« Changelog History


Vault v1.9.0 Release Notes

  • November 17, 2021

    🔄 CHANGES:

    • auth/kubernetes: disable_iss_validation defaults to true. #127 [GH-12975]
    • expiration: VAULT_16_REVOKE_PERMITPOOL environment variable has been removed. [GH-12888]
    • expiration: VAULT_LEASE_USE_LEGACY_REVOCATION_STRATEGY environment variable has 🚚 been removed. [GH-12888]
    • ⚡️ go: Update go version to 1.17.2
    • secrets/ssh: Roles with empty allowed_extensions will now forbid end-users ⚡️ specifying extensions when requesting ssh key signing. Update roles setting allowed_extensions to * to permit any extension to be specified by an end-user. [GH-12847]

    🔋 FEATURES:

    • Customizable HTTP Headers: Add support to define custom HTTP headers for root path (/) and also on API endpoints (/v1/*) [GH-12485]
    • 🌲 Deduplicate Token With Entities in Activity Log: Vault tokens without entities are now tracked with client IDs and deduplicated in the Activity Log [GH-12820]
    • 💻 Elasticsearch Database UI: The UI now supports adding and editing Elasticsearch connections in the database secret engine. [GH-12672]
    • 📇 KV Custom Metadata: Add ability in kv-v2 to specify version-agnostic custom key metadata via the 📇 metadata endpoint. The data will be present in responses made to the data endpoint independent of the 📇 calling token's read access to the metadata endpoint. [GH-12907]
    • KV patch (Tech Preview): Add partial update support for the /<mount>/data/:path kv-v2 endpoint through HTTP PATCH. A new patch ACL capability has been added and is required to make such requests. [GH-12687]
    • Key Management Secrets Engine (Enterprise): Adds support for distributing and managing keys in GCP Cloud KMS.
    • Local Auth Mount Entities (enterprise): Logins on local auth mounts will generate identity entities for the tokens issued. The aliases of the entity resulting from local auth mounts (local-aliases), will be scoped by the cluster. This means that the local-aliases will never leave the geographical boundary of the cluster where they were issued. This is something to be mindful about for those who have implemented local auth mounts for complying with GDPR guidelines.
    • Namespaces (Enterprise): Adds support for locking Vault API for particular namespaces.
    • OIDC Identity Provider (Tech Preview): Adds support for Vault to be an OpenID Connect (OIDC) provider. [GH-12932]
    • 💻 Oracle Database UI: The UI now supports adding and editing Oracle connections in the database secret engine. [GH-12752]
    • 💻 Postgres Database UI: The UI now supports adding and editing Postgres connections in the database secret engine. [GH-12945]

    🔒 SECURITY:

    • 🔀 core/identity: A Vault user with write permission to an entity alias ID sharing a mount accessor with another user may acquire this other user’s policies by merging their identities. This vulnerability, CVE-2021-41802, was fixed in Vault and Vault Enterprise 1.7.5, 1.8.4, and 1.9.0.
    • 🛠 core/identity: Templated ACL policies would always match the first-created entity alias if multiple entity aliases existed for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. This vulnerability, CVE-2021-43998, was fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

    👌 IMPROVEMENTS:

    • ⏪ agent/cache: Process persistent cache leases in dependency order during restore to ensure child leases are always correctly restored [GH-12843]
    • agent/cache: Use an in-process listener between consul-template and vault-agent when caching is enabled and either templates or a listener is defined [GH-12762]
    • ⏪ agent/cache: tolerate partial restore failure from persistent cache [GH-12718]
    • 👍 agent/template: add support for new 'writeToFile' template function [GH-12505]
    • 🔧 api: Add configuration option for ensuring isolated read-after-write semantics for all Client requests. [GH-12814]
    • 👍 api: adds native Login method to Go client module with different auth method interfaces to support easier authentication [GH-12796]
    • 🔀 api: Move mergeStates and other required utils from agent to api module [GH-12731]
    • api: Support VAULT_HTTP_PROXY environment variable to allow overriding the Vault client's HTTP proxy [GH-12582]
    • auth/approle: The role/:name/secret-id-accessor/lookup endpoint now returns a 404 status code when the secret_id_accessor cannot be found [GH-12788]
    • auth/approle: expose secret_id_accessor as WrappedAccessor when creating wrapped secret-id. [GH-12425]
    • 👍 auth/aws: add profile support for AWS credentials when using the AWS auth method [GH-12621]
    • auth/kubernetes: validate JWT against the provided role on alias look ahead operations [GH-12688]
    • 🔧 auth/kubernetes: Add ability to configure entity alias names based on the serviceaccount's namespace and name. #110 #112 [GH-12633]
    • 👍 auth/ldap: include support for an optional user filter field when searching for users [GH-11000]
    • 0️⃣ auth/oidc: Adds the skip_browser CLI option to allow users to skip opening the default browser during the authentication flow. [GH-12876]
    • auth/okta: Send x-forwarded-for in Okta Push Factor request [GH-12320]
    • auth/token: Add allowed_policies_glob and disallowed_policies_glob fields to token roles to allow glob matching of policies [GH-7277]
    • 🔧 cli: Operator diagnose now tests for missing or partial telemetry configurations. [GH-12802]
    • cli: add new http option : -header which enable sending arbitrary headers with the cli [GH-12508]
    • command: operator generate-root -decode: allow passing encoded token via stdin [GH-12881]
    • core/token: Return the token_no_default_policy config on token role read if set [GH-12565]
    • 👍 core: Add support for go-sockaddr templated addresses in config. [GH-9109]
    • 📇 core: adds custom_metadata field for aliases [GH-12502]
    • ⚡️ core: Update Oracle Cloud library to enable seal integration with the uk-gov-london-1 region [GH-12724]
    • ⚡️ core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27. [GH-12253]
    • ⬆️ core: Upgrade github.com/gogo/protobuf [GH-12255]
    • 🏗 core: build with Go 1.17, and mitigate a breaking change they made that could impact how approle and ssh interpret IPs/CIDRs [GH-12868]
    • core: observe the client counts broken down by namespace for partial month client count [GH-12393]
    • 🚀 core: Artifact builds will now only run on merges to the release branches or to main
    • 🚀 core: The dockerfile that is used to build the vault docker image available at hashicorp/vault now lives in the root of this repo, and the entrypoint is available under .release/docker/docker-entrypoint.sh
    • 🚀 core: The vault linux packaging service configs and pre/post install scripts are now available under .release/linux
    • 🐧 core: Vault linux packages are now available for all supported linux architectures including arm, arm64, 386, and amd64
    • db/cassandra: make the connect_timeout config option actually apply to connection timeouts, in addition to non-connection operations [GH-12903]
    • identity/token: Only return keys from the .well-known/keys endpoint that are being used by roles to sign/verify tokens. [GH-12780]
    • identity: fix issue where Cache-Control header causes stampede of requests for JWKS keys [GH-12414]
    • ⬆️ physical/etcd: Upgrade etcd3 client to v3.5.0 and etcd2 to v2.305.0. [GH-11980]
    • pki: adds signature_bits field to customize signature algorithm on CAs and certs signed by Vault [GH-11245]
    • 🔌 plugin: update the couchbase gocb version in the couchbase plugin [GH-12483]
    • replication (enterprise): Add merkle.flushDirty.num_pages_outstanding metric which specifies number of outstanding dirty pages that were not flushed. [GH-2093]
    • 👍 sdk/framework: The '+' wildcard is now supported for parameterizing unauthenticated paths. [GH-12668]
    • secrets/aws: Add conditional template that allows custom usernames for both STS and IAM cases [GH-12185]
    • 🔌 secrets/azure: Adds support for rotate-root. #70 [GH-13034]
    • 🚚 secrets/azure: Adds support for using Microsoft Graph API since Azure Active Directory API is being removed in 2022. #67 [GH-12629]
    • ⚡️ secrets/database: Update MSSQL dependency github.com/denisenkom/go-mssqldb to v0.11.0 and include support for contained databases in MSSQL plugin [GH-12839]
    • secrets/pki: Allow signing of self-issued certs with a different signature algorithm. [GH-12514]
    • secrets/pki: Use entropy augmentation when available when generating root and intermediate CA key material. [GH-12559]
    • secrets/pki: select appropriate signature algorithm for ECDSA signature on certificates. [GH-11216]
    • 👍 secrets/pki: Support ed25519 as a key for the pki backend [GH-11780]
    • ⚡️ secrets/rabbitmq: Update dependency github.com/michaelklishin/rabbit-hole to v2 and resolve UserInfo.tags regression from RabbitMQ v3.9 [GH-12877]
    • secrets/ssh: Let allowed_users template mix templated and non-templated parts. [GH-10886]
    • secrets/ssh: Use entropy augmentation when available for generation of the signing key. [GH-12560]
    • 📇 serviceregistration: add external-source: "vault" metadata value for Consul registration. [GH-12163]
    • storage/raft: Best-effort handling of cancelled contexts. [GH-12162]
    • transform (enterprise): Add advanced features for encoding and decoding for Transform FPE
    • transform (enterprise): Add a reference field to batch items, and propogate it to the response
    • 📇 ui: Add KV secret search box when no metadata list access. [GH-12626]
    • 📇 ui: Add custom metadata to KV secret engine and metadata to config [GH-12169]
    • 💻 ui: Creates new StatText component [GH-12295]
    • 💻 ui: client count monthly view [GH-12554]
    • 💻 ui: creates bar chart component for displaying client count data by namespace [GH-12437]
    • 💻 ui: Add creation time to KV 2 version history and version view [GH-12663]
    • 💻 ui: Added resize for JSON editor [GH-12906] [GH-12906]
    • ⚠ ui: Adds warning about white space in KV secret engine. [GH-12921]
    • 💻 ui: Click to copy database static role last rotation value in tooltip [GH-12890]
    • 💻 ui: Filter DB connection attributes so only relevant attrs POST to backend [GH-12770]
    • 🚚 ui: Removes empty rows from DB config views [GH-12819]
    • 💻 ui: Standardizes toolbar presentation of destructive actions [GH-12895]
    • ⚡️ ui: Updates font for table row value fields [GH-12908]
    • 💻 ui: namespace search in client count views [GH-12577]
    • 📇 ui: parse and display pki cert metadata [GH-12541]
    • 🏗 ui: replaces Vault's use of elazarl/go-bindata-assetfs in building the UI with Go's native Embed package [GH-11208]
    • ⚡️ ui: updated client tracking config view [GH-12422]

    🗄 DEPRECATIONS:

    • auth/kubernetes: deprecate disable_iss_validation and issuer configuration fields #127 [GH-12975]

    🐛 BUG FIXES:

    • 🌲 activity log (enterprise): allow partial monthly client count to be accessed from namespaces [GH-13086]
    • agent: Avoid possible unexpected fault address panic when using persistent cache. [GH-12534]
    • 📜 api: Fixes storage APIs returning incorrect error when parsing responses [GH-12338]
    • auth/aws: Fix ec2 auth on instances that have a cert in their PKCS7 signature [GH-12519]
    • 🛠 auth/aws: Fixes ec2 login no longer supporting DSA signature verification [GH-12340]
    • auth/aws: fix config/rotate-root to store new key [GH-12715]
    • auth/jwt: Fixes OIDC auth from the Vault UI when using form_post as the oidc_response_mode. [GH-12265]
    • cli/api: Providing consistency for the use of comma separated parameters in auth/secret enable/tune [GH-12126]
    • 🛠 cli: fixes CLI requests when namespace is both provided as argument and part of the path [GH-12720]
    • 🛠 cli: fixes CLI requests when namespace is both provided as argument and part of the path [GH-12911]
    • 🌲 cli: vault debug now puts newlines after every captured log line. [GH-12175]
    • core (enterprise): Allow deletion of stored licenses on DR secondary nodes
    • core (enterprise): Disallow autogenerated licenses to be used in diagnose even when config is specified
    • 🔌 core (enterprise): Fix bug where password generation through password policies do not work on namespaces if performed outside a request callback or from an external plugin. [GH-12635]
    • core (enterprise): Fix data race during perf standby sealing
    • 🐎 core (enterprise): Fixes reading raft auto-snapshot configuration from performance standby node [GH-12317]
    • core (enterprise): Only delete quotas on primary cluster. [GH-12339]
    • core (enterprise): namespace header included in responses, Go client uses it when displaying error messages [GH-12196]
    • core/api: Fix an arm64 bug converting a negative int to an unsigned int [GH-12372]
    • ⚡️ core/identity: Address a data race condition between local updates to aliases and invalidations [GH-13093]
    • core/identity: Cleanup alias in the in-memory entity after an alias deletion by ID [GH-12834]
    • ⚡️ core/identity: Disallow entity alias creation/update if a conflicting alias exists for the target entity and mount combination [GH-12747]
    • core: Fix a deadlock on HA leadership transfer [GH-12691]
    • ⚠ core: Fix warnings logged on perf standbys re stored versions [GH-13042]
    • 🖨 core: fix byte printing for diagnose disk checks [GH-12229]
    • ⬇️ core: revert some unintentionally downgraded dependencies from 1.9.0-rc1 [GH-13168]
    • 0️⃣ database/couchbase: change default template to truncate username at 128 characters [GH-12301]
    • ⚡️ database/postgres: Update postgres library (github.com/lib/pq) to properly remove terminated TLS connections from the connection pool. [GH-12413]
    • http (enterprise): Always forward internal/counters endpoints from perf standbys to active node
    • 📚 http: removed unpublished true from logical_system path, making openapi spec consistent with documentation [GH-12713]
    • identity/token: Adds missing call to unlock mutex in key deletion error handling [GH-12916]
    • identity: Fail alias rename if the resulting (name,accessor) exists already [GH-12473]
    • identity: Fix a panic on arm64 platform when doing identity I/O. [GH-12371]
    • identity: Fix regression preventing startup when aliases were created pre-1.9. [GH-13169]
    • identity: dedup from_entity_ids when merging two entities [GH-10101]
    • identity: disallow creation of role without a key parameter [GH-12208]
    • identity: do not allow a role's token_ttl to be longer than the signing key's verification_ttl [GH-12151]
    • 🔀 identity: merge associated entity groups when merging entities [GH-10085]
    • identity: suppress duplicate policies on entities [GH-12812]
    • kmip (enterprise): Fix handling of custom attributes when servicing GetAttributes requests
    • kmip (enterprise): Fix handling of invalid role parameters within various vault api calls
    • kmip (enterprise): Forward KMIP register operations to the active node
    • license: ignore stored terminated license while autoloading is enabled [GH-2104]
    • 🏗 licensing (enterprise): Revert accidental inclusion of the TDE feature from the prem build.
    • 🏁 physical/raft: Fix safeio.Rename error when restoring snapshots on windows [GH-12377]
    • pki: Fix regression preventing email addresses being used as a common name within certificates [GH-12716]
    • 🔌 plugin/couchbase: Fix an issue in which the locking patterns did not allow parallel requests. [GH-13033]
    • 🔌 plugin/snowflake: Fixed bug where plugin would crash on 32 bit systems [GH-12378]
    • ⚡️ raft (enterprise): Fix panic when updating auto-snapshot config
    • replication (enterprise): Fix issue where merkle.flushDirty.num_pages metric is not emitted if number of dirty pages is 0. [GH-2093]
    • replication (enterprise): Fix merkle.saveCheckpoint.num_dirty metric to accurately specify the number of dirty pages in the merkle tree at time of checkpoint creation. [GH-2093]
    • sdk/database: Fix a DeleteUser error message on the gRPC client. [GH-12351]
    • secrets/db: Fix bug where Vault can rotate static role passwords early during start up under certain conditions. [GH-12563]
    • ⏪ secrets/gcp: Fixes a potential panic in the service account policy rollback for rolesets. [GH-12379]
    • 👍 secrets/keymgmt (enterprise): Fix support for Azure Managed HSM Key Vault instances. [GH-12934]
    • 🔌 secrets/openldap: Fix bug where Vault can rotate static role passwords early during start up under certain conditions. #28 [GH-12600]
    • secrets/transit: Enforce minimum cache size for transit backend and init cache size on transit backend without restart. [GH-12418]
    • ⚡️ storage/postgres: Update postgres library (github.com/lib/pq) to properly remove terminated TLS connections from the connection pool. [GH-12413]
    • storage/raft (enterprise): Ensure that raft autosnapshot backoff retry duration never hits 0s
    • storage/raft: Detect incomplete raft snapshots in api.RaftSnapshot(), and thereby in vault operator raft snapshot save. [GH-12388]
    • 🔊 storage/raft: Fix regression in 1.9.0-rc1 that changed how time is represented in Raft logs; this prevented using a raft db created pre-1.9. [GH-13165]
    • storage/raft: Support addr_type=public_v6 in auto-join [GH-12366]
    • transform (enterprise): Enforce minimum cache size for Transform backend and reset cache size without a restart
    • transform (enterprise): Fix an error where the decode response of an expired token is an empty result rather than an error.
    • 💻 ui: Adds pagination to auth methods list view [GH-13054]
    • 💻 ui: Fix bug where capabilities check on secret-delete-menu was encoding the forward slashes. [GH-12550]
    • 0️⃣ ui: Fix bug where edit role form on auth method is invalid by default [GH-12646]
    • 💻 ui: Fixed api explorer routing bug [GH-12354]
    • 💻 ui: Fixed text overflow in flash messages [GH-12357]
    • 💻 ui: Fixes issue with the number of PGP Key inputs not matching the key shares number in the initialization form on change [GH-13038]
    • 💻 ui: Fixes metrics page when read on counter config not allowed [GH-12348]
    • 🚚 ui: Remove spinner after token renew [GH-12887]
    • 🚚 ui: Removes ability to tune token_type for token auth methods [GH-12904]
    • ⚠ ui: Show day of month instead of day of year in the expiration warning dialog [GH-11984]
    • 💻 ui: fix issue where on MaskedInput on auth methods if tab it would clear the value. [GH-12409]
    • 💻 ui: fix missing navbar items on login to namespace [GH-12478]
    • ⚡️ ui: update bar chart when model changes [GH-12622]
    • ⚡️ ui: updating database TTL picker help text. [GH-12212]