Merge remote-tracking branch 'remotes/from/ce/main'

Author: hc-github-team-secure-vault-core

changelog/_11044.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+rotation: Fix a bug where a performance secondary would panic if a write was made to a local mount
+```
+
+```release-note:improvement
+rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
+```

vault/logical_system.go

@@ -190,6 +190,7 @@ func NewSystemBackend(core *Core, logger log.Logger, config *logical.BackendConf
 			LocalStorage: []string{
 				expirationSubPath,
 				countersSubPath,
+				rotationLocalSubPath,
 			},
 
 			SealWrapStorage: []string{

vault/rotation.go

@@ -0,0 +1,10 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+const (
+	// rotationLocalSubPath is the sub-path used for the rotation manager's
+	// Local (non-replicated) view. This is nested under the system view.
+	rotationLocalSubPath = "rotation-local/"
+)