Commit graph

22158 commits

Author SHA1 Message Date
Vault Automation
591e963342
add carbon tree chart (#11965) (#11970)
* add carbon tree chart

* a11y and test improvements

Co-authored-by: lane-wetmore <lane.wetmore@hashicorp.com>
2026-01-23 23:59:12 +00:00
Vault Automation
921ea64aba
Adjust CODEOWNERS for copilot-related files (#11949) (#11959)
Set copilot instructions code ownership to wider Vault team.

Co-authored-by: Angelo Cordon <angelo.cordon@hashicorp.com>
2026-01-23 15:12:35 -08:00
Vault Automation
0d0a06c491
Update eslint console rule (#11883) (#11948)
Allow for console error and warn and fail for everything else.
Remove disable rules for console.

Co-authored-by: Angelo Cordon <angelo.cordon@hashicorp.com>
2026-01-23 13:26:41 -08:00
Vault Automation
aa1349f5a5
actions(runners): add backup self-hosted runner types (#11884) (#11937)
* actions(runners): add backup self-hosted runner types

We've previously added backup runner types for various self-hosted
runners but were not exhaustive. This change adds at least one backup
instance type to each specified on-demand runner type.

Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Ryan Cragun <me@ryan.ec>
2026-01-23 21:12:52 +00:00
Vault Automation
3c2f5b2ea0
Enable GCP workload identity authentication for GCP KMS Managed Keys (#11918) (#11942)
* removing explicit GCP credentials checks to allow for GCP WIF authentication, in line with AWS KMS functionality

* upd: updated changelog for GCP managed keys in core

---------

Co-authored-by: Steven Clark <steven.clark@hashicorp.com>
Co-authored-by: rizkybiz <justin.defrank@gmail.com>
2026-01-23 13:48:50 -05:00
Vault Automation
e21dfb9707
UI: Add tune support to Kubernetes Secrets Engine (#11855) (#11935)
* updating kub to use new config pages

* fix tests

* remove cta

* fix test

* updating configure route data, adding tests for dropdown/exit button

Co-authored-by: Dan Rivera <dan.rivera@hashicorp.com>
2026-01-23 17:27:22 +00:00
Vault Automation
433f90417a
add variable template (#11923) (#11932)
Co-authored-by: lane-wetmore <lane.wetmore@hashicorp.com>
2026-01-23 09:49:26 -06:00
Vault Automation
fc3f525ea8
Backport remove unused TestLicenseOptions into ce/main (#11929)
* remove unused TestLicenseOptions (#11928)

* go mod tidy

---------

Co-authored-by: akshya96 <87045294+akshya96@users.noreply.github.com>
Co-authored-by: akshya96 <araghavan@hashicorp.com>
2026-01-23 07:18:29 -05:00
Vault Automation
8d3e25015f
Backport Remove go-licensing specific changes from CE into ce/main (#11922)
* no-op commit

* merging changes from ent

* deleting ent file

* moving licensing config back

* Revert "moving licensing config back"

This reverts commit 8856cd7d5d334355610782e500ebcd4438ff89b3.

* adding back licensing config to original state (#11925)

---------

Co-authored-by: akshya96 <87045294+akshya96@users.noreply.github.com>
Co-authored-by: akshya96 <araghavan@hashicorp.com>
2026-01-22 20:30:31 -08:00
Vault Automation
bb75e0846a
[UI][VAULT-41961] Update Access nav and breadcrumbs (#11869) (#11915)
* Update access nav and breadcrumbs

* Fix tsts and update permissions

* Remove pausetest

* Check if root is an array

* Fix edit breadcrumb

* Fix more tests!

* Fix logic

Co-authored-by: Kianna <30884335+kiannaquach@users.noreply.github.com>
2026-01-22 17:55:18 -08:00
Vault Automation
e745f92bc5
actions: pin to latest actions (#11818) (#11909)
- actions/cache -> v5.0.2: A bugfix around not retrying cache entries on
  429s.
- actions/setup-go -> v6.2.0: NodeJS bump and internal actions/cache
  bump. We don't use the caching in setup-go so this ought to have no
  impact for us.
- actions/setup-node -> v6.2.0: internal bump of actions/cache.
- pnpm/action-setup -> v4.2.0: Adds support for .npmrc file.

Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Ryan Cragun <me@ryan.ec>
2026-01-22 20:38:08 +00:00
Vault Automation
c493633d99
update lodash version (#11893) (#11906)
Co-authored-by: Dan Rivera <dan.rivera@hashicorp.com>
2026-01-22 18:36:13 +00:00
Vault Automation
692246e894
enos(ui): use amd64 target machines (#11875) (#11894)
Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Ryan Cragun <me@ryan.ec>
2026-01-22 10:59:06 -07:00
Vault Automation
ae330a274e
add observations for the rabbitmq secrets engine (#11601) (#11846) 2026-01-22 10:40:17 -06:00
Vault Automation
b22b89ef2d
add observations for the consul secrets engine (#11425) (#11692) 2026-01-22 10:39:50 -06:00
Vault Automation
60eb60c24f
[UI] Ember Data Migration - KMIP Cleanup (#11838) (#11865)
* updates kmip scope roles route to ts

* updates kmip scope roles route to use api service and adds page component

* converts kmip role route to ts

* fixes a11y error in kmip header-credentials component

* updates kmip role route to use api service and adds page component

* removes kmip operation-field-display component that was moved into role page component

* converts kmip role create route to ts

* moves kmip role form component to component directory root

* converts kmip role form component to ts

* adds operation-groups helper and refactors kmip role page to use it

* adds operation-label helper and updates kmip role page to use it

* converts kmip edit role route to ts

* updates kmip role test to use operation-groups helper

* adds kmip role form

* updates kmip role edit and create routes to use api service and form class

* updates kmip role form component to work with form class

* updates kmip acceptance tests

* converts kmip credentials index route to ts

* updates kmip credentials route to use api service

* adds kmip credentials page component

* converts kmip credentials show route to ts

* updates kmip credentials show route to use api service and adds page component

* fixes flash message issue on kmip role form submit success

* converts kmip credentials generate route to ts

* reverts kmip credentials show page component in favor of details-credentials component which is also used in generate route

* fixes kmip details-credentials tests

* update kmip credentials generate route to use api service and updates page component

* removes store and pagination services from kmip engine

* converts kmip breadcrumb component to ts

* converts kmip header scope component to ts

* removes kmip Ember Data models and adapters

* removes store reference from kmip acceptance tests

* fixes issues routing back to secrets engine via breadcrumb in kmip roles and credentials routes

* removes kmip role adapter test

* updates open api helpers tests

Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
2026-01-21 17:20:19 +00:00
Vault Automation
1f883d8d59
agent: Retry transient lookup-self errors (#11842) (#11860)
Co-authored-by: Mike Palmiotto <mpalmi@ibm.com>
2026-01-21 11:35:08 -05:00
Vault Automation
04d1d4ca76
UI: Client count error handling (#11852) (#11859)
* move utils to a folder

* separate methods for serializing

* separate test coverage too

* make formatQueryParams a separate util

* use api service to request export data

* consolidate error templates

* move export request to parent route

* replace EmptyState with ApplicationState

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
2026-01-21 02:56:29 +00:00
Vault Automation
318d6a2843
UI: Add automation snippets to policy read view (#11804) (#11856)
* add automation snippets to policy and convert to page component

* only show for acl types

* remove unnecessary tag

* update test coverage

* last fix, oops!

* wait for dropdown to close

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
2026-01-20 16:30:28 -08:00
Vault Automation
5e36c2417f
[UI] Ember Data Migration - KMIP Credentials (#11837) (#11858)
* updates kmip scope roles route to ts

* updates kmip scope roles route to use api service and adds page component

* converts kmip role route to ts

* fixes a11y error in kmip header-credentials component

* updates kmip role route to use api service and adds page component

* removes kmip operation-field-display component that was moved into role page component

* converts kmip role create route to ts

* moves kmip role form component to component directory root

* converts kmip role form component to ts

* adds operation-groups helper and refactors kmip role page to use it

* adds operation-label helper and updates kmip role page to use it

* converts kmip edit role route to ts

* updates kmip role test to use operation-groups helper

* adds kmip role form

* updates kmip role edit and create routes to use api service and form class

* updates kmip role form component to work with form class

* updates kmip acceptance tests

* converts kmip credentials index route to ts

* updates kmip credentials route to use api service

* adds kmip credentials page component

* converts kmip credentials show route to ts

* updates kmip credentials show route to use api service and adds page component

* fixes flash message issue on kmip role form submit success

* converts kmip credentials generate route to ts

* reverts kmip credentials show page component in favor of details-credentials component which is also used in generate route

* fixes kmip details-credentials tests

* update kmip credentials generate route to use api service and updates page component

Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
2026-01-20 23:15:13 +00:00
Vault Automation
7cedc372c3
VAULT-41973 Move sidebar to core (#11850) (#11857)
Co-authored-by: Kianna <30884335+kiannaquach@users.noreply.github.com>
2026-01-20 22:54:38 +00:00
Vault Automation
8b300cf6eb
[UI] Ember Data Migration - KMIP Roles (#11801) (#11854)
* updates kmip scope roles route to ts

* updates kmip scope roles route to use api service and adds page component

* converts kmip role route to ts

* fixes a11y error in kmip header-credentials component

* updates kmip role route to use api service and adds page component

* removes kmip operation-field-display component that was moved into role page component

* converts kmip role create route to ts

* moves kmip role form component to component directory root

* converts kmip role form component to ts

* adds operation-groups helper and refactors kmip role page to use it

* adds operation-label helper and updates kmip role page to use it

* converts kmip edit role route to ts

* updates kmip role test to use operation-groups helper

* adds kmip role form

* updates kmip role edit and create routes to use api service and form class

* updates kmip role form component to work with form class

* updates kmip acceptance tests

* fixes flash message issue on kmip role form submit success

Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
2026-01-20 20:38:18 +00:00
Vault Automation
812498cfc6
VAULT-41778 Added enos tests for LDAP auth. (#11773) (#11827)
* VAULT-41778 Fixing linting issues

* Fixing linting issues

* Fixing lint issues

* Fixing lint issues

* Fixing review comments

* Fixing lint issues

* Fix review comments

* Fix review comments

* Fix lint issues

* Fix lint issues

* Fix failing tests

* Fix lint issues

* Fixing failed tests

* Fix lint issues

* Fix lint issues

* Reverted ENOS_VAR_verify_ldap_secrets_engine variable to false

---------

Co-authored-by: rohit-ganthade-hashicorp <rohit.ganthade@hashicorp.com>
Co-authored-by: Rohit Ganthade <rohit.ganthade@gmail.com>
Co-authored-by: Luis (LT) Carbonell <lt.carbonell@hashicorp.com>
2026-01-20 08:16:46 -05:00
Vault Automation
87c9b9470b
VAULT-41681: SSH certificate observations (#11811) (#11834)
* ssh observations and tests

* remove unnecessary comments

* add metadata in comments

* add more assertions, fix test

* fix test

Co-authored-by: miagilepner <mia.epner@hashicorp.com>
2026-01-19 11:22:04 -05:00
Vault Automation
539e30c4cd
VAULT-24267 Code change for unsync secrets immediately when a mount is deleted or disabled (#11578) (#11674)
Co-authored-by: ankitsutharhashicorp <ankitkumar.suthar@hashicorp.com>
2026-01-17 10:15:27 +05:30
Vault Automation
48dbd17974
UI: Add tune support for PKI Secrets engine (#11761) (#11826)
* add dropdown

* first pass

* adding configure page w creation, edit and routing

* remove route

* remote route usage

* test fixes

* fix title

* add things back

* test fixes

* testing

* moving to template

* fixing configure

* applying suggestions & updating tests

* removing login lines to mend tests

* update header

* fix test

Co-authored-by: Dan Rivera <dan.rivera@hashicorp.com>
2026-01-16 21:30:18 +00:00
Vault Automation
4d7e01047e
go: upgrade Go to 1.25.6 (#11800) (#11819)
Resolves:
  - CVE-2025-68121
  - CVE-2025-61728
  - CVE-2025-61726
  - CVE-2025-61731
  - CVE-2025-68119

Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Ryan Cragun <me@ryan.ec>
2026-01-16 19:50:33 +00:00
Vault Automation
7a29044ea4
UI: Implement policy generator in kv v2 routes (#11798) (#11813)
* add support for initializing with capability paths

* only render flyout for enterprise versions

* update PolicyStanza to support object

* add policy generator to kv

* only set preset stanzas if no changes have been made

* add test coverage for kv adding policy generate to page headers

* add community test

* add test coverage to capabilities service

* add changelog

* add close callback

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
2026-01-16 10:45:01 -08:00
Vault Automation
062537e1fe
VAULT-40016 Add request information to observations from direct mounts/unmounts (#11777) (#11815)
* VAULT-40016 Add request information to observations from direct mounts/unmounts

* Fix typo

Co-authored-by: Violet Hynes <violet.hynes@hashicorp.com>
2026-01-16 18:24:30 +00:00
Vault Automation
0e0abf8f4e
Root credential rollback workflow (#11616) (#11785)
* Add LDAP secrets engine verification with rollback functionality

- Added LDAP secrets engine read verification module
- Implemented secrets-rollback.sh script for LDAP credential rotation testing
- Updated enos configuration files for LDAP testing support
- Added vault.zip distribution file for testing

* Optimize LDAP rollback script - improve readability and reduce redundancy

* demonstated 3 case of rollback under various situations and maintain system consistancy

* modified ldap.tf file with changes needed for secret-rollback script file

* Fix LDAP secrets engine: remove unused credential_ttl_buffer variable

* Fix shell script formatting for shfmt compliance

* Refactor LDAP secrets rollback script for clarity

* Add LDAP verification configuration to ldap.tf

Added local variable for LDAP login data and configured resource for verifying Vault LDAP configurations.

* Comment out vault_revision in enos.vars.hcl

* Remove unused generate_ldif function from secrets-rollback script

* Make sleep delays configurable in secrets-rollback script

* Add LDAP secrets rollback verification scripts and update ldap.tf configuration

* Update LDAP secrets rollback test scripts

* Update LDAP secrets engine read module

* Fix formatting in ldap.tf - correct indentation

* Change LDAP secrets engine verification to true

* Refactor LDAP rollback script for clarity

Updated script to improve clarity and consistency checks after LDAP root rotation failures.

* Add copyright and license information to script

* Fix formatting in secrets-rollback-transactional.sh

* Change LDAP secrets engine verification to false(reverting to old state)

Tried running root rotation  rollback cases with ldap set true

---------

Co-authored-by: sukanya-prakash <sukanya.p@hashicorp.com>
Co-authored-by: Sukanya P <sukanyap@Sukanyas-MacBook-Pro.local>
Co-authored-by: Sukanya P <sukanyap@mac.n3d-in.ibm.com>
2026-01-16 09:01:56 -05:00
Vault Automation
126f9f3048
VAULT-41462: Nomad secrets engine observations (#11516) (#11741)
* add nomad observations

* fix typo

* add additional metadata checks

* fix check for ttl and maxttl

* add global check for cred create

Co-authored-by: miagilepner <mia.epner@hashicorp.com>
2026-01-15 18:19:12 +01:00
Vault Automation
322d731a7a
bump github.com/hashicorp/vault/sdk to v0.21.0 (#11723) (#11732)
Co-authored-by: Maithy Ton <maithytonn@gmail.com>
2026-01-15 08:34:25 -08:00
Vault Automation
0793c817ef
[UI][VAULT-40930] Replace direct use of Hds::PageHeader with Page::Header (#11721) (#11760)
* Replace direct use of hds::pageheader with page::header

* Update test selector

* Remove unused selector

Co-authored-by: Kianna <30884335+kiannaquach@users.noreply.github.com>
2026-01-15 07:43:05 -08:00
Vault Automation
cab60d761b
Backport rotationManager: add configurable limit to rotation retries with orphaning into ce/main (#11782)
Co-authored-by: vinay-gopalan <86625824+vinay-gopalan@users.noreply.github.com>
2026-01-15 09:31:40 -06:00
Vault Automation
d978f9720c
VAULT-41600: SSH OTP observations (#11704) (#11783)
* ssh observations and tests

* remove unnecessary comments

* add metadata in comments

* limit to only otp paths

* remove unnecessary change

Co-authored-by: miagilepner <mia.epner@hashicorp.com>
2026-01-15 15:22:11 +00:00
Vault Automation
673f170d03
[UI] Ember Data Migration - KMIP Scopes (#11763) (#11781)
* converts kmip scopes index route to ts

* adds capabilities service to kmip engine

* updates kmip scopes index route to use api service

* adds kmip scopes page component

* adds kmip scopes create page component

* adds pagination component to scopes page

* adds tests for kmip scopes page component

* fixes path for kmip scope capabilities in scopes route

* fixes issue with linked block linkPrefix in kmip scopes page

Co-authored-by: Jordan Reimer <zofskeez@gmail.com>
2026-01-14 23:09:23 +00:00
Vault Automation
ba04a284f8
Validate that certificate of the connection matches (#11695) (#11764)
* Validate that certificate of the connection is the same as the certificate we are trying to renew for.

* add changelog

* Add explicit check for nil-entry.

* Remove the cast - PR feedback.

Co-authored-by: Kit Haines <khaines@mit.edu>
2026-01-14 14:12:57 -05:00
Vault Automation
42fa6ab32a
KV HWM Metrics (#11596) (#11725)
* Added kv HWM metrics and a local test

* Added go docs and some helper functions

* Just added kv secret hwm to endpoint for tracking

* Fixed some small things and added one more test

* Fix a race test

* Added require'

Co-authored-by: divyaac <divya.chandrasekaran@hashicorp.com>
2026-01-13 10:46:02 -08:00
Vault Automation
879f7d1a7f
VAULT-21133 Add counters for operations picked up by the reconciliation loop (#11261) (#11755)
* initial commit for reconciliation telemetry

* added go doc to tests

* updated retries count logic

* updated go doc for TestSecretsSyncBackend_emitReconciliationMetrics

* updated tests

* added changelog

Co-authored-by: suraj-simha <suraj.s@hashicorp.com>
2026-01-13 23:41:39 +05:30
Vault Automation
e7133e83f2
VAULT-40965 async option for scan API (#11011) (#11751)
* VAULT-40965 async option for scan API

* whoopsie

* whoopsie

* add test, return accepted (for real), fix docs

* Add extra time

* make test more resilient

Co-authored-by: Violet Hynes <violet.hynes@hashicorp.com>
2026-01-13 17:40:37 +00:00
Vault Automation
1f92de7454
VAULT-21132 - Add telemetry counters for sync/unsync operations by status (#11307) (#11746)
* VAULT-21132 - Added telemetry for sync and unsync operations by status

* changelog added

* added tests

* updated change log

* Addressed review comments

* Addressed review comments

* Addressed review comments

* Code scanning issue fixed

* Addressed review comments

* Addressed review comments

* unit test issues fixed

* issues fixed

* issues fixed

* issues fixed

* issues fixed

* issues fixed

* issues fixed

* Addressed review comments

* unit test issues fixed

* unit test issues fixed

* unit test issues fixed

* unit test issues fixed

Co-authored-by: santoshhashicorp <santosh.yelamarthi@hashicorp.com>
2026-01-13 22:29:55 +05:30
Vault Automation
3fde566dd2
Put alias_metadata tokenutil field into public SDK (#11468) (#11717) 2026-01-13 09:43:33 -06:00
Vault Automation
c9c1b158c8
Fix a data race that occurs when SetCore is called by CreateCore in tests that reuse seals. (#11743) (#11744) 2026-01-13 15:22:33 +00:00
Vault Automation
7592c217ac
catch 404 error for ldap overview (#11734) (#11738)
Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
2026-01-13 01:27:23 +00:00
Vault Automation
b7b7002d71
UI: Fix error parsing for creating LDAP roles (#11731) (#11737)
* parse error

* add test coverage

* update test so original code fails the same way

* remove unused vars

Co-authored-by: claire bontempo <68122737+hellobontempo@users.noreply.github.com>
2026-01-13 01:04:45 +00:00
Vault Automation
964ab5a9b4
Backport VAULT-41683: fix false postiive failure notification into ce/main (#11621)
Sometimes our CI slack message outputs the wrong information, most
notably the data race failure when only UI tests run but the UI tests
fail. In an effort to fix this false positive I noticed that there are
several error cases we didn't consider when creating the notification.
Now we only report which failures were detected in the message.

Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Ryan Cragun <me@ryan.ec>
2026-01-12 22:09:44 +00:00
Vault Automation
9abe521b19
Fix another seal healthcheck related data race (#11726) (#11729)
Co-authored-by: Nick Cabatoff <ncabatoff@hashicorp.com>
2026-01-12 20:59:04 +00:00
Vault Automation
a4435c1fd0
VAULT-17006 - Replaced EmptyState component with HDS ApplicationState for "identity" directory (#11652) (#11662)
* VAULT-17006 - Replaced EmptyState component with HDS ApplicationState for "identity" directory

* reverted top margin spacing to use top padding instead

Co-authored-by: mohit-hashicorp <mohit.ojha@hashicorp.com>
Co-authored-by: Dan Rivera <dan.rivera@hashicorp.com>
2026-01-12 15:17:31 -05:00
Vault Automation
ffee73240b
Backport IBM License key integration: config file changes into ce/main (#11665)
* IBM License key integration: config file changes (#11509)

* adding config changes for ibm license entitlement

* added ibm licensing_ent_test

* adding newlicensing test

* fix TestLicenseEntitlementConfig test

* Update vault/core_util_ent.go

Co-authored-by: Jenny Deng <jenny.deng@hashicorp.com>

* Update vault/licensing_ent.go

Co-authored-by: Jenny Deng <jenny.deng@hashicorp.com>

* fixing name GenerateHashicorpTestLicenseConfig

* remove local vscode settings

* add a func to create entitlements and a sample ibm license

---------

Co-authored-by: Jenny Deng <jenny.deng@hashicorp.com>

* go mod tidy

* adding issueroptions to ce

---------

Co-authored-by: akshya96 <87045294+akshya96@users.noreply.github.com>
Co-authored-by: Jenny Deng <jenny.deng@hashicorp.com>
Co-authored-by: akshya96 <araghavan@hashicorp.com>
2026-01-12 10:52:01 -08:00
Vault Automation
1484f71665
VAULT-17006 - Replaced EmptyState component with HDS ApplicationState for "clients" directory (#11648) (#11709)
* VAULT-17006 - Replaced EmptyState component with HDS ApplicationState for "clients" directory

* added missing data-test values to HDS:ApplicationState header and body

* reverted top margin spacing to use top padding instead

* updated class for consistent spacing and added icon & errorCode args

* fixed failing test

* fixed vertical alignment for Hds Application State error

* VAULT-17006 - Replaced EmptyState component with HDS ApplicationState for "clients" directory

* added missing data-test values to HDS:ApplicationState header and body

* reverted top margin spacing to use top padding instead

* updated class for consistent spacing and added icon & errorCode args

* fixed failing test

* fixed vertical alignment for Hds Application State error

* fixed failing test case

Co-authored-by: mohit-hashicorp <mohit.ojha@hashicorp.com>
2026-01-12 16:54:28 +00:00