Skip to content

Rekey cancel returns 400 EOF error unless nonce is provided #31649

@tsaarni

Description

@tsaarni

Describe the bug
The rekey cancel operation does not work unless a nonce parameter is explicitly provided.

To Reproduce
Steps to reproduce the behavior:

  1. Initialize rekey:
$ vault operator rekey -init -key-shares=3 -key-threshold=2
Key                      Value
---                      -----
Nonce                    c78b489a-01fe-a522-e35e-38196be049d7
Started                  true
Rekey Progress           0/1
New Shares               3
New Threshold            2
Verification Required    false
  1. Wait for 10 minutes.

  2. Attempt to cancel rekey without specifying the nonce:

$ vault operator rekey -cancel
Error canceling rekey: Error making API request.

URL: DELETE http://127.0.0.1:8200/v1/sys/rekey/init
Code: 400. Errors:

* EOF

Expected behavior

After waiting 10 minutes, the cancel operation should succeed without requiring the nonce (doc link):

$ vault operator rekey -cancel
Success! Canceled rekeying (if it was started)

Environment:

  • Vault Server Version (retrieve with vault status): 1.16.x and later (see Additional context)
  • Vault CLI Version (retrieve with vault version): N/A
  • Server Operating System/Architecture: N/A

Vault server configuration file(s):

# Paste your Vault config here.
# Be sure to scrub any sensitive values

Additional context
The problem was introduced in #30794.
It has been backported to versions 1.16.x and newer.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions