Слияние кода завершено, страница обновится автоматически
SECURITY:
IMPROVEMENTS:
BUG FIXES:
max_lease_ttl tune value for tokens created via auth/token/create. [GH-28498]SECURITY:
valid_principals to contain a value or default_user be set by default to guard against potentially insecure configurations. allow_empty_principals can be used for backwards compatibility [HCSEC-2024-20](https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/7025
CHANGES:
allow_empty_principals to allow keys or certs to apply to any user/principal. [GH-28466]BUG FIXES:
CHANGES:
IMPROVEMENTS:
/sys/internal/counters/activity will now include a warning if the specified usage period contains estimated client counts. [GH-28068]vault operator usage will now include a warning if the specified usage period contains estimated client counts. [GH-28068]BUG FIXES:
vault secrets move and vault auth move command will no longer attempt to write to storage on performance standby nodes. [GH-28059]CHANGES:
IMPROVEMENTS:
BUG FIXES:
sys/internal/ui/mounts for a mount prefixed by a namespace path when path filters are configured. [GH-27939]CHANGES:
aud claims were validated.BUG FIXES:
proxy_protocol_behavior with deny_unauthorized,
which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection. [GH-27589]BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
IMPROVEMENTS:
BUG FIXES:
/sys/config/auditing)
will now force invalidation and be reloaded from storage when data is replicated
to other nodes.SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
deletion_allowed param to transformations and include tokenization as a type option [GH-25436]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
code_challenge_methods_supported to OpenID Connect Metadata [GH-24979]BUG FIXES:
{ [GH-24513]SECURITY:
CHANGES:
/identity/entity/merge endpoint
are now always forwarded from standbys to the active node. [GH-24325]BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
log_requests_level. [GH-24059]SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
detect_deadlocks. [GH-23902]CHANGES:
IMPROVEMENTS:
tls-server-name arg for plugin registration [GH-23549]authenticate_from_environment variable to "true" and "false" string literals, too. [GH-22996]BUG FIXES:
SECURITY:
CHANGES:
data_path will include full data path of secret, including name. [GH-22487]EventSender interface method is now SendEvent instead of Send. [GH-22487]vault.rollback.attempt.{MOUNT_POINT} and vault.route.rollback.{MOUNT_POINT} metrics with vault.rollback.attempt and vault.route.rollback metrics by default. Added a telemetry configuration add_mount_point_rollback_metrics which, when set to true, causes vault to emit the metrics with mount points in their names. [GH-22400]FEATURES:
IMPROVEMENTS:
use_sts_region_from_client which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication. [GH-21960]-dev-tls-san flag to configure subject alternative names for the certificate generated when using -dev-tls. [GH-22657]vault.policy.configured.count. [GH-21010]-output-policy recognition of some non-standard sudo paths [GH-21772]sys/raw/ and sys/leases/lookup/ to match prevailing conventions [GH-21760]CreateOperation to be defined without an ExistenceCheck, thereby fixing misleading x-vault-createSupported in OpenAPI [GH-18492]service_account_json parameter when reading DB connection details [GH-23256]pending_permits, active_permits, and pool_size. [GH-21742]DEPRECATIONS:
BUG FIXES:
auth/token/create fields to avoid incorrect warnings about ignored parameters [GH-18556]AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE, and AWS_ROLE_SESSION_NAME. [GH-21951]-field flag is provided during a vault write. [GH-21546]table. [GH-22818]identity/mfa/method/* APIs [GH-20879]vault plugin runtime list can successfully list plugin runtimes with GET [GH-23171]no managed key found with uuid. [GH-21316]default_critical_options and default_extension if left unchanged. [GH-21739]max_versions default for secret metadata unintentionally overriding kv engine defaults [GH-22394]CHANGES:
IMPROVEMENTS:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
code_challenge_methods_supported to OpenID Connect Metadata [GH-24979]BUG FIXES:
SECURITY:
CHANGES:
/identity/entity/merge endpoint
are now always forwarded from standbys to the active node. [GH-24325]BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
log_requests_level. [GH-24058]SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
detect_deadlocks. [GH-23902]CHANGES:
IMPROVEMENTS:
tls-server-name arg for plugin registration [GH-23549]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
table. [GH-22818]CHANGES:
IMPROVEMENTS:
BUG FIXES:
max_versions default for secret metadata unintentionally overriding kv engine defaults [GH-22394]SECURITY
CHANGES:
IMPROVEMENTS:
BUG FIXES:
auth/token/create fields to avoid incorrect warnings about ignored parameters [GH-18556]AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE, and AWS_ROLE_SESSION_NAME. [GH-21951]no managed key found with uuid. [GH-21316]default_critical_options and default_extension if left unchanged. [GH-21739]SECURITY:
BREAKING CHANGES:
CHANGES:
FEATURES:
env_template configuration stanza. The process-supervisor configuration can be generated with a new vault agent generate-config helper tool. [GH-20530]vault proxy -config=config.hcl. It currently has the same feature set as Vault Agent's API proxy, but the two may diverge in the future. We plan to deprecate the API proxy functionality of Vault Agent in a future release. [GH-20548]IMPROVEMENTS:
reload option to cert auth configuration in case of external renewals of local x509 key-pairs. [GH-19002]remove_jwt_follows_symlinks (default: false), that, if set to true will now remove the JWT, instead of the symlink to the JWT, if a symlink to a JWT has been provided in the path option, and the remove_jwt_after_reading config option is set to true (default). [GH-18863]/sys/internal/counters/config endpoint now contains read-only
minimum_retention_months. [GH-20150]/sys/internal/counters/config endpoint now contains read-only
reporting_enabled and billing_start_timestamp fields. [GH-20086]VAULT_PPROF_WRITE_TO_FILE=true is set on the server. [GH-20609]OPTOUT_LICENSE_REPORTING environment variable. [GH-3939]kv-get command for reading kv v2 data and metadata [GH-20590]BUG FIXES:
max_page_size properly [GH-20453]new_token forwarding is set. When this occurred, this would result in the following error to the client: error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue.sscGenCounter
resulting in 412 errors.TypeInt64 schema field. [GH-18729]operation_all to persist after deselecting all operation checkboxes [GH-19139]CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
/identity/entity/merge endpoint
are now always forwarded from standbys to the active node. [GH-24325]BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
log_requests_level. [GH-24057]SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
detect_deadlocks. [GH-23902]CHANGES:
IMPROVEMENTS:
tls-server-name arg for plugin registration [GH-23549]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
SECURITY:
CHANGES:
FEATURES:
IMPROVEMENTS:
BUG FIXES:
table. [GH-22818]CHANGES:
IMPROVEMENTS:
BUG FIXES:
max_versions default for secret metadata unintentionally overriding kv engine defaults [GH-22394]SECURITY:
CHANGES:
IMPROVEMENTS:
vault.policy.configured.count. [GH-21010]BUG FIXES:
no managed key found with uuid. [GH-21316]default_critical_options and default_extension if left unchanged. [GH-21739]BREAKING CHANGES:
CHANGES:
FEATURES:
IMPROVEMENTS:
/sys/internal/counters/config endpoint now contains read-only
minimum_retention_months. [GH-20150]/sys/internal/counters/config endpoint now contains read-only
reporting_enabled and billing_start_timestamp fields. [GH-20086]OPTOUT_LICENSE_REPORTING environment variable. [GH-3939]BUG FIXES:
CHANGES:
IMPROVEMENTS:
mount_point field to audit requests and response entries [GH-20411]VAULT_PPROF_WRITE_TO_FILE=true is set on the server. [GH-20609]BUG FIXES:
max_page_size properly [GH-20453]CHANGES:
SECURITY:
IMPROVEMENTS:
raft sub-field to the storage and ha_storage details provided by the
/sys/config/state/sanitized endpoint in order to include the max_entry_size. [GH-20044]connection_timeout to tune connection timeout duration
for all LDAP plugins. [GH-20144]BUG FIXES:
-dev-tls flag on Windows [GH-20257]new_token forwarding is set. When this occurred, this would result in the following error to the client: error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue.sscGenCounter
resulting in 412 errors.. [GH-19799]SECURITY:
IMPROVEMENTS:
VAULT_AUTH_CONFIG_GITHUB_TOKEN environment variable when writing Github config [GH-19244]BUG FIXES:
password_policy has changed. [GH-19640]SECURITY:
secret is unsupported by this backend will be thrown by the lease manager. [GH-18874]CHANGES:
role field on login [GH-19005]builtin in their metadata remain unaffected. [GH-18051]GET /database/config/:name endpoint now returns an additional plugin_version field in the response data. [GH-16982]GET /sys/auth/:path/tune and GET /sys/mounts/:path/tune endpoints may now return an additional plugin_version field in the response data if set. [GH-17167]GET for /sys/auth, /sys/auth/:path, /sys/mounts, and /sys/mounts/:path paths now return additional plugin_version, running_plugin_version and running_sha256 fields in the response data for each mount. [GH-17167]FEATURES:
sys/config/group-policy-application API, policies can be configured to apply outside of namespace hierarchy, allowing this kind of cross-namespace sharing.IMPROVEMENTS:
token_file auto-auth configuration to allow using a pre-existing token for Vault Agent. [GH-18740]metrics_only role, serving only metrics, as part of the listener's new top level role option. [GH-18101]elide_list_responses option, providing a countermeasure for a common source of oversized audit log entries [GH-18128]abort_on_error parameter to CLI login command to help in non-interactive contexts [GH-19076]vault operator rekey prompts to describe recovery keys when -target=recovery [GH-18892]events.alpha1 experiment. [GH-18682]sys/loggers and sys/loggers/:name endpoints [GH-17979]detect_deadlocks config to optionally detect core state deadlocks [GH-18604]vault operator migrate in order to speed up a migration. [GH-18817]sys/config/group-policy-application, to allow group policies to be configurable
to apply to a group in any namespace. The default, within_namespace_hierarchy, is the current behaviour.{mountPath} to {<type>_mount_path} [GH-18663]vX.Y.Z+builtin or vX.Y.Z+builtin.vault. [GH-17289]tls_server_name and tls_skip_verify parameters [GH-18799]default_follows_latest_issuer. [GH-17824]config/auto-tidy, config/crl, and roles/:role. [GH-18222]retry_join_as_non_voter config option. [GH-18030]go.opentelemetry.io/otel, go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/trace to v1.11.2 [GH-18589]DEPRECATIONS:
BUG FIXES:
token_bound_cidrs validation when using /32 blocks for role and secret ID [GH-18145]-mount flag and secret key path are the same. [GH-17679]vault secrets list -detailed output. [GH-17577]vault server command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than raft or consul.permission denied for all HelpOperations on sudo-protected paths [GH-18568]sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]partial_success_response_code on decryption failures. [GH-18310]default and add default-service and default-batch to UI token_type for auth mount and tuning. [GH-19290]SECURITY:
IMPROVEMENTS:
BUG FIXES:
table. [GH-22818]CHANGES:
IMPROVEMENTS:
BUG FIXES:
max_versions default for secret metadata unintentionally overriding kv engine defaults [GH-22394]SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
no managed key found with uuid. [GH-21316]default_critical_options and default_extension if left unchanged. [GH-21739]BREAKING CHANGES:
CHANGES:
FEATURES:
IMPROVEMENTS:
/sys/internal/counters/config endpoint now contains read-only
minimum_retention_months. [GH-20150]/sys/internal/counters/config endpoint now contains read-only
reporting_enabled and billing_start_timestamp fields. [GH-20086]OPTOUT_LICENSE_REPORTING environment variable. [GH-3939]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
mount_point field to audit requests and response entries [GH-20411]VAULT_PPROF_WRITE_TO_FILE=true is set on the server. [GH-20609]BUG FIXES:
max_page_size properly [GH-20453]CHANGES:
IMPROVEMENTS:
raft sub-field to the storage and ha_storage details provided by the
/sys/config/state/sanitized endpoint in order to include the max_entry_size. [GH-20044]connection_timeout to tune connection timeout duration
for all LDAP plugins. [GH-20144]BUG FIXES:
-dev-tls flag on Windows [GH-20257]new_token forwarding is set. When this occurred, this would result in the following error to the client: error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue.sscGenCounter
resulting in 412 errors.. [GH-19799]SECURITY:
IMPROVEMENTS:
VAULT_AUTH_CONFIG_GITHUB_TOKEN environment variable when writing Github config [GH-19244]BUG FIXES:
password_policy has changed. [GH-19641]SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]CHANGES:
IMPROVEMENTS:
sys/loggers and sys/loggers/:name endpoints [GH-17979]tls_server_name and tls_skip_verify parameters [GH-18799]BUG FIXES:
token_bound_cidrs validation when using /32 blocks for role and secret ID [GH-18145]partial_success_response_code on decryption failures. [GH-18310]CHANGES:
builtin in their metadata remain unaffected. [GH-18051]IMPROVEMENTS:
default_follows_latest_issuer. [GH-17824]retry_join_as_non_voter config option. [GH-18030]BUG FIXES:
-mount flag and secret key path are the same. [GH-17679]vault server command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than raft or consul.IMPROVEMENTS:
BUG FIXES:
vault secrets list -detailed output. [GH-17577]SECURITY:
CHANGES:
GET /sys/plugins/catalog endpoint for listing plugins, and add details field to list responses. [GH-17347]GET /sys/auth/:name endpoint now returns an additional deprecation_status field in the response data for builtins. [GH-16849]GET /sys/auth endpoint now returns an additional deprecation_status field in the response data for builtins. [GH-16849]POST /sys/auth/:type endpoint response contains a warning for Deprecated auth methods. [GH-17058]auth enable returns an error and POST /sys/auth/:type endpoint reports an error for Pending Removal auth methods. [GH-17005]/identity/group that includes member_group_ids that contains a cycle will now be responded to with a 400 rather than 500 [GH-15912]GET /sys/plugins/catalog/:type/:name endpoint contains deprecation status for builtin plugins. [GH-17077]GET /sys/plugins/catalog/:type/:name endpoint now returns an additional version field in the response data. [GH-16688]GET /sys/plugins/catalog/ endpoint contains deprecation status in detailed list. [GH-17077]GET /sys/plugins/catalog endpoint now returns an additional detailed field in the response data with a list of additional plugin metadata. [GH-16688]plugin info displays deprecation status for builtin plugins. [GH-17077]plugin list now accepts a -detailed flag, which display deprecation status and version info. [GH-17077]Pending Removal. [GH-17038]GET /sys/mounts/:name endpoint now returns an additional deprecation_status field in the response data for builtins. [GH-16849]GET /sys/mounts endpoint now returns an additional deprecation_status field in the response data for builtins. [GH-16849]POST /sys/mounts/:type endpoint response contains a warning for Deprecated secrets engines. [GH-17058]secrets enable returns an error and POST /sys/mount/:type endpoint reports an error for Pending Removal secrets engines. [GH-17005]FEATURES:
ldap secrets engine with service account check-out functionality for all supported schemas. [GH-17152]IMPROVEMENTS:
exit_on_err which when set to true, will cause Agent to exit if any errors are encountered during authentication. [GH-17091]disable_idle_connections configuration to disable leaving idle connections open in auto-auth, caching and templating. [GH-15986]disable_keep_alives configuration to disable keep alives in auto-auth, caching and templating. [GH-16479]remove_jwt_after_reading config option which defaults to true. [GH-11969]google.golang.org/api@v0.83.0, github.com/hashicorp/go-gcp-common@v0.8.0. [GH-17160]add_group_aliases config to include LDAP groups in Vault group aliases [GH-16890]remove_instance_name parameter to the login CLI and the Kerberos config in Vault. This removes any instance names found in the keytab service principal name. [GH-16594]auth and secrets list -detailed commands now show Deprecation Status for builtin plugins. [GH-16849]vault plugin list now has a details field in JSON format, and version and type information in table format. [GH-17347]-dev-tls and -dev-tls-cert-dir subcommands to create a Vault dev server with generated certificates and private key. [GH-16421]namespace patch CLI commandvault server command to ensure configured storage backend is supported.sys/loggers and sys/loggers/:name endpoints to provide ability to modify logging verbosity [GH-16111]VAULT_ALLOW_PENDING_REMOVAL_MOUNTS to override shutdown and error when attempting to mount Pending Removal builtin plugins. [GH-17005]client_secret_post token endpoint authentication method. [GH-16598]cn_validations). [GH-15996]google.golang.org/api@v0.83.0, github.com/hashicorp/go-gcp-common@v0.8.0. [GH-17174]default_user field [GH-16351]ssh/issue/:role to allow the creation of signed key pairs [GH-15561]connection_timeout, initial_connection_timeout, simple_retry_policy_retries. [GH-10467]BUG FIXES:
max_retries retry configuration even when caching is set. [GH-16970]cache_disable trueclaims_supported to discovery document. [GH-16992]state parameter of the Authorization Endpoint to optional. [GH-16599]redirect_uri values sooner in validation of the Authorization Endpoint. [GH-16601]request and request_uri parameters. [GH-16600]kv get issue preventing the ability to read a secret when providing a leading slash [GH-16443]CHANGES:
FEATURES:
IMPROVEMENTS:
/sys/internal/counters/config endpoint now contains read-only
minimum_retention_months. [GH-20150]/sys/internal/counters/config endpoint now contains read-only
reporting_enabled and billing_start_timestamp fields. [GH-20086]OPTOUT_LICENSE_REPORTING environment variable. [GH-3939]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
VAULT_PPROF_WRITE_TO_FILE=true is set on the server. [GH-20609]BUG FIXES:
max_page_size properly [GH-20453]CHANGES:
IMPROVEMENTS:
raft sub-field to the storage and ha_storage details provided by the
/sys/config/state/sanitized endpoint in order to include the max_entry_size. [GH-20044]connection_timeout to tune connection timeout duration
for all LDAP plugins. [GH-20144]BUG FIXES:
new_token forwarding is set. When this occurred, this would result in the following error to the client: error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue.sscGenCounter
resulting in 412 errors.. [GH-19799]SECURITY:
IMPROVEMENTS:
VAULT_AUTH_CONFIG_GITHUB_TOKEN environment variable when writing Github config [GH-19244]BUG FIXES:
SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]CHANGES:
IMPROVEMENTS:
tls_server_name and tls_skip_verify parameters [GH-18799]BUG FIXES:
token_bound_cidrs validation when using /32 blocks for role and secret ID [GH-18145]IMPROVEMENTS:
default_follows_latest_issuer. [GH-17824]BUG FIXES:
-mount flag and secret key path are the same. [GH-17679]IMPROVEMENTS:
BUG FIXES:
cache_disable trueSECURITY:
IMPROVEMENTS:
exit_on_err which when set to true, will cause Agent to exit if any errors are encountered during authentication. [GH-17091]BUG FIXES:
claims_supported to discovery document. [GH-16992]SECURITY:
CHANGES:
IMPROVEMENTS:
add_group_aliases config to include LDAP groups in Vault group aliases [GH-16890]remove_instance_name parameter to the login CLI and the
Kerberos config in Vault. This removes any instance names found in the keytab
service principal name. [GH-16594]client_secret_post token endpoint authentication method. [GH-16598]BUG FIXES:
state parameter of the Authorization Endpoint to optional. [GH-16599]redirect_uri values sooner in validation of the
Authorization Endpoint. [GH-16601]request and request_uri parameters. [GH-16600]SECURITY:
IMPROVEMENTS:
disable_keep_alives configuration to disable keep alives in auto-auth, caching and templating. [GH-16479]BUG FIXES:
kv get issue preventing the ability to read a secret when providing a leading slash [GH-16443]SECURITY:
CHANGES:
IMPROVEMENTS:
disable_idle_connections configuration to disable leaving idle connections open in auto-auth, caching and templating. [GH-15986]sys/loggers and sys/loggers/:name endpoints to provide ability to modify logging verbosity [GH-16111]BUG FIXES:
SECURITY:
CHANGES:
kubernetes_ca_cert is unset, and there is no pod-local CA available, an error will be surfaced when writing config instead of waiting for login. [GH-15584]sys/license and sys/license/signed
endpoints in favor of autoloaded licenses./sys/replication/performance/primary/mount-filter endpoint has been removed. Please use Paths Filter instead.additional_metadata into extra_annotations and extra_labels parameters [GH-15655]ca_chain response field within issuing (/pki/issue/:role)
and signing APIs will now include the root CA certificate if the mount is
aware of it. [GH-15155]FEATURES:
-output-policy can now be used with any command to print out the minimum required policy HCL for that operation, including whether the given path requires the "sudo" capability. [GH-14899]AWS_DYNAMODB_REGION environment variable. [GH-15054]IMPROVEMENTS:
min_backoff to the method stanza for configuring initial backoff duration. [GH-15204]user_claim value. [GH-15593]unauthenticated_metrics_access is enabled [GH-15316]termination_time in sys/license/status responselicense inspect command outputsys/seal-status and sys/version-history endpoints. [GH-14957]generate_lease and no_store are both set to true on requests. [GH-14292]add_before_duration in SSH [GH-15250]DEPRECATIONS:
BUG FIXES:
username_as_alias is set
has been fixed. The previous behavior would make a request to the LDAP server to
get user_attr before discarding it and using the username instead. This would
make it impossible for a user to connect if this attribute was missing or had
multiple values, even though it would not be used anyway. This has been fixed
and the username is now used without making superfluous LDAP searches. [GH-15525]connection_url password is redacted in all cases. [GH-14744]delete_version_after key metadata field to 0s via HTTP PATCH. [GH-15792]leasId to leaseId in the "Copy Credentials" section of "Generate AWS Credentials" [GH-15685]SECURITY:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
sys/leases/lookup, sys/leases/revoke, and sys/leases/renew endpoints if provided lease_id is null [GH-18951]CHANGES:
IMPROVEMENTS:
tls_server_name and tls_skip_verify parameters [GH-18799]BUG FIXES:
token_bound_cidrs validation when using /32 blocks for role and secret ID [GH-18145]BUG FIXES:
BUG FIXES:
cache_disable trueSECURITY:
BUG FIXES:
claims_supported to discovery document. [GH-16992]SECURITY:
CHANGES:
IMPROVEMENTS:
client_secret_post token endpoint authentication method. [GH-16598]BUG FIXES:
state parameter of the Authorization Endpoint to optional. [GH-16599]redirect_uri values sooner in validation of the
Authorization Endpoint. [GH-16601]request and request_uri parameters. [GH-16600]SECURITY:
SECURITY:
CHANGES:
IMPROVEMENTS:
sys/loggers and sys/loggers/:name endpoints to provide ability to modify logging verbosity [GH-16111]BUG FIXES:
leasId to leaseId in the "Copy Credentials" section of "Generate AWS Credentials" [GH-15685]CHANGES:
IMPROVEMENTS:
unauthenticated_metrics_access is enabled [GH-15316]BUG FIXES:
username_as_alias is set
has been fixed. The previous behavior would make a request to the LDAP server to
get user_attr before discarding it and using the username instead. This would
make it impossible for a user to connect if this attribute was missing or had
multiple values, even though it would not be used anyway. This has been fixed
and the username is now used without making superfluous LDAP searches. [GH-15525]SECURITY:
BUG FIXES:
BUG FIXES:
CHANGES:
IMPROVEMENTS:
BUG FIXES:
connection_url password is redacted in all cases. [GH-14744]CHANGES:
default_lease_ttl and max_lease_ttl values returned by
the /sys/config/state/sanitized endpoint from nanoseconds to seconds. [GH-14206]POST /database/config/:name has been updated to "204 No Content" [GH-14033]use_microsoft_graph_api to use the Microsoft
Graph API by default. [GH-14130]FEATURES:
/agent/v1/metrics endpoint.IMPROVEMENTS:
agent/v1/quit endpoint can now be used to stop the Vault Agent remotely [GH-14223]api.Client tokens via api.Config.CloneToken or api.Client.SetCloneToken(). [GH-13515]auto [GH-14051]userfilter doesn't consider userattr [GH-14095]auth/token/revoke-accessor endpoint is now idempotent and will
not error out if the token has already been revoked. [GH-13661]sys/auth/:path now returns the configuration for the auth engine mounted at the given path [GH-12793]custom_metadata to be empty. [GH-13395]sys/policies/password [GH-12787]sys/version-history and via CLI with vault version-history [GH-13766]sys/mounts/:path now returns the configuration for the secret engine at the given path [GH-12792]allow_all assignment that permits all entities to authenticate via an OIDC client [GH-14119]influxdb1-client module [GH-12262]allow_wildcard_certificates) [GH-14238]ca_chain field) on calls to pki/cert/ca_chain [GH-13935]aerospike-client-go to v5.6.0. [GH-12165]-f and --force as aliases
for -force for the write command. [GH-13683]BUG FIXES:
replicateStateStore was being set to nil upon consecutive calls to client.SetReadYourWrites(true). [GH-13486]login endpoint [GH-14107]alias_name_source [GH-13925]form_post response mode. [GH-13492]-output-curl-string now properly sets cURL options for client and CA
certificates. [GH-13660]nonce parameter optional for the Authorization Endpoint of OIDC providers. [GH-13231]prem build.vault_key column when initializing database tables. [GH-14231]root_password_ttl of zero. [GH-14130]contained_db, rather than just a string. [GH-13469]Вы можете оставить комментарий после Вход в систему
Неприемлемый контент может быть отображен здесь и не будет показан на странице. Вы можете проверить и изменить его с помощью соответствующей функции редактирования.
Если вы подтверждаете, что содержание не содержит непристойной лексики/перенаправления на рекламу/насилия/вульгарной порнографии/нарушений/пиратства/ложного/незначительного или незаконного контента, связанного с национальными законами и предписаниями, вы можете нажать «Отправить» для подачи апелляции, и мы обработаем ее как можно скорее.
Опубликовать ( 0 )