Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VAULT-11595: Augment forwarded requests with host:port info (from/to nodes) (Enterprise) #20733

Merged
merged 3 commits into from
May 24, 2023

Conversation

peteski22
Copy link
Contributor

Enterprise only:

When a perf-standby node receives a request and eventually forwards it to the primary node, audit logs can be written on the the perf-standby and the primary node for both the incoming request, and outgoing response (max 4 entries in total, 2 per each node).

  1. Performance Standby node logs request
  2. Primary node logs (forwarded) request
  3. Primary node logs response to (forwarded) request
  4. Performance Standby node logs response to request

In order to make it clearer in the audit logs that a request was forwarded this PR will add forwarded data to the request object that is used to generate audit log entries. The forwarded data will contain the host of the node that the request is either forwarded from or a forwarded flag.

e.g.

"forwarded_from": "10.0.0.2:8200"

"forwarded": true

We should expect to see forwarded_from in 'request' audit entries on a primary node where the request has been forwarded (2. above), and the forwarded flag in 'response' audit entries that were involved in forwarding (3. and 4. above).

The following Vault Enterprise PR will cover any required population of the data: https://github.com/hashicorp/vault-enterprise/pull/4064

NOTE: This is an updated version of the previously merged (and then reverted) #20689.

@peteski22 peteski22 merged commit 4b0d85e into main May 24, 2023
@peteski22 peteski22 deleted the VAULT-11595_forwarded-from-to branch May 24, 2023 12:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants