Support vault namespaces in connect CA

[markan]

Follow on to some missed items from #12655

Description

From an internal ticket "Support standard "Vault namespace in the
path" semantics for Connect Vault CA Provider"

Vault allows the namespace to be specified as a prefix in the path of
a PKI definition, but our usage of the Vault API includes calls that
don't support a namespaced key. In particular the sys.* family of
calls simply appends the key, instead of prefixing the namespace in
front of the path.

Unfortunately it is difficult to reliably parse a path with a
namespace; only vault knows what namespaces are present, and the '/'
separator can be inside a key name, as well as separating path
elements. This is in use in the wild; for example
'dc1/intermediate-key' is a relatively common naming schema.

Instead we add two new fields: RootPKINamespace and
IntermediatePKINamespace, which are the absolute namespace paths
'prefixed' in front of the respective PKI Paths.

Testing & Reproduction steps

[ ] manual testing

Links

Asana task

PR Checklist

• updated test coverage
• external facing docs updated
• not a security concern
• checklist folder consulted

Signed-off-by: Mark Anderson [email protected]

[hashicorp-ci]

🤔 This PR has changes in the website/ directory but does not have a type/docs-cherrypick label. If the changes are for the next version, this can be ignored. If they are updates to current docs, attach the label to auto cherrypick to the stable-website branch after merging.

[jkirschner-hashicorp]

@markan : a few questions we can discuss Monday!

[jkirschner-hashicorp]

I noticed some config params (AuthMethod, Namespace) aren't here. Do they need to be?

[boxofrad]

@markan as discussed (again, I'm totally fine with copy-pasta 🍝) here are a couple of options for extracting the concurrency-safe namespace swapping pattern into a helper method:

func (v *VaultProvider) setNamespace(namespace string) func() {
	v.mu.Lock()
	v.client.SetNamespace(namespace)
	return func() {
		v.client.SetNamsepace(v.baseNamspace)
		v.mu.Unlock()
	}
}

func (v *VaultProvider) someMethod(namespace string, arg2 any) {
	restoreNamespace := v.setNamespace(namespace)
	defer restoreNamespace()

	// or..

	defer v.setNamsepace(namespace)()
}

func (v *VaultProvider) withNamespace(namespace string, fn func()) {
	v.mu.Lock()
	v.client.SetNamespace(namespace)
	fn()
	v.client.SetNamsepace(v.baseNamspace)
	v.mu.Unlock()
}

func (v *VaultProvider) someMethod(namespace string, arg2 any) someType {
	var result someType
	v.withNamespace(namespace, func() {
		result = v.client.SomeMethod()
	})
	return result
}

[boxofrad]

Looks good to me, nice work! 🎉

[trujillo-adam]

One bit of feedback about formatting.

[hc-github-team-consul-core]

🍒 If backport labels were added before merging, cherry-picking will start automatically.

To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/662352.

[hashicorp-ci]

After merging, confirm that you see messages like: 🍒✅ Cherry pick of commit ... onto ... succeeded!