Backport of Clean up unused CRL entries when issuer is removed into release/1.14.x #23030
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hc-github-team-secure-vault-core
requested a review
from a team
as a code owner
hc-github-team-secure-vault-core
force-pushed
the
backport/cipherboy-fix-crl-removal/unlikely-crack-maggot
branch
2 times, most recently
from
a3aaac4 to
4bffd2a
Compare
github-actions
bot
added
the
hashicorp-contributed-pr
cipherboy
approved these changes
Sep 12, 2023
|
Build Results: |
cipherboy
deleted the
backport/cipherboy-fix-crl-removal/unlikely-crack-maggot
branch
|
CI Results: |
cipherboy
added a commit
that referenced
this pull request
Sep 13, 2023
Co-authored-by: Alexander Scheel <[email protected]>
cipherboy
added a commit
that referenced
this pull request
Sep 13, 2023
Co-authored-by: Alexander Scheel <[email protected]>
cipherboy
added a commit
that referenced
this pull request
Sep 13, 2023
…elease/1.12.x (#23028) * backport of commit e2ff1f1 (#23030) Co-authored-by: Alexander Scheel <[email protected]> * backport of commit 293e8b8 (#23045) Co-authored-by: Steven Clark <[email protected]> * Remove unified CRLs references from v1.12.x Signed-off-by: Alexander Scheel <[email protected]> --------- Signed-off-by: Alexander Scheel <[email protected]> Co-authored-by: Alexander Scheel <[email protected]> Co-authored-by: Steven Clark <[email protected]>
cipherboy
added a commit
that referenced
this pull request
Sep 13, 2023
…elease/1.13.x (#23029) * backport of commit e2ff1f1 (#23030) Co-authored-by: Alexander Scheel <[email protected]> * backport of commit 293e8b8 (#23045) Co-authored-by: Steven Clark <[email protected]> * Fix call of crlBuilder.rebuild Signed-off-by: Alexander Scheel <[email protected]> --------- Signed-off-by: Alexander Scheel <[email protected]> Co-authored-by: Alexander Scheel <[email protected]> Co-authored-by: Steven Clark <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This PR is auto-generated from #23007 to be assessed for backporting due to the inclusion of the label backport/1.14.x.
The below text is copied from the body of the original PR.
When a issuer is removed, the space utilized by its CRL was not freed, both from the CRL config mapping issuer IDs to CRL IDs and from the CRL storage entry. We thus implement a two step cleanup, wherein orphaned CRL IDs are removed from the config and any remaining full CRL entries are removed from disk.
This relates to a Consul<->Vault interop issue (#22980), wherein Consul creates a new issuer on every leadership election, causing this config to grow. Deleting issuers manually does not entirely solve this problem as the config does not fully reclaim space used in this entry.
Notably, an observation that when deleting issuers, the CRL was rebuilt on secondary clusters (due to the invalidation not caring about type of the operation); for consistency and to clean up the unified CRLs, we also need to run the rebuild on the active primary cluster that deleted the issuer as well.
This approach does allow cleanup on existing impacted clusters by simply rebuilding the CRL.
TODO:
Overview of commits