Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of Add notes on the PKI cert generation forwarding regression into stable-website #13817

Merged
merged 5 commits into from
Jan 27, 2022
Merged

Backport of Add notes on the PKI cert generation forwarding regression into stable-website #13817

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4575e08
backport of commit 7e9856550995608342aa5e0fb2fe305bc8ad20e6
sgmiller Jan 27, 2022
c89fa4d
backport of commit 0cf56fd160dac8934226aaad384eca49829c70a4
sgmiller Jan 27, 2022
5e13322
backport of commit bf9735dd4806a97cdb1bf2e3ea1daa6cce0e24fc
sgmiller Jan 27, 2022
001548e
backport of commit b86ba9a75b82a95218aff968609371d4f89d46e3
sgmiller Jan 27, 2022
295f21e
backport of commit 3418b2fbe55460ad05044cc548c82651af77745a
sgmiller Jan 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions website/content/docs/upgrading/upgrade-to-1.8.x.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ Notes](https://golang.org/doc/go1.16) for full details. Of particular note:

@include 'entity-alias-mapping.mdx'

@include 'pki-forwarding-bug.mdx'
## Known Issues

- MSSQL integrations (storage and secrets engine) will crash with a "panic: not implemented" error
Expand Down
2 changes: 2 additions & 0 deletions website/content/docs/upgrading/upgrade-to-1.9.x.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,8 @@ respects the order of suites given in `tls_cipher_suites`.

See [this blog post](https://go.dev/blog/tls-cipher-suites) for more information.

@include 'pki-forwarding-bug.mdx'

## Known Issues

### Identity Token Backend Key Rotations
Expand Down
10 changes: 10 additions & 0 deletions website/content/partials/pki-forwarding-bug.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
## PKI Certificate Generation Forwarding Regression

A bug introduced in Vault 1.8 causes certificate generation requests to the PKI secrets engine made on a performance
secondary node to be forwarded to the cluster's primary node. The resulting certificates are stored on the primary node,
and thus visible to list and read certificate requests only on the primary node rather than the secondary node as
intended. Furthermore, if a certificate is subsequently revoked on a performance secondary node, the secondary's
certificate revocation list is updated, rather than the primary's where the certificate is stored. This bug is fixed
in Vault 1.8.8 and 1.9.3.
Certificates issued after the fix are correctly stored locally to the performance secondary.