-
Notifications
You must be signed in to change notification settings - Fork 4.5k
Open
Labels
Description
Describe the bug
The rekey cancel operation does not work unless a nonce parameter is explicitly provided.
To Reproduce
Steps to reproduce the behavior:
- Initialize rekey:
$ vault operator rekey -init -key-shares=3 -key-threshold=2
Key Value
--- -----
Nonce c78b489a-01fe-a522-e35e-38196be049d7
Started true
Rekey Progress 0/1
New Shares 3
New Threshold 2
Verification Required false-
Wait for 10 minutes.
-
Attempt to cancel rekey without specifying the nonce:
$ vault operator rekey -cancel
Error canceling rekey: Error making API request.
URL: DELETE http://127.0.0.1:8200/v1/sys/rekey/init
Code: 400. Errors:
* EOFExpected behavior
After waiting 10 minutes, the cancel operation should succeed without requiring the nonce (doc link):
$ vault operator rekey -cancel
Success! Canceled rekeying (if it was started)Environment:
- Vault Server Version (retrieve with
vault status): 1.16.x and later (see Additional context) - Vault CLI Version (retrieve with
vault version): N/A - Server Operating System/Architecture: N/A
Vault server configuration file(s):
# Paste your Vault config here.
# Be sure to scrub any sensitive valuesAdditional context
The problem was introduced in #30794.
It has been backported to versions 1.16.x and newer.