Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support reloading database plugins across multiple mounts #24512

Merged
merged 5 commits into from
Jan 8, 2024

Conversation

tomhjp
Copy link
Contributor

@tomhjp tomhjp commented Dec 13, 2023

This builds on #24472 to support reloading database plugins across multiple mounts. The next stage will be to implement a new root-namespace-only endpoint that allows reloading plugins across multiple namespaces, which will leverage the same function but with some updates. At that point, admins in the root namespace will have everything they need to ensure they can reload all instances of a plugin they've just updated in the plugin catalog without having to enumerate all mounts and namespaces.

This also adds a warning to the response if a reload request ever succeeds but without actually reloading a plugin, for example because the plugin wasn't in use, or if the plugin doesn't even exist in the catalog. We report number of reloads instead of explicitly telling users about whether or not the plugin exists to avoid (admittedly fairly low stakes) enumeration attacks on the contents of the catalog.

@tomhjp tomhjp added this to the 1.16.0-rc1 milestone Dec 13, 2023
@github-actions github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Dec 13, 2023
Copy link

Build Results:
All builds succeeded! ✅

Copy link

github-actions bot commented Dec 13, 2023

CI Results:
All Go tests succeeded! ✅

@tomhjp tomhjp force-pushed the vault-21610/reload-database-plugins-from-backend-api branch from aaaf517 to 87e0336 Compare January 3, 2024 13:00
@tomhjp tomhjp force-pushed the vault-21610/reload-database-plugins-from-backend-api branch from 87e0336 to 0a70e8c Compare January 5, 2024 12:58
@tomhjp tomhjp requested a review from a team as a code owner January 5, 2024 12:58
@tomhjp tomhjp requested review from tvoran and kschoche January 5, 2024 15:51
vault/plugin_reload.go Outdated Show resolved Hide resolved
vault/plugin_reload.go Outdated Show resolved Hide resolved
vault/plugin_reload.go Outdated Show resolved Hide resolved
Copy link
Member

@austingebauer austingebauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@tomhjp
Copy link
Contributor Author

tomhjp commented Jan 8, 2024

Note: With the latest commit, I also removed the typeExists check, as I realised it's possible for a plugin to be deleted from the catalog while it's still mounted (separately, it would be nice to fix this, but local-only mounts complicate the solution somewhat). The reload will fail in that case, but I think that's the appropriate result to surface for what is an invalid state for the Vault cluster.

@tomhjp tomhjp merged commit 6e537bb into main Jan 8, 2024
109 checks passed
@tomhjp tomhjp deleted the vault-21610/reload-database-plugins-from-backend-api branch January 8, 2024 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
core/plugin hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants