Skip to content

HTTP API for pinning plugin versions#25105

Merged
tomhjp merged 8 commits intomainfrom
vault-23129/pin-plugin-version-http-api
Jan 30, 2024
Merged

HTTP API for pinning plugin versions#25105
tomhjp merged 8 commits intomainfrom
vault-23129/pin-plugin-version-http-api

Conversation

@tomhjp
Copy link
Contributor

@tomhjp tomhjp commented Jan 26, 2024

Adds the HTTP API for pinning plugin versions, building on #24960. This lets users in the root namespace safely upgrade plugin versions for the cluster without having to enumerate through child namespaces.

Also:

  • Adds computed running_plugin_version field to the response when reading a database connection config so that users can see when their configured plugin version is being overridden by a pin
  • Adds a warning to the read mount API for the same case for secrets and auth plugins
  • Moves one of the external plugin tests to a different (external) package so it can depend on vault/http and operate on the API like a normal client

Given the size of this already, I've deferred API docs to the next PR.

@tomhjp tomhjp added this to the 1.16.0-rc1 milestone Jan 26, 2024
@tomhjp tomhjp requested a review from a team as a code owner January 26, 2024 18:48
@github-actions github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Jan 26, 2024
return logical.ErrorResponse("missing plugin version"), nil
}
if builtin {
return logical.ErrorResponse("cannot pin a builtin plugin: %q", pluginVersion), nil
Copy link
Contributor Author

@tomhjp tomhjp Jan 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to support pinning to builtin versions, but it requires a bit of extra thought and logic because of the fact we don't want to store builtin versions in storage (they disappear/change as Vault gets updated), so I've deferred this for now.

}, nil
resp := &logical.Response{}
if dbi, err := b.GetConnection(ctx, req.Storage, name); err == nil {
config.RunningPluginVersion = dbi.runningPluginVersion
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be good to add running SHA256 as well like we have for secrets/auth plugins, but this requires a bit of refactoring in the sdk package, so to be pragmatic (and safe) I've left it as just the plugin version for now.

@github-actions
Copy link

Build Results:
All builds succeeded! ✅

@github-actions
Copy link

github-actions bot commented Jan 26, 2024

CI Results:
All Go tests succeeded! ✅

Copy link
Contributor

@fairclothjm fairclothjm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tomhjp
Copy link
Contributor Author

tomhjp commented Jan 30, 2024

Thanks!

@tomhjp tomhjp merged commit 78ef25e into main Jan 30, 2024
@tomhjp tomhjp deleted the vault-23129/pin-plugin-version-http-api branch January 30, 2024 10:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

core/plugin hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants