diff --git a/changelog/10708.txt b/changelog/10708.txt new file mode 100644 index 000000000000..ac6813710cc8 --- /dev/null +++ b/changelog/10708.txt @@ -0,0 +1,3 @@ +```release-note:bug + metrics: Protect emitMetrics from panicking during post-seal + ``` diff --git a/vault/core_metrics.go b/vault/core_metrics.go index 10e42ddffce4..292fedab457c 100644 --- a/vault/core_metrics.go +++ b/vault/core_metrics.go @@ -242,6 +242,13 @@ func (c *Core) findKvMounts() []*kvMount { c.mountsLock.RLock() defer c.mountsLock.RUnlock() + // emitMetrics doesn't grab the statelock, so this code might run during or after the seal process. + // Therefore, we need to check if c.mounts is nil. If we do not, emitMetrics will panic if this is + // run after seal. + if c.mounts == nil { + return mounts + } + for _, entry := range c.mounts.Entries { if entry.Type == "kv" { version, ok := entry.Options["version"]