diff --git a/command/server.go b/command/server.go index 4c2714af33..aa2fd339d8 100644 --- a/command/server.go +++ b/command/server.go @@ -2724,8 +2724,7 @@ func setSeal(c *ServerCommand, config *server.Config, infoKeys []string, info ma } func (c *ServerCommand) computeSealGenerationInfo(existingSealGenInfo *vaultseal.SealGenerationInfo, sealConfigs []*configutil.KMS) (*vaultseal.SealGenerationInfo, error) { - var generation uint64 - generation = 1 + generation := uint64(1) if existingSealGenInfo != nil { if cmp.Equal(existingSealGenInfo.Seals, sealConfigs) { diff --git a/vault/core.go b/vault/core.go index 86b7a312bf..5da2ade3bb 100644 --- a/vault/core.go +++ b/vault/core.go @@ -2397,8 +2397,14 @@ func (s standardUnsealStrategy) unseal(ctx context.Context, logger log.Logger, c return err } - if !sealGenerationInfo.IsRewrapped() { + sealHaEnabled, err := server.IsSealHABetaEnabled() + if err != nil { + return err + } + if sealHaEnabled && !sealGenerationInfo.IsRewrapped() { // Flag migration performed for seal-rewrap later + // Note that in the case where seal HA is not enabled, Core.migrateSeal() takes care of + // triggering the rewrap when necessary. c.logger.Trace("seal generation information indicates that a seal-rewrap is needed", "generation", sealGenerationInfo.Generation, "rewrapped", sealGenerationInfo.IsRewrapped()) atomic.StoreUint32(c.sealMigrationDone, 1) }