upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

VAULT-24267 Code change for unsync secrets immediately when a mount is deleted or disabled (#11578) (#11674)

Browse source 
Co-authored-by: ankitsutharhashicorp <ankitkumar.suthar@hashicorp.com>
This commit is contained in:
Vault Automation 2026-01-16 21:45:27 -07:00 committed by GitHub
parent 48dbd17974
commit 539e30c4cd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
changelog/_11578.txt Normal file
View file

@ -0,0 +1,6 @@
```release-note:improvement
secrets-sync (enterprise): Improved the user experience during mount lifecycle changes by triggering immediate
unsyncing of external secrets when a secrets engine mount is deleted or disabled. By moving this logic from
the background reconciliation loop to a direct callback, the system prevents perceived "leaks" and ensures external
secret resources are cleaned up synchronously with the Vault unmount.
```

5
vault/logical_system.go
View file

@ -1792,6 +1792,11 @@ func (b *SystemBackend) handleUnmount(ctx context.Context, req *logical.Request,
return handleError(fmt.Errorf("unable to find storage for path: %q", path))
}
// Unsync secrets during mount deletion
if err := b.callUnsyncMountHelper(ctx, path); err != nil {
b.Backend.Logger().Error("failed to unsync secrets during mount deletion", "error", err)
}
// Attempt unmount
if err := b.Core.unmountWithRequest(ctx, path, req); err != nil {
b.Backend.Logger().Error("unmount failed", "path", path, "error", err)

4
vault/logical_system_stubs_oss.go
View file

@ -116,3 +116,7 @@ func (b *SystemBackend) mountInfo(ctx context.Context, entry *MountEntry, legacy
return info
}
func (b *SystemBackend) callUnsyncMountHelper(ctx context.Context, path string) error {
return nil
}