New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conditionally overwrite TLS parameters for MySQL secrets engine #9729
Conversation
Overwrite MySQL TLS configuration in MySQL DSN only if have `tls_ca` or `tls_certificate_key` set Current logic always overwrites it
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
* master: Add a section to the MySQL secrets plugin docs about x509 (#9757) Update documentation for MySQL Secrets Engine (#9671) Conditionally overwrite TLS parameters for MySQL secrets engine (#9729) Correctly mark Cassandra as not supporting static roles (#9750) changelog++ pki: Allow to use not only one variable during templating in allowed_domains #8509 (#9498) agent/templates: update consul-template to v0.25.1 (#9626) Restoring the example policies for blocking sha1 (#9677) changelog++ changelog++ Document the new SSH signing algorithm option. (#9197) CHANGELOG-+ CHANGELOG++ Trail of bits 018 (#9674)
Would it be possible to know, when this change will be in a public release? |
My sincerest apologies. It looks like this was slated for an earlier release but the backport got bungled and didn't make it into the release. |
We'll be releasing it as part of the 1.5.5 release which should be in the next couple weeks. Once again, apologies that this wasn't released sooner. |
* Conditionally overwrite TLS parameters in MySQL DSN Overwrite MySQL TLS configuration in MySQL DSN only if have `tls_ca` or `tls_certificate_key` set Current logic always overwrites it * Add test for MySQL DSN with a valid TLS parameter in query string
… (#10073) * Conditionally overwrite TLS parameters in MySQL DSN Overwrite MySQL TLS configuration in MySQL DSN only if have `tls_ca` or `tls_certificate_key` set Current logic always overwrites it * Add test for MySQL DSN with a valid TLS parameter in query string Co-authored-by: arnis <8789226+0x63lv@users.noreply.github.com>
Changes to how connections to MySQL secrets engine are set up, which were introduced with #9181 and released with Vault 1.5.0, broke a working setup in Vault versions prior to 1.5.0, where a valid TLS parameter was set in MySQL DSN (e.g.
...?tls=true
).If none of the new parameters introduced with 1.5.0 (
tls_ca
ortls_certificate_key
) would be set, the TLS configuration would be empty, and it would be written over the existing TLS parameters in the DSN (e.g.tls=true
), resulting in a non-TLS connection attempt to MySQL.This PR would change that behaviour, and only overwrite the TLS parameters in the DSN, if at least one of the
tls_ca
ortls_certificate_key
parameters are set. Otherwise it would leave the TLS configuration set in DSN as-is.Tests also updated with this case.