Fix regression in returning empty value for approle cidrlist. (#13235)

Author: ncabatoff

builtin/credential/approle/validation.go

@@ -118,6 +118,11 @@ func decodeSecretIDStorageEntry(entry *logical.StorageEntry) (*secretIDStorageEn
 	}
 
 	cleanup := func(in []string) []string {
+		if len(in) == 0 {
+			// Don't change unnecessarily, if it was empty list leave as empty list
+			// instead of making it nil.
+			return in
+		}
 		var out []string
 		for _, s := range in {
 			out = append(out, parseip.TrimLeadingZeroesCIDR(s))

changelog/13235.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+auth/approle: Fix regression where unset cidrlist is returned as nil instead of zero-length array.
+```