Track barrier encryptions and rotate when an operation threshold or time limit is reached.

command/server.go

@@ -1186,6 +1186,7 @@ func (c *ServerCommand) Run(args []string) int {
 		MetricsHelper:             metricsHelper,
 		MetricSink:                metricSink,
 		SecureRandomReader:        secureRandomReader,
+		Barrier:                   config.Barrier,
 	}
 	if c.flagDev {
 		coreConfig.EnableRaw = true

command/server/config_test_helpers.go

@@ -391,6 +391,11 @@ func testLoadConfigFile(t *testing.T) {
 				LeaseMetricsNameSpaceLabels: false,
 			},
 
+			Barrier: &configutil.BarrierConfig{
+				KeyRotationMaxOperations: 1073741824,
+				KeyRotationInterval:      365 * 24 * time.Hour,
+			},
+
 			DisableMlock: true,
 
 			Entropy: nil,
@@ -687,6 +692,10 @@ func testConfig_Sanitized(t *testing.T) {
 			"num_lease_metrics_buckets":              168,
 			"add_lease_metrics_namespace_labels":     false,
 		},
+		"barrier": map[string]interface{}{
+			"key_rotation_max_operations": int64(1073741824),
+			"key_rotation_interval":       8760 * time.Hour,
+		},
 	}
 
 	addExpectedEntSanitizedConfig(expected, []string{"http"})

command/server/test-fixtures/config.hcl

@@ -34,6 +34,11 @@ telemetry {
     metrics_prefix = "myprefix"
 }
 
+barrier {
+    key_rotation_max_operations = 1073741824
+    key_rotation_interval = "8760h"
+}
+
 sentinel {
     additional_enabled_modules = []
 }

command/server/test-fixtures/config3.hcl

@@ -44,6 +44,11 @@ seal "awskms" {
   secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
 }
 
+barrier {
+  key_rotation_max_operations = 1073741824
+  key_rotation_interval = "8760h"
+}
+
 max_lease_ttl = "10h"
 default_lease_ttl = "10h"
 cluster_name = "testcluster"

internalshared/configutil/barrier.go

@@ -0,0 +1,45 @@
+package configutil
+
+import (
+	"fmt"
+	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/hcl"
+	"github.com/hashicorp/hcl/hcl/ast"
+	"github.com/hashicorp/vault/sdk/helper/parseutil"
+	"time"
+)
+
+type BarrierConfig struct {
+	KeyRotationMaxOperations int64 `hcl:"key_rotation_max_operations"`
+	KeyRotationInterval      time.Duration
+	KeyRotationIntervalRaw   interface{} `hcl:"key_rotation_interval"`
+	nextRotation             time.Time
+}
+
+func parseBarrier(result *SharedConfig, list *ast.ObjectList) error {
+	if len(list.Items) > 1 {
+		return fmt.Errorf("only one 'barrier' block is permitted")
+	}
+
+	// Get our one item
+	item := list.Items[0]
+
+	if result.Barrier == nil {
+		result.Barrier = &BarrierConfig{}
+	}
+
+	if err := hcl.DecodeObject(&result.Barrier, item.Val); err != nil {
+		return multierror.Prefix(err, "telemetry:")
+	}
+
+	if result.Barrier.KeyRotationIntervalRaw != nil {
+		var err error
+		if result.Barrier.KeyRotationInterval, err = parseutil.ParseDurationSecond(result.Barrier.KeyRotationIntervalRaw); err != nil {
+			return err
+		}
+		result.Barrier.KeyRotationIntervalRaw = nil
+	} else {
+		result.Barrier.KeyRotationInterval = 0
+	}
+	return nil
+}

internalshared/configutil/config.go

@@ -23,7 +23,8 @@ type SharedConfig struct {
 	DisableMlock    bool        `hcl:"-"`
 	DisableMlockRaw interface{} `hcl:"disable_mlock"`
 
-	Telemetry *Telemetry `hcl:"telemetry"`
+	Telemetry *Telemetry     `hcl:"telemetry"`
+	Barrier   *BarrierConfig `hcl:"barrier"`
 
 	DefaultMaxRequestDuration    time.Duration `hcl:"-"`
 	DefaultMaxRequestDurationRaw interface{}   `hcl:"default_max_request_duration"`
@@ -126,6 +127,12 @@ func ParseConfig(d string) (*SharedConfig, error) {
 		}
 	}
 
+	if o := list.Filter("barrier"); len(o.Items) > 0 {
+		if err := parseBarrier(&result, o); err != nil {
+			return nil, errwrap.Wrapf("error parsing 'barrier': {{err}}", err)
+		}
+	}
+
 	entConfig := &(result.EntSharedConfig)
 	if err := entConfig.ParseConfig(list); err != nil {
 		return nil, errwrap.Wrapf("error parsing enterprise config: {{err}}", err)
@@ -221,5 +228,13 @@ func (c *SharedConfig) Sanitized() map[string]interface{} {
 		result["telemetry"] = sanitizedTelemetry
 	}
 
+	if c.Barrier != nil {
+		sanitizedBarrier := map[string]interface{}{
+			"key_rotation_max_operations": c.Barrier.KeyRotationMaxOperations,
+			"key_rotation_interval":       c.Barrier.KeyRotationInterval,
+		}
+		result["barrier"] = sanitizedBarrier
+	}
+
 	return result
 }

internalshared/configutil/merge.go

@@ -31,6 +31,11 @@ func (c *SharedConfig) Merge(c2 *SharedConfig) *SharedConfig {
 		result.Telemetry = c2.Telemetry
 	}
 
+	result.Barrier = c.Barrier
+	if c2.Barrier != nil {
+		result.Barrier = c2.Barrier
+	}
+
 	result.DisableMlock = c.DisableMlock
 	if c2.DisableMlock {
 		result.DisableMlock = c2.DisableMlock