021
Merged

Add universal default key_bits value for PKI endpoints #13080

merged 6 commits into from Dec 13, 2021

Conversation

cipherboy
Copy link
Contributor

Built on top of #12872; will be rebased once that merges.

PKI endpoints currently require key_bits field to be changed if key_type changes; this is because key_bits presently has default value 2048, which is nonsensical for key_type=ec keys (which support 224, 256, 384, and 521). Changing key_bits to a default value of 0 (a "universal default" similar to what was done with signature_bits in #12872) allows us to switch the actual default value of key_bits internally, based on what value key_type takes.

This retains the default value of 2048 for RSA and allows for a request with only key_type=ec to succeed, with 256-bit NIST P-Curve.

Also slightly refactors RSA small key detection and pki/backend_test.go.

@vercel vercel bot temporarily deployed to Preview – vault November 8, 2021 16:58 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 8, 2021 16:58 Inactive
@vercel vercel bot temporarily deployed to Preview – vault November 8, 2021 17:20 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 8, 2021 17:20 Inactive
@vercel vercel bot temporarily deployed to Preview – vault November 16, 2021 13:38 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 16, 2021 13:38 Inactive
@cipherboy cipherboy marked this pull request as ready for review November 16, 2021 13:39
sgmiller
sgmiller requested changes Nov 17, 2021
View reviewed changes
Copy link
Collaborator

@sgmiller sgmiller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly like it, but would a couple comments.

changelog/13080.txt Outdated
@@ -0,0 +1,3 @@
```release-note:bug
secrets/pki: Default value for key_bits changed to 0 to enable default key_type=ec key generation time
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

awk sentence. Dod you possibly mean "at key generation time"?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lol. s/Dod/do/

Copy link
Contributor Author

@cipherboy cipherboy Nov 29, 2021 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, yeah, that didn't make sense. Take a look at this? Hoping it makes more sense... :D

sdk/helper/certutil/helpers.go Outdated
@@ -536,7 +544,7 @@ func StringToOid(in string) (asn1.ObjectIdentifier, error) {
// Validates that the combination of keyType, keyBits, and hashBits are
// valid together; replaces individual calls to ValidateSignatureLength and
// ValidateKeyTypeLength.
func ValidateKeyTypeSignatureLength(keyType string, keyBits int, hashBits *int) error {
func ValidateKeyTypeSignatureLength(keyType string, keyBits *int, hashBits *int) error {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bit concerned that it's surprising that a Validation function actually changes it's inputs. Rather than use a pointer, I'd prefer a (named?) multi-return that returns the new keyBits/hashBits, and change the function name in some way to show that it's both validating and updating.

Copy link
Contributor Author

@cipherboy cipherboy Nov 17, 2021 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah sorry, that snuck in from the earlier PR on signature bits, guess I brought in a C-ism. 🗡️

How does multi-return work at the call site? Would we need to do:

var err error
...

if role.KeyBits, role.SignatureBits, err = certutil.ValidateKeyTypeSignatureLength(role.KeyType, role.KeyBits, role.SignatureBits); err != nil {
    return err
}

(Edit: dropped the := -- wouldn't work). Would that be scoped properly?

That gets really long and length, in my mind. I think the &... (for a C programmer) is sufficient warning to tell them to look at what the function is doing more closely.

@cipherboy
Allow universal default for key_bits
cc11186 
This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@cipherboy
Handle universal default key size in certutil
4e2a140 
Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@cipherboy
Add missing RSA key sizes to pki/backend_test.go
31bb231 
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@vercel vercel bot temporarily deployed to Preview – vault November 29, 2021 15:54 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 29, 2021 15:54 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 29, 2021 15:58 Inactive
@vercel vercel bot temporarily deployed to Preview – vault November 29, 2021 15:58 Inactive
@cipherboy
Switch to returning updated values
056bcf3 
When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@cipherboy
Add changelog entry
555f12e 
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@vercel vercel bot temporarily deployed to Preview – vault November 29, 2021 16:24 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 29, 2021 16:24 Inactive
@cipherboy
Re-add fix for ed25519 from hashicorp#13254
1e0eada 
Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
@vercel vercel bot temporarily deployed to Preview – vault November 29, 2021 18:37 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook November 29, 2021 18:37 Inactive
@cipherboy
Copy link
Contributor Author

@sgmiller and @stevendpclark, any chance I could bother either of you to take a look at this early next week? Thanks!

stevendpclark
stevendpclark reviewed Dec 6, 2021
View reviewed changes
sdk/helper/certutil/helpers.go
}
// Returns default key bits for the specified key type, or the present value
// if keyBits is non-zero.
func DefaultOrValueKeyBits(keyType string, keyBits int) (int, error) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We never return an error in any circumstance from this function, could this be simplified?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't here, but DefaultOrValueHashBits returns an err... does it make sense (since this is in the SDK) to keep the signature the same between the two and thus leave the potential for an error open in the future? That was my reasoning for including an (unused) error type.

If we chose to add ed25519 to defaultAlgorithmKeyBits we could turn !present into an error case, much like we've done with expectedNISTPCurveHashBits below. But that'd also be validating algorithm type, which I think should be done later.

Thoughts?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well I suppose my only thought would be that would be a subtle interface/behaviour change in the future and would be harder to evaluate the effects of.

If we decide to add ed25519 and switch the !present behaviour we run the risk of breaking say ed448 or some other type that is not within the default value but being leveraged by some code path added in the future...

Anyways just my 2c.

@cipherboy
Copy link
Contributor Author

cipherboy commented Dec 13, 2021 •
edited

Thanks all! Going ahead and merging with out-of-band confirmation from Scott.

@cipherboy cipherboy merged commit e923413 into hashicorp:main Dec 13, 2021
Monkeychip added a commit that referenced this pull request Dec 15, 2021
@Monkeychip @ncabatoff
@harsimranmaan @stevendpclark @taoism4504 @zofskeez @mickael-hc @calvn @mikegreen @EnMod @tomhjp @schultz-is @robison @tvoran @pmmukh @mladlow @hghaf099 @fairclothjm @divyapola5 @hashishaw @benashz @jasonodonnell @cipherboy @ml4 @bshreddy @kpenfound @victorr
UI/merge main (#13436)
a304198 
* Rename master key to root key (#13324)

* See what it looks like to replace "master key" with "root key".  There are two places that would require more challenging code changes: the storage path `core/master`, and its contents (the JSON-serialized EncodedKeyringtructure.)

* Restore accidentally deleted line

* Add changelog

* Update root->recovery

* Fix test

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Fix typo (#13355)

* Add kms_library configuration stanza (#13352)

- Add the kms_library configuration stanza to Vault's command/server
 - Provide validation of keys and general configuration.
 - Add initial kms_library configuration documentation
 - Attempt at startup to verify we can read the configured HSM Library
 - Hook in KmsLibrary config into the Validate to detect typo/unused keys

* modifed note (#13351)

* Incorporate Ember Flight Icons (#12976)

* adds ember-flight-icons dependecy

* adds inline-json-import babel plugin

* adds flight icon styling

* updates Icon component to support flight icons

* updates Icon component usages to new api and updates name values to flight icon set when available

* fixes tests

* updates icon story with flight mappings and fixes issue with flight icons not rendering in storybook

* adds changelog

* fixes typo in sign action glyph name in transit-key model

* adds comments to icon-map

* updates Icon component to use only supported flight icon sizes

* adds icon transform codemod

* updates icon transform formatting to handle edge case

* runs icon transform on templates

* updates Icon usage in toolbar-filter md and story

* updates tests

* docs: winsvc update recommendations (#13280)

* docs: update custom database sample code (#13211)

* clarify more sink options (#12586)

* Update @hashicorp/react-hashi-stack-menu (#13354)

* Docs to clarify k8s auth options with short-lived tokens (#13275)

* Rework 1.21 content into one heading and add note at top
* Add notes about extended k8s token duration
* Add example of ClusterRoleBinding for using client JWTs

* Adds support for SHA-3 to transit (#13367)

* Adding support for SHA3 in the transit backend.

* Adds SHA-3 tests for transit sign/verify path. Adds SHA-3 tests for logical system tools path hash functionality. Updates documentation to include SHA-3 algorithms in system tools path hashing.

* Adds changelog entry.

Co-authored-by: robison jacka <robison@packetized.io>

* agent/cache: differentiate open log messages (#13362)

Changes the error output for the second open of the persistent cache
file, to differentiate it from the c.UI.Error message for the initial
open of the cache file, just to make it easier to tell where a problem
occurred.

* Warn user supplying nonce values in FIPS mode for transit encryption requests (#13366)

* Warn user supplying nonce values in FIPS mode for transit encryption requests

 - Send back a warning within the response if an end-user supplies nonce
   values that we use within the various transit encrypt apis.
 - We do not send a warning if an end-user supplies a nonce value but we
   don't use it.
 - Affected api methods are encrypt, rewrap and datakey
 - The warning is only sent when we are operating in FIPS mode.

* [VAULT-3252] Add entity-alias behavior change to docs (#13370)

* Add entity-alias behavior change to docs

* Add upgrade note about entity-alias mapping change

* Rename 1.7-9 upgrade pages, shuffle upgrade note position

* Update website/content/partials/entity-alias-mapping.mdx

Co-authored-by: Meggie <meggie@hashicorp.com>

* Add incorrect policy issue to the docs

* Add example about entity-alias restriction

Co-authored-by: Meggie <meggie@hashicorp.com>

* VAULT-1564 report in-flight requests (#13024)

* VAULT-1564 report in-flight requests

* adding a changelog

* Changing some variable names and fixing comments

* minor style change

* adding unauthenticated support for in-flight-req

* adding documentation for the listener.profiling stanza

* adding an atomic counter for the inflight requests
addressing comments

* addressing comments

* logging completed requests

* fixing a test

* providing log_requests_info as a config option to determine at which level requests should be logged

* removing a member and a method from the StatusHeaderResponseWriter struct

* adding api docks

* revert changes in NewHTTPResponseWriter

* Fix logging invalid log_requests_info value

* Addressing comments

* Fixing a test

* use an tomic value for logRequestsInfo, and moving the CreateClientID function to Core

* fixing go.sum

* minor refactoring

* protecting InFlightRequests from data race

* another try on fixing a data race

* another try to fix a data race

* addressing comments

* fixing couple of tests

* changing log_requests_info to log_requests_level

* minor style change

* fixing a test

* removing the lock in InFlightRequests

* use single-argument form for interface assertion

* adding doc for the new configuration paramter

* adding the new doc to the nav data file

* minor fix

* auth/jwt: Update plugin to v0.11.3 (#13365)

* auth/jwt: Update plugin to v0.11.3

* add changelog

* changelog++

* Update alert banner (#13375)

* Updating website for 1.9.1 (#13378)

* Use os.Hostname instead of a dependency that doesn't work on OpenBSD. (#13389)

* Remove another use gopsutil/host. (#13390)

* CLI changes for new mount tune config parameter allowed_managed_keys (#13255)

* CLI changes for new mount tune config parameter allowed_managed_keys

* Correct allowed_managed_keys description in auth and secrets

* Documentation update for secrets and removed changes for auth

* Add changelog and remove documentation changes for auth

* removed changelog

* Correct the field description

* auth/jwt: update changelog for pkce improvement (#13392)

* Fix test validating convergent encryption behaviour across key types (#13371)

- The test was attempting to test the convergent encryption behaviour
  with several key types but the common function never used the passed
  in key type. So we ran the test with the default aes256-gcm96 only.

* Fix managed namespace test (#13394)

* Fix managed namespace test

* Remove log

* Some changelog tidying for 1.10 preview (#13385)

* Some changelog tidying for 1.10 preview

* PR accounted for by different CL entry

* changelog++

Working on a new workflow for generating the preview so I thought I'd leave a note that it's still coming.

* UI/fix client count partial (#13396)

* Initial fix

* Add fallback zero values

* Add changelog

* Fix client count current test

* Support clearing an identity alias' custom_metadata (#13395)

* Support clearing an identity alias' custom_metadata

Previously, an update to an entity alias supported updating the
custom_metadata as long as the update was not empty, which makes it
impossible to clear the metadata values completely.

Fixes:
- empty custom_metadata parameters are honoured on entity alias update
- update related tests
- drop dependency on mapstructure
- reformat with gofumpt

* Docs: fix invalid link in the kubernetes auth api doc. (#13399)

* Clean up whitespace

* auth/azure: add note about debug env (#13405)

* auth/azure: add note about debug env

* Update azure.mdx

* Update azure.mdx

* Add universal default key_bits value for PKI endpoints (#13080)

* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from #13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Fix logging statement using formatting args (#13407)

* Add docs about path param restrictions (#13413)

* Add docs about path param restrictions

* Update website/content/api-docs/auth/userpass.mdx

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update with review suggestion

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update raftautosnapshots.mdx (#13412)

* Main go version bump (#13408)

* Go 1.17.2 -> 1.17.5
* Switching to cimg

* Bump yarn cache key version so that it uses the new disk layout we've adopted for using cimg/go. (#13420)

* Add vault-api module (#13048)

* crt main fix for ecr tag (#13425)

* Add no-op method setupManagedKeyRegistry(). (#13433)

* github auth: use org id to verify creds (#13332)

* github auth: use org id to verify creds

* add check for required org param; add test case

* update UTs

* add nil check for org

* add changelog

* fix typo in ut

* set org ID if it is unset; add more ut coverage

* add optional organization_id

* move client instantiation

* refactor parse URL; add UT for setting org ID

* fix comment in UT

* add nil check

* don't update org name on change; return warning

* refactor verifyCredentials

* error when unable to fetch org ID on config write; add warnings

* fix bug in log message

* update UT and small refactor

* update comments and log msg

* use getter for org ID

Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>
hellobontempo added a commit that referenced this pull request Jan 6, 2022
@Monkeychip @hellobontempo
@ncabatoff @harsimranmaan @stevendpclark @taoism4504 @zofskeez @mickael-hc @calvn @mikegreen @EnMod @tomhjp @schultz-is @robison @tvoran @pmmukh @mladlow @hghaf099 @fairclothjm @divyapola5 @hashishaw @benashz @jasonodonnell @cipherboy @ml4 @bshreddy @kpenfound @victorr
UI/client count 1.10 (#13574)
7b3b455 
* UI/total client usage (#13359)

* blah

* setup

* clean up

* rename history to dashboard

* clean up

* Styling fixes (#13369)

* styling

* clean up

* UI/ horizontal bar chart component (#13361)

* horizontal bar chart component

* adds horizontal chart to dashboard file

* add export class

* yarn install d3 array

* yarn install d3 array

* adds data subtext to chart

* update naming to plural charts"

* updates css grid to 6 columns"

* UI/tooltip (#13397)

* working state

* stuff

* adds month tick marks and sort of y-axis, but y scale still messed up

* moves y scale so zero shows again

* fixes translating constants

* format numbers y axis

* actually fixes viewbox

* styling for x and y axis plus gridlines

* clean up

* separates grid types based on content

Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>

* Styling and legend component (#13430)

* styling

* cleanup

* UI/ Double horizontal bar charts (#13398)

* add descriptions and styling to side by side charts

* add border below horizontal charts

* starts legend styling

* center legend

* add to do

* add hover actions/event listeners

* UI/merge main (#13436)

* Rename master key to root key (#13324)

* See what it looks like to replace "master key" with "root key".  There are two places that would require more challenging code changes: the storage path `core/master`, and its contents (the JSON-serialized EncodedKeyringtructure.)

* Restore accidentally deleted line

* Add changelog

* Update root->recovery

* Fix test

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Fix typo (#13355)

* Add kms_library configuration stanza (#13352)

- Add the kms_library configuration stanza to Vault's command/server
 - Provide validation of keys and general configuration.
 - Add initial kms_library configuration documentation
 - Attempt at startup to verify we can read the configured HSM Library
 - Hook in KmsLibrary config into the Validate to detect typo/unused keys

* modifed note (#13351)

* Incorporate Ember Flight Icons (#12976)

* adds ember-flight-icons dependecy

* adds inline-json-import babel plugin

* adds flight icon styling

* updates Icon component to support flight icons

* updates Icon component usages to new api and updates name values to flight icon set when available

* fixes tests

* updates icon story with flight mappings and fixes issue with flight icons not rendering in storybook

* adds changelog

* fixes typo in sign action glyph name in transit-key model

* adds comments to icon-map

* updates Icon component to use only supported flight icon sizes

* adds icon transform codemod

* updates icon transform formatting to handle edge case

* runs icon transform on templates

* updates Icon usage in toolbar-filter md and story

* updates tests

* docs: winsvc update recommendations (#13280)

* docs: update custom database sample code (#13211)

* clarify more sink options (#12586)

* Update @hashicorp/react-hashi-stack-menu (#13354)

* Docs to clarify k8s auth options with short-lived tokens (#13275)

* Rework 1.21 content into one heading and add note at top
* Add notes about extended k8s token duration
* Add example of ClusterRoleBinding for using client JWTs

* Adds support for SHA-3 to transit (#13367)

* Adding support for SHA3 in the transit backend.

* Adds SHA-3 tests for transit sign/verify path. Adds SHA-3 tests for logical system tools path hash functionality. Updates documentation to include SHA-3 algorithms in system tools path hashing.

* Adds changelog entry.

Co-authored-by: robison jacka <robison@packetized.io>

* agent/cache: differentiate open log messages (#13362)

Changes the error output for the second open of the persistent cache
file, to differentiate it from the c.UI.Error message for the initial
open of the cache file, just to make it easier to tell where a problem
occurred.

* Warn user supplying nonce values in FIPS mode for transit encryption requests (#13366)

* Warn user supplying nonce values in FIPS mode for transit encryption requests

 - Send back a warning within the response if an end-user supplies nonce
   values that we use within the various transit encrypt apis.
 - We do not send a warning if an end-user supplies a nonce value but we
   don't use it.
 - Affected api methods are encrypt, rewrap and datakey
 - The warning is only sent when we are operating in FIPS mode.

* [VAULT-3252] Add entity-alias behavior change to docs (#13370)

* Add entity-alias behavior change to docs

* Add upgrade note about entity-alias mapping change

* Rename 1.7-9 upgrade pages, shuffle upgrade note position

* Update website/content/partials/entity-alias-mapping.mdx

Co-authored-by: Meggie <meggie@hashicorp.com>

* Add incorrect policy issue to the docs

* Add example about entity-alias restriction

Co-authored-by: Meggie <meggie@hashicorp.com>

* VAULT-1564 report in-flight requests (#13024)

* VAULT-1564 report in-flight requests

* adding a changelog

* Changing some variable names and fixing comments

* minor style change

* adding unauthenticated support for in-flight-req

* adding documentation for the listener.profiling stanza

* adding an atomic counter for the inflight requests
addressing comments

* addressing comments

* logging completed requests

* fixing a test

* providing log_requests_info as a config option to determine at which level requests should be logged

* removing a member and a method from the StatusHeaderResponseWriter struct

* adding api docks

* revert changes in NewHTTPResponseWriter

* Fix logging invalid log_requests_info value

* Addressing comments

* Fixing a test

* use an tomic value for logRequestsInfo, and moving the CreateClientID function to Core

* fixing go.sum

* minor refactoring

* protecting InFlightRequests from data race

* another try on fixing a data race

* another try to fix a data race

* addressing comments

* fixing couple of tests

* changing log_requests_info to log_requests_level

* minor style change

* fixing a test

* removing the lock in InFlightRequests

* use single-argument form for interface assertion

* adding doc for the new configuration paramter

* adding the new doc to the nav data file

* minor fix

* auth/jwt: Update plugin to v0.11.3 (#13365)

* auth/jwt: Update plugin to v0.11.3

* add changelog

* changelog++

* Update alert banner (#13375)

* Updating website for 1.9.1 (#13378)

* Use os.Hostname instead of a dependency that doesn't work on OpenBSD. (#13389)

* Remove another use gopsutil/host. (#13390)

* CLI changes for new mount tune config parameter allowed_managed_keys (#13255)

* CLI changes for new mount tune config parameter allowed_managed_keys

* Correct allowed_managed_keys description in auth and secrets

* Documentation update for secrets and removed changes for auth

* Add changelog and remove documentation changes for auth

* removed changelog

* Correct the field description

* auth/jwt: update changelog for pkce improvement (#13392)

* Fix test validating convergent encryption behaviour across key types (#13371)

- The test was attempting to test the convergent encryption behaviour
  with several key types but the common function never used the passed
  in key type. So we ran the test with the default aes256-gcm96 only.

* Fix managed namespace test (#13394)

* Fix managed namespace test

* Remove log

* Some changelog tidying for 1.10 preview (#13385)

* Some changelog tidying for 1.10 preview

* PR accounted for by different CL entry

* changelog++

Working on a new workflow for generating the preview so I thought I'd leave a note that it's still coming.

* UI/fix client count partial (#13396)

* Initial fix

* Add fallback zero values

* Add changelog

* Fix client count current test

* Support clearing an identity alias' custom_metadata (#13395)

* Support clearing an identity alias' custom_metadata

Previously, an update to an entity alias supported updating the
custom_metadata as long as the update was not empty, which makes it
impossible to clear the metadata values completely.

Fixes:
- empty custom_metadata parameters are honoured on entity alias update
- update related tests
- drop dependency on mapstructure
- reformat with gofumpt

* Docs: fix invalid link in the kubernetes auth api doc. (#13399)

* Clean up whitespace

* auth/azure: add note about debug env (#13405)

* auth/azure: add note about debug env

* Update azure.mdx

* Update azure.mdx

* Add universal default key_bits value for PKI endpoints (#13080)

* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from #13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Fix logging statement using formatting args (#13407)

* Add docs about path param restrictions (#13413)

* Add docs about path param restrictions

* Update website/content/api-docs/auth/userpass.mdx

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update with review suggestion

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update raftautosnapshots.mdx (#13412)

* Main go version bump (#13408)

* Go 1.17.2 -> 1.17.5
* Switching to cimg

* Bump yarn cache key version so that it uses the new disk layout we've adopted for using cimg/go. (#13420)

* Add vault-api module (#13048)

* crt main fix for ecr tag (#13425)

* Add no-op method setupManagedKeyRegistry(). (#13433)

* github auth: use org id to verify creds (#13332)

* github auth: use org id to verify creds

* add check for required org param; add test case

* update UTs

* add nil check for org

* add changelog

* fix typo in ut

* set org ID if it is unset; add more ut coverage

* add optional organization_id

* move client instantiation

* refactor parse URL; add UT for setting org ID

* fix comment in UT

* add nil check

* don't update org name on change; return warning

* refactor verifyCredentials

* error when unable to fetch org ID on config write; add warnings

* fix bug in log message

* update UT and small refactor

* update comments and log msg

* use getter for org ID

Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>

* UI/chart legend (#13437)

* fixes axes lines blend

* add pixel conversions to variable css file

* reorganizes css file

* adds legend

* fixes scales and makes room for legend

* fixes grid for dual charts

* made grid responsive

* fixes legend styling

* fixes legend, removes ticks and fixes scale

* adjusts tooltip target

* un-comment mouse events

* remove console log

* UI/ Client counts range (running total component) (#13477)

* grid for stacked charts

* pass in data as arg from parent

* pull out vertical bar chart component

* refactor to use vertical bar chart component

* remove any chart handling stuff from parent

* rename variables

* refactor horizontal bar chart into separate component

* move descriptions to inside template (not passed in)

* constructs attribution copy

* add sample response to mirage config

* change indenting

* rename to MonthlyUsage

* change name to running totals

* rename variable

* finishes line chart

* pull constants to util

* cleanup add todos

* fix formatNumbers return"

* comments and cleanup

* adds tooltip to line chart

* make cover area larger

* fixes tooltip styling

* adds tooltip styling"

* adds tooltip modal to horizontal chart

* finishes tooltip for horizontal chart

* remove click event arg

* merges main and fixes conflicts

* bumps yarn.lock

* linting fix

* clean up go files and changelog

* more clean up

* remove changelog

* fix

* update component documentation for jsdocs

* removing test to see if that helps with browserstack

* remove new packages to test dep failure

* add ember-modal-dialog

* add ember-tether

* add ember-tether

* fixes mirage config file - merge conflict issue

* remove general spacing variable

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>
heppu pushed a commit to heppu/vault that referenced this pull request Jan 13, 2022
@cipherboy @heppu
Add universal default key_bits value for PKI endpoints (hashicorp#13080)
c619489 
* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from hashicorp#13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
heppu pushed a commit to heppu/vault that referenced this pull request Jan 13, 2022
@Monkeychip @hellobontempo
@ncabatoff @harsimranmaan @stevendpclark @taoism4504 @zofskeez @mickael-hc @calvn @mikegreen @EnMod @tomhjp @schultz-is @robison @tvoran @pmmukh @mladlow @hghaf099 @fairclothjm @divyapola5 @hashishaw @benashz @jasonodonnell @cipherboy @ml4 @bshreddy @kpenfound @victorr @heppu
UI/client count 1.10 (hashicorp#13574)
aad0b4f 
* UI/total client usage (hashicorp#13359)

* blah

* setup

* clean up

* rename history to dashboard

* clean up

* Styling fixes (hashicorp#13369)

* styling

* clean up

* UI/ horizontal bar chart component (hashicorp#13361)

* horizontal bar chart component

* adds horizontal chart to dashboard file

* add export class

* yarn install d3 array

* yarn install d3 array

* adds data subtext to chart

* update naming to plural charts"

* updates css grid to 6 columns"

* UI/tooltip (hashicorp#13397)

* working state

* stuff

* adds month tick marks and sort of y-axis, but y scale still messed up

* moves y scale so zero shows again

* fixes translating constants

* format numbers y axis

* actually fixes viewbox

* styling for x and y axis plus gridlines

* clean up

* separates grid types based on content

Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>

* Styling and legend component (hashicorp#13430)

* styling

* cleanup

* UI/ Double horizontal bar charts (hashicorp#13398)

* add descriptions and styling to side by side charts

* add border below horizontal charts

* starts legend styling

* center legend

* add to do

* add hover actions/event listeners

* UI/merge main (hashicorp#13436)

* Rename master key to root key (hashicorp#13324)

* See what it looks like to replace "master key" with "root key".  There are two places that would require more challenging code changes: the storage path `core/master`, and its contents (the JSON-serialized EncodedKeyringtructure.)

* Restore accidentally deleted line

* Add changelog

* Update root->recovery

* Fix test

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Fix typo (hashicorp#13355)

* Add kms_library configuration stanza (hashicorp#13352)

- Add the kms_library configuration stanza to Vault's command/server
 - Provide validation of keys and general configuration.
 - Add initial kms_library configuration documentation
 - Attempt at startup to verify we can read the configured HSM Library
 - Hook in KmsLibrary config into the Validate to detect typo/unused keys

* modifed note (hashicorp#13351)

* Incorporate Ember Flight Icons (hashicorp#12976)

* adds ember-flight-icons dependecy

* adds inline-json-import babel plugin

* adds flight icon styling

* updates Icon component to support flight icons

* updates Icon component usages to new api and updates name values to flight icon set when available

* fixes tests

* updates icon story with flight mappings and fixes issue with flight icons not rendering in storybook

* adds changelog

* fixes typo in sign action glyph name in transit-key model

* adds comments to icon-map

* updates Icon component to use only supported flight icon sizes

* adds icon transform codemod

* updates icon transform formatting to handle edge case

* runs icon transform on templates

* updates Icon usage in toolbar-filter md and story

* updates tests

* docs: winsvc update recommendations (hashicorp#13280)

* docs: update custom database sample code (hashicorp#13211)

* clarify more sink options (hashicorp#12586)

* Update @hashicorp/react-hashi-stack-menu (hashicorp#13354)

* Docs to clarify k8s auth options with short-lived tokens (hashicorp#13275)

* Rework 1.21 content into one heading and add note at top
* Add notes about extended k8s token duration
* Add example of ClusterRoleBinding for using client JWTs

* Adds support for SHA-3 to transit (hashicorp#13367)

* Adding support for SHA3 in the transit backend.

* Adds SHA-3 tests for transit sign/verify path. Adds SHA-3 tests for logical system tools path hash functionality. Updates documentation to include SHA-3 algorithms in system tools path hashing.

* Adds changelog entry.

Co-authored-by: robison jacka <robison@packetized.io>

* agent/cache: differentiate open log messages (hashicorp#13362)

Changes the error output for the second open of the persistent cache
file, to differentiate it from the c.UI.Error message for the initial
open of the cache file, just to make it easier to tell where a problem
occurred.

* Warn user supplying nonce values in FIPS mode for transit encryption requests (hashicorp#13366)

* Warn user supplying nonce values in FIPS mode for transit encryption requests

 - Send back a warning within the response if an end-user supplies nonce
   values that we use within the various transit encrypt apis.
 - We do not send a warning if an end-user supplies a nonce value but we
   don't use it.
 - Affected api methods are encrypt, rewrap and datakey
 - The warning is only sent when we are operating in FIPS mode.

* [VAULT-3252] Add entity-alias behavior change to docs (hashicorp#13370)

* Add entity-alias behavior change to docs

* Add upgrade note about entity-alias mapping change

* Rename 1.7-9 upgrade pages, shuffle upgrade note position

* Update website/content/partials/entity-alias-mapping.mdx

Co-authored-by: Meggie <meggie@hashicorp.com>

* Add incorrect policy issue to the docs

* Add example about entity-alias restriction

Co-authored-by: Meggie <meggie@hashicorp.com>

* VAULT-1564 report in-flight requests (hashicorp#13024)

* VAULT-1564 report in-flight requests

* adding a changelog

* Changing some variable names and fixing comments

* minor style change

* adding unauthenticated support for in-flight-req

* adding documentation for the listener.profiling stanza

* adding an atomic counter for the inflight requests
addressing comments

* addressing comments

* logging completed requests

* fixing a test

* providing log_requests_info as a config option to determine at which level requests should be logged

* removing a member and a method from the StatusHeaderResponseWriter struct

* adding api docks

* revert changes in NewHTTPResponseWriter

* Fix logging invalid log_requests_info value

* Addressing comments

* Fixing a test

* use an tomic value for logRequestsInfo, and moving the CreateClientID function to Core

* fixing go.sum

* minor refactoring

* protecting InFlightRequests from data race

* another try on fixing a data race

* another try to fix a data race

* addressing comments

* fixing couple of tests

* changing log_requests_info to log_requests_level

* minor style change

* fixing a test

* removing the lock in InFlightRequests

* use single-argument form for interface assertion

* adding doc for the new configuration paramter

* adding the new doc to the nav data file

* minor fix

* auth/jwt: Update plugin to v0.11.3 (hashicorp#13365)

* auth/jwt: Update plugin to v0.11.3

* add changelog

* changelog++

* Update alert banner (hashicorp#13375)

* Updating website for 1.9.1 (hashicorp#13378)

* Use os.Hostname instead of a dependency that doesn't work on OpenBSD. (hashicorp#13389)

* Remove another use gopsutil/host. (hashicorp#13390)

* CLI changes for new mount tune config parameter allowed_managed_keys (hashicorp#13255)

* CLI changes for new mount tune config parameter allowed_managed_keys

* Correct allowed_managed_keys description in auth and secrets

* Documentation update for secrets and removed changes for auth

* Add changelog and remove documentation changes for auth

* removed changelog

* Correct the field description

* auth/jwt: update changelog for pkce improvement (hashicorp#13392)

* Fix test validating convergent encryption behaviour across key types (hashicorp#13371)

- The test was attempting to test the convergent encryption behaviour
  with several key types but the common function never used the passed
  in key type. So we ran the test with the default aes256-gcm96 only.

* Fix managed namespace test (hashicorp#13394)

* Fix managed namespace test

* Remove log

* Some changelog tidying for 1.10 preview (hashicorp#13385)

* Some changelog tidying for 1.10 preview

* PR accounted for by different CL entry

* changelog++

Working on a new workflow for generating the preview so I thought I'd leave a note that it's still coming.

* UI/fix client count partial (hashicorp#13396)

* Initial fix

* Add fallback zero values

* Add changelog

* Fix client count current test

* Support clearing an identity alias' custom_metadata (hashicorp#13395)

* Support clearing an identity alias' custom_metadata

Previously, an update to an entity alias supported updating the
custom_metadata as long as the update was not empty, which makes it
impossible to clear the metadata values completely.

Fixes:
- empty custom_metadata parameters are honoured on entity alias update
- update related tests
- drop dependency on mapstructure
- reformat with gofumpt

* Docs: fix invalid link in the kubernetes auth api doc. (hashicorp#13399)

* Clean up whitespace

* auth/azure: add note about debug env (hashicorp#13405)

* auth/azure: add note about debug env

* Update azure.mdx

* Update azure.mdx

* Add universal default key_bits value for PKI endpoints (hashicorp#13080)

* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from hashicorp#13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Fix logging statement using formatting args (hashicorp#13407)

* Add docs about path param restrictions (hashicorp#13413)

* Add docs about path param restrictions

* Update website/content/api-docs/auth/userpass.mdx

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update with review suggestion

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update raftautosnapshots.mdx (hashicorp#13412)

* Main go version bump (hashicorp#13408)

* Go 1.17.2 -> 1.17.5
* Switching to cimg

* Bump yarn cache key version so that it uses the new disk layout we've adopted for using cimg/go. (hashicorp#13420)

* Add vault-api module (hashicorp#13048)

* crt main fix for ecr tag (hashicorp#13425)

* Add no-op method setupManagedKeyRegistry(). (hashicorp#13433)

* github auth: use org id to verify creds (hashicorp#13332)

* github auth: use org id to verify creds

* add check for required org param; add test case

* update UTs

* add nil check for org

* add changelog

* fix typo in ut

* set org ID if it is unset; add more ut coverage

* add optional organization_id

* move client instantiation

* refactor parse URL; add UT for setting org ID

* fix comment in UT

* add nil check

* don't update org name on change; return warning

* refactor verifyCredentials

* error when unable to fetch org ID on config write; add warnings

* fix bug in log message

* update UT and small refactor

* update comments and log msg

* use getter for org ID

Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>

* UI/chart legend (hashicorp#13437)

* fixes axes lines blend

* add pixel conversions to variable css file

* reorganizes css file

* adds legend

* fixes scales and makes room for legend

* fixes grid for dual charts

* made grid responsive

* fixes legend styling

* fixes legend, removes ticks and fixes scale

* adjusts tooltip target

* un-comment mouse events

* remove console log

* UI/ Client counts range (running total component) (hashicorp#13477)

* grid for stacked charts

* pass in data as arg from parent

* pull out vertical bar chart component

* refactor to use vertical bar chart component

* remove any chart handling stuff from parent

* rename variables

* refactor horizontal bar chart into separate component

* move descriptions to inside template (not passed in)

* constructs attribution copy

* add sample response to mirage config

* change indenting

* rename to MonthlyUsage

* change name to running totals

* rename variable

* finishes line chart

* pull constants to util

* cleanup add todos

* fix formatNumbers return"

* comments and cleanup

* adds tooltip to line chart

* make cover area larger

* fixes tooltip styling

* adds tooltip styling"

* adds tooltip modal to horizontal chart

* finishes tooltip for horizontal chart

* remove click event arg

* merges main and fixes conflicts

* bumps yarn.lock

* linting fix

* clean up go files and changelog

* more clean up

* remove changelog

* fix

* update component documentation for jsdocs

* removing test to see if that helps with browserstack

* remove new packages to test dep failure

* add ember-modal-dialog

* add ember-tether

* add ember-tether

* fixes mirage config file - merge conflict issue

* remove general spacing variable

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>
joatmon08 pushed a commit that referenced this pull request Jan 25, 2022
@cipherboy @joatmon08
Add universal default key_bits value for PKI endpoints (#13080)
e5f3895 
* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from #13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
joatmon08 pushed a commit that referenced this pull request Jan 25, 2022
@Monkeychip @hellobontempo
@ncabatoff @harsimranmaan @stevendpclark @taoism4504 @zofskeez @mickael-hc @calvn @mikegreen @EnMod @tomhjp @schultz-is @robison @tvoran @pmmukh @mladlow @hghaf099 @fairclothjm @divyapola5 @hashishaw @benashz @jasonodonnell @cipherboy @ml4 @bshreddy @kpenfound @victorr @joatmon08
UI/client count 1.10 (#13574)
0d9b2be 
* UI/total client usage (#13359)

* blah

* setup

* clean up

* rename history to dashboard

* clean up

* Styling fixes (#13369)

* styling

* clean up

* UI/ horizontal bar chart component (#13361)

* horizontal bar chart component

* adds horizontal chart to dashboard file

* add export class

* yarn install d3 array

* yarn install d3 array

* adds data subtext to chart

* update naming to plural charts"

* updates css grid to 6 columns"

* UI/tooltip (#13397)

* working state

* stuff

* adds month tick marks and sort of y-axis, but y scale still messed up

* moves y scale so zero shows again

* fixes translating constants

* format numbers y axis

* actually fixes viewbox

* styling for x and y axis plus gridlines

* clean up

* separates grid types based on content

Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>

* Styling and legend component (#13430)

* styling

* cleanup

* UI/ Double horizontal bar charts (#13398)

* add descriptions and styling to side by side charts

* add border below horizontal charts

* starts legend styling

* center legend

* add to do

* add hover actions/event listeners

* UI/merge main (#13436)

* Rename master key to root key (#13324)

* See what it looks like to replace "master key" with "root key".  There are two places that would require more challenging code changes: the storage path `core/master`, and its contents (the JSON-serialized EncodedKeyringtructure.)

* Restore accidentally deleted line

* Add changelog

* Update root->recovery

* Fix test

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Fix typo (#13355)

* Add kms_library configuration stanza (#13352)

- Add the kms_library configuration stanza to Vault's command/server
 - Provide validation of keys and general configuration.
 - Add initial kms_library configuration documentation
 - Attempt at startup to verify we can read the configured HSM Library
 - Hook in KmsLibrary config into the Validate to detect typo/unused keys

* modifed note (#13351)

* Incorporate Ember Flight Icons (#12976)

* adds ember-flight-icons dependecy

* adds inline-json-import babel plugin

* adds flight icon styling

* updates Icon component to support flight icons

* updates Icon component usages to new api and updates name values to flight icon set when available

* fixes tests

* updates icon story with flight mappings and fixes issue with flight icons not rendering in storybook

* adds changelog

* fixes typo in sign action glyph name in transit-key model

* adds comments to icon-map

* updates Icon component to use only supported flight icon sizes

* adds icon transform codemod

* updates icon transform formatting to handle edge case

* runs icon transform on templates

* updates Icon usage in toolbar-filter md and story

* updates tests

* docs: winsvc update recommendations (#13280)

* docs: update custom database sample code (#13211)

* clarify more sink options (#12586)

* Update @hashicorp/react-hashi-stack-menu (#13354)

* Docs to clarify k8s auth options with short-lived tokens (#13275)

* Rework 1.21 content into one heading and add note at top
* Add notes about extended k8s token duration
* Add example of ClusterRoleBinding for using client JWTs

* Adds support for SHA-3 to transit (#13367)

* Adding support for SHA3 in the transit backend.

* Adds SHA-3 tests for transit sign/verify path. Adds SHA-3 tests for logical system tools path hash functionality. Updates documentation to include SHA-3 algorithms in system tools path hashing.

* Adds changelog entry.

Co-authored-by: robison jacka <robison@packetized.io>

* agent/cache: differentiate open log messages (#13362)

Changes the error output for the second open of the persistent cache
file, to differentiate it from the c.UI.Error message for the initial
open of the cache file, just to make it easier to tell where a problem
occurred.

* Warn user supplying nonce values in FIPS mode for transit encryption requests (#13366)

* Warn user supplying nonce values in FIPS mode for transit encryption requests

 - Send back a warning within the response if an end-user supplies nonce
   values that we use within the various transit encrypt apis.
 - We do not send a warning if an end-user supplies a nonce value but we
   don't use it.
 - Affected api methods are encrypt, rewrap and datakey
 - The warning is only sent when we are operating in FIPS mode.

* [VAULT-3252] Add entity-alias behavior change to docs (#13370)

* Add entity-alias behavior change to docs

* Add upgrade note about entity-alias mapping change

* Rename 1.7-9 upgrade pages, shuffle upgrade note position

* Update website/content/partials/entity-alias-mapping.mdx

Co-authored-by: Meggie <meggie@hashicorp.com>

* Add incorrect policy issue to the docs

* Add example about entity-alias restriction

Co-authored-by: Meggie <meggie@hashicorp.com>

* VAULT-1564 report in-flight requests (#13024)

* VAULT-1564 report in-flight requests

* adding a changelog

* Changing some variable names and fixing comments

* minor style change

* adding unauthenticated support for in-flight-req

* adding documentation for the listener.profiling stanza

* adding an atomic counter for the inflight requests
addressing comments

* addressing comments

* logging completed requests

* fixing a test

* providing log_requests_info as a config option to determine at which level requests should be logged

* removing a member and a method from the StatusHeaderResponseWriter struct

* adding api docks

* revert changes in NewHTTPResponseWriter

* Fix logging invalid log_requests_info value

* Addressing comments

* Fixing a test

* use an tomic value for logRequestsInfo, and moving the CreateClientID function to Core

* fixing go.sum

* minor refactoring

* protecting InFlightRequests from data race

* another try on fixing a data race

* another try to fix a data race

* addressing comments

* fixing couple of tests

* changing log_requests_info to log_requests_level

* minor style change

* fixing a test

* removing the lock in InFlightRequests

* use single-argument form for interface assertion

* adding doc for the new configuration paramter

* adding the new doc to the nav data file

* minor fix

* auth/jwt: Update plugin to v0.11.3 (#13365)

* auth/jwt: Update plugin to v0.11.3

* add changelog

* changelog++

* Update alert banner (#13375)

* Updating website for 1.9.1 (#13378)

* Use os.Hostname instead of a dependency that doesn't work on OpenBSD. (#13389)

* Remove another use gopsutil/host. (#13390)

* CLI changes for new mount tune config parameter allowed_managed_keys (#13255)

* CLI changes for new mount tune config parameter allowed_managed_keys

* Correct allowed_managed_keys description in auth and secrets

* Documentation update for secrets and removed changes for auth

* Add changelog and remove documentation changes for auth

* removed changelog

* Correct the field description

* auth/jwt: update changelog for pkce improvement (#13392)

* Fix test validating convergent encryption behaviour across key types (#13371)

- The test was attempting to test the convergent encryption behaviour
  with several key types but the common function never used the passed
  in key type. So we ran the test with the default aes256-gcm96 only.

* Fix managed namespace test (#13394)

* Fix managed namespace test

* Remove log

* Some changelog tidying for 1.10 preview (#13385)

* Some changelog tidying for 1.10 preview

* PR accounted for by different CL entry

* changelog++

Working on a new workflow for generating the preview so I thought I'd leave a note that it's still coming.

* UI/fix client count partial (#13396)

* Initial fix

* Add fallback zero values

* Add changelog

* Fix client count current test

* Support clearing an identity alias' custom_metadata (#13395)

* Support clearing an identity alias' custom_metadata

Previously, an update to an entity alias supported updating the
custom_metadata as long as the update was not empty, which makes it
impossible to clear the metadata values completely.

Fixes:
- empty custom_metadata parameters are honoured on entity alias update
- update related tests
- drop dependency on mapstructure
- reformat with gofumpt

* Docs: fix invalid link in the kubernetes auth api doc. (#13399)

* Clean up whitespace

* auth/azure: add note about debug env (#13405)

* auth/azure: add note about debug env

* Update azure.mdx

* Update azure.mdx

* Add universal default key_bits value for PKI endpoints (#13080)

* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from #13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Fix logging statement using formatting args (#13407)

* Add docs about path param restrictions (#13413)

* Add docs about path param restrictions

* Update website/content/api-docs/auth/userpass.mdx

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update with review suggestion

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update raftautosnapshots.mdx (#13412)

* Main go version bump (#13408)

* Go 1.17.2 -> 1.17.5
* Switching to cimg

* Bump yarn cache key version so that it uses the new disk layout we've adopted for using cimg/go. (#13420)

* Add vault-api module (#13048)

* crt main fix for ecr tag (#13425)

* Add no-op method setupManagedKeyRegistry(). (#13433)

* github auth: use org id to verify creds (#13332)

* github auth: use org id to verify creds

* add check for required org param; add test case

* update UTs

* add nil check for org

* add changelog

* fix typo in ut

* set org ID if it is unset; add more ut coverage

* add optional organization_id

* move client instantiation

* refactor parse URL; add UT for setting org ID

* fix comment in UT

* add nil check

* don't update org name on change; return warning

* refactor verifyCredentials

* error when unable to fetch org ID on config write; add warnings

* fix bug in log message

* update UT and small refactor

* update comments and log msg

* use getter for org ID

Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>

* UI/chart legend (#13437)

* fixes axes lines blend

* add pixel conversions to variable css file

* reorganizes css file

* adds legend

* fixes scales and makes room for legend

* fixes grid for dual charts

* made grid responsive

* fixes legend styling

* fixes legend, removes ticks and fixes scale

* adjusts tooltip target

* un-comment mouse events

* remove console log

* UI/ Client counts range (running total component) (#13477)

* grid for stacked charts

* pass in data as arg from parent

* pull out vertical bar chart component

* refactor to use vertical bar chart component

* remove any chart handling stuff from parent

* rename variables

* refactor horizontal bar chart into separate component

* move descriptions to inside template (not passed in)

* constructs attribution copy

* add sample response to mirage config

* change indenting

* rename to MonthlyUsage

* change name to running totals

* rename variable

* finishes line chart

* pull constants to util

* cleanup add todos

* fix formatNumbers return"

* comments and cleanup

* adds tooltip to line chart

* make cover area larger

* fixes tooltip styling

* adds tooltip styling"

* adds tooltip modal to horizontal chart

* finishes tooltip for horizontal chart

* remove click event arg

* merges main and fixes conflicts

* bumps yarn.lock

* linting fix

* clean up go files and changelog

* more clean up

* remove changelog

* fix

* update component documentation for jsdocs

* removing test to see if that helps with browserstack

* remove new packages to test dep failure

* add ember-modal-dialog

* add ember-tether

* add ember-tether

* fixes mirage config file - merge conflict issue

* remove general spacing variable

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>
qk4l pushed a commit to qk4l/vault that referenced this pull request Feb 4, 2022
@cipherboy
Add universal default key_bits value for PKI endpoints (hashicorp#13080)
1f71e1f 
* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from hashicorp#13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
qk4l pushed a commit to qk4l/vault that referenced this pull request Feb 4, 2022
@Monkeychip @hellobontempo
@ncabatoff @harsimranmaan @stevendpclark @taoism4504 @zofskeez @mickael-hc @calvn @mikegreen @EnMod @tomhjp @schultz-is @robison @tvoran @pmmukh @mladlow @hghaf099 @fairclothjm @divyapola5 @hashishaw @benashz @jasonodonnell @cipherboy @ml4 @bshreddy @kpenfound @victorr
UI/client count 1.10 (hashicorp#13574)
2af7964 
* UI/total client usage (hashicorp#13359)

* blah

* setup

* clean up

* rename history to dashboard

* clean up

* Styling fixes (hashicorp#13369)

* styling

* clean up

* UI/ horizontal bar chart component (hashicorp#13361)

* horizontal bar chart component

* adds horizontal chart to dashboard file

* add export class

* yarn install d3 array

* yarn install d3 array

* adds data subtext to chart

* update naming to plural charts"

* updates css grid to 6 columns"

* UI/tooltip (hashicorp#13397)

* working state

* stuff

* adds month tick marks and sort of y-axis, but y scale still messed up

* moves y scale so zero shows again

* fixes translating constants

* format numbers y axis

* actually fixes viewbox

* styling for x and y axis plus gridlines

* clean up

* separates grid types based on content

Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>

* Styling and legend component (hashicorp#13430)

* styling

* cleanup

* UI/ Double horizontal bar charts (hashicorp#13398)

* add descriptions and styling to side by side charts

* add border below horizontal charts

* starts legend styling

* center legend

* add to do

* add hover actions/event listeners

* UI/merge main (hashicorp#13436)

* Rename master key to root key (hashicorp#13324)

* See what it looks like to replace "master key" with "root key".  There are two places that would require more challenging code changes: the storage path `core/master`, and its contents (the JSON-serialized EncodedKeyringtructure.)

* Restore accidentally deleted line

* Add changelog

* Update root->recovery

* Fix test

Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>

* Fix typo (hashicorp#13355)

* Add kms_library configuration stanza (hashicorp#13352)

- Add the kms_library configuration stanza to Vault's command/server
 - Provide validation of keys and general configuration.
 - Add initial kms_library configuration documentation
 - Attempt at startup to verify we can read the configured HSM Library
 - Hook in KmsLibrary config into the Validate to detect typo/unused keys

* modifed note (hashicorp#13351)

* Incorporate Ember Flight Icons (hashicorp#12976)

* adds ember-flight-icons dependecy

* adds inline-json-import babel plugin

* adds flight icon styling

* updates Icon component to support flight icons

* updates Icon component usages to new api and updates name values to flight icon set when available

* fixes tests

* updates icon story with flight mappings and fixes issue with flight icons not rendering in storybook

* adds changelog

* fixes typo in sign action glyph name in transit-key model

* adds comments to icon-map

* updates Icon component to use only supported flight icon sizes

* adds icon transform codemod

* updates icon transform formatting to handle edge case

* runs icon transform on templates

* updates Icon usage in toolbar-filter md and story

* updates tests

* docs: winsvc update recommendations (hashicorp#13280)

* docs: update custom database sample code (hashicorp#13211)

* clarify more sink options (hashicorp#12586)

* Update @hashicorp/react-hashi-stack-menu (hashicorp#13354)

* Docs to clarify k8s auth options with short-lived tokens (hashicorp#13275)

* Rework 1.21 content into one heading and add note at top
* Add notes about extended k8s token duration
* Add example of ClusterRoleBinding for using client JWTs

* Adds support for SHA-3 to transit (hashicorp#13367)

* Adding support for SHA3 in the transit backend.

* Adds SHA-3 tests for transit sign/verify path. Adds SHA-3 tests for logical system tools path hash functionality. Updates documentation to include SHA-3 algorithms in system tools path hashing.

* Adds changelog entry.

Co-authored-by: robison jacka <robison@packetized.io>

* agent/cache: differentiate open log messages (hashicorp#13362)

Changes the error output for the second open of the persistent cache
file, to differentiate it from the c.UI.Error message for the initial
open of the cache file, just to make it easier to tell where a problem
occurred.

* Warn user supplying nonce values in FIPS mode for transit encryption requests (hashicorp#13366)

* Warn user supplying nonce values in FIPS mode for transit encryption requests

 - Send back a warning within the response if an end-user supplies nonce
   values that we use within the various transit encrypt apis.
 - We do not send a warning if an end-user supplies a nonce value but we
   don't use it.
 - Affected api methods are encrypt, rewrap and datakey
 - The warning is only sent when we are operating in FIPS mode.

* [VAULT-3252] Add entity-alias behavior change to docs (hashicorp#13370)

* Add entity-alias behavior change to docs

* Add upgrade note about entity-alias mapping change

* Rename 1.7-9 upgrade pages, shuffle upgrade note position

* Update website/content/partials/entity-alias-mapping.mdx

Co-authored-by: Meggie <meggie@hashicorp.com>

* Add incorrect policy issue to the docs

* Add example about entity-alias restriction

Co-authored-by: Meggie <meggie@hashicorp.com>

* VAULT-1564 report in-flight requests (hashicorp#13024)

* VAULT-1564 report in-flight requests

* adding a changelog

* Changing some variable names and fixing comments

* minor style change

* adding unauthenticated support for in-flight-req

* adding documentation for the listener.profiling stanza

* adding an atomic counter for the inflight requests
addressing comments

* addressing comments

* logging completed requests

* fixing a test

* providing log_requests_info as a config option to determine at which level requests should be logged

* removing a member and a method from the StatusHeaderResponseWriter struct

* adding api docks

* revert changes in NewHTTPResponseWriter

* Fix logging invalid log_requests_info value

* Addressing comments

* Fixing a test

* use an tomic value for logRequestsInfo, and moving the CreateClientID function to Core

* fixing go.sum

* minor refactoring

* protecting InFlightRequests from data race

* another try on fixing a data race

* another try to fix a data race

* addressing comments

* fixing couple of tests

* changing log_requests_info to log_requests_level

* minor style change

* fixing a test

* removing the lock in InFlightRequests

* use single-argument form for interface assertion

* adding doc for the new configuration paramter

* adding the new doc to the nav data file

* minor fix

* auth/jwt: Update plugin to v0.11.3 (hashicorp#13365)

* auth/jwt: Update plugin to v0.11.3

* add changelog

* changelog++

* Update alert banner (hashicorp#13375)

* Updating website for 1.9.1 (hashicorp#13378)

* Use os.Hostname instead of a dependency that doesn't work on OpenBSD. (hashicorp#13389)

* Remove another use gopsutil/host. (hashicorp#13390)

* CLI changes for new mount tune config parameter allowed_managed_keys (hashicorp#13255)

* CLI changes for new mount tune config parameter allowed_managed_keys

* Correct allowed_managed_keys description in auth and secrets

* Documentation update for secrets and removed changes for auth

* Add changelog and remove documentation changes for auth

* removed changelog

* Correct the field description

* auth/jwt: update changelog for pkce improvement (hashicorp#13392)

* Fix test validating convergent encryption behaviour across key types (hashicorp#13371)

- The test was attempting to test the convergent encryption behaviour
  with several key types but the common function never used the passed
  in key type. So we ran the test with the default aes256-gcm96 only.

* Fix managed namespace test (hashicorp#13394)

* Fix managed namespace test

* Remove log

* Some changelog tidying for 1.10 preview (hashicorp#13385)

* Some changelog tidying for 1.10 preview

* PR accounted for by different CL entry

* changelog++

Working on a new workflow for generating the preview so I thought I'd leave a note that it's still coming.

* UI/fix client count partial (hashicorp#13396)

* Initial fix

* Add fallback zero values

* Add changelog

* Fix client count current test

* Support clearing an identity alias' custom_metadata (hashicorp#13395)

* Support clearing an identity alias' custom_metadata

Previously, an update to an entity alias supported updating the
custom_metadata as long as the update was not empty, which makes it
impossible to clear the metadata values completely.

Fixes:
- empty custom_metadata parameters are honoured on entity alias update
- update related tests
- drop dependency on mapstructure
- reformat with gofumpt

* Docs: fix invalid link in the kubernetes auth api doc. (hashicorp#13399)

* Clean up whitespace

* auth/azure: add note about debug env (hashicorp#13405)

* auth/azure: add note about debug env

* Update azure.mdx

* Update azure.mdx

* Add universal default key_bits value for PKI endpoints (hashicorp#13080)

* Allow universal default for key_bits

This allows the key_bits field to take a universal default value, 0,
which, depending on key_type, gets adjusted appropriately into a
specific default value (rsa->2048, ec->256, ignored under ed25519).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Handle universal default key size in certutil

Also move RSA < 2048 error message into certutil directly, instead of in
ca_util/path_roles.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add missing RSA key sizes to pki/backend_test.go

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Switch to returning updated values

When determining the default, don't pass in pointer types, but instead
return the newly updated value.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Add changelog entry

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Re-add fix for ed25519 from hashicorp#13254

Ed25519 internally specifies a hash length; by changing the default from
256 to 0, we fail validation in ValidateSignatureLength(...) unless we
specify the key algorithm.

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

* Fix logging statement using formatting args (hashicorp#13407)

* Add docs about path param restrictions (hashicorp#13413)

* Add docs about path param restrictions

* Update website/content/api-docs/auth/userpass.mdx

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update with review suggestion

Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>

* Update raftautosnapshots.mdx (hashicorp#13412)

* Main go version bump (hashicorp#13408)

* Go 1.17.2 -> 1.17.5
* Switching to cimg

* Bump yarn cache key version so that it uses the new disk layout we've adopted for using cimg/go. (hashicorp#13420)

* Add vault-api module (hashicorp#13048)

* crt main fix for ecr tag (hashicorp#13425)

* Add no-op method setupManagedKeyRegistry(). (hashicorp#13433)

* github auth: use org id to verify creds (hashicorp#13332)

* github auth: use org id to verify creds

* add check for required org param; add test case

* update UTs

* add nil check for org

* add changelog

* fix typo in ut

* set org ID if it is unset; add more ut coverage

* add optional organization_id

* move client instantiation

* refactor parse URL; add UT for setting org ID

* fix comment in UT

* add nil check

* don't update org name on change; return warning

* refactor verifyCredentials

* error when unable to fetch org ID on config write; add warnings

* fix bug in log message

* update UT and small refactor

* update comments and log msg

* use getter for org ID

Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>

* UI/chart legend (hashicorp#13437)

* fixes axes lines blend

* add pixel conversions to variable css file

* reorganizes css file

* adds legend

* fixes scales and makes room for legend

* fixes grid for dual charts

* made grid responsive

* fixes legend styling

* fixes legend, removes ticks and fixes scale

* adjusts tooltip target

* un-comment mouse events

* remove console log

* UI/ Client counts range (running total component) (hashicorp#13477)

* grid for stacked charts

* pass in data as arg from parent

* pull out vertical bar chart component

* refactor to use vertical bar chart component

* remove any chart handling stuff from parent

* rename variables

* refactor horizontal bar chart into separate component

* move descriptions to inside template (not passed in)

* constructs attribution copy

* add sample response to mirage config

* change indenting

* rename to MonthlyUsage

* change name to running totals

* rename variable

* finishes line chart

* pull constants to util

* cleanup add todos

* fix formatNumbers return"

* comments and cleanup

* adds tooltip to line chart

* make cover area larger

* fixes tooltip styling

* adds tooltip styling"

* adds tooltip modal to horizontal chart

* finishes tooltip for horizontal chart

* remove click event arg

* merges main and fixes conflicts

* bumps yarn.lock

* linting fix

* clean up go files and changelog

* more clean up

* remove changelog

* fix

* update component documentation for jsdocs

* removing test to see if that helps with browserstack

* remove new packages to test dep failure

* add ember-modal-dialog

* add ember-tether

* add ember-tether

* fixes mirage config file - merge conflict issue

* remove general spacing variable

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
Co-authored-by: Claire Bontempo <cbontempo@hashicorp.com>
Co-authored-by: Jim Kalafut <jkalafut@hashicorp.com>
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
Co-authored-by: Harsimran Singh Maan <maan.harry@gmail.com>
Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com>
Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
Co-authored-by: mickael-hc <86245626+mickael-hc@users.noreply.github.com>
Co-authored-by: Calvin Leung Huang <1883212+calvn@users.noreply.github.com>
Co-authored-by: Mike Green <772413+mikegreen@users.noreply.github.com>
Co-authored-by: Noel Quiles <3746694+EnMod@users.noreply.github.com>
Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
Co-authored-by: Matt Schultz <975680+schultz-is@users.noreply.github.com>
Co-authored-by: robison jacka <robison@packetized.io>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Co-authored-by: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Co-authored-by: Meggie <meggie@hashicorp.com>
Co-authored-by: hghaf099 <83242695+hghaf099@users.noreply.github.com>
Co-authored-by: John-Michael Faircloth <fairclothjm@users.noreply.github.com>
Co-authored-by: Brandon Romano <brandon@hashicorp.com>
Co-authored-by: divyapola5 <87338962+divyapola5@users.noreply.github.com>
Co-authored-by: Chelsea Shaw <82459713+hashishaw@users.noreply.github.com>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
Co-authored-by: Mark Lewis <56076038+ml4@users.noreply.github.com>
Co-authored-by: Sai Hemanth Bheemreddy <35338241+SaiHemanthBR@users.noreply.github.com>
Co-authored-by: Kyle Penfound <kpenfound11@gmail.com>
Co-authored-by: Victor Rodriguez <vrizo@hashicorp.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@stevendpclark stevendpclark stevendpclark left review comments

@sgmiller sgmiller sgmiller approved these changes

@divyapola5 divyapola5 Awaiting requested review from divyapola5

@schultz-is schultz-is Awaiting requested review from schultz-is

@victorr victorr Awaiting requested review from victorr

@rculpepper rculpepper Awaiting requested review from rculpepper

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@cipherboy @sgmiller @stevendpclark