OpenBao 2.1.0 release notes
2.1.0
Release date: November 29, 2024
info
This release had no major changes over the beta.
warning
OpenBao's 2.1.0 Beta Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.
SECURITY
- core/identity: fix root namespace privilege escalation via entity modification. HCSEC-2024-21 / CVE-2024-9180. [GH-695]
- raft: Fix memory exhaustion when processing raft cluster join requests; results in longer challenge/answers. HCSEC-2024-26 / CVE-2024-8185. [GH-690]
- secrets/ssh: Deny globally valid certificate issuance without valid_principals or allow_empty_principals override. HCSEC-2024-20 / CVE-2024-7594. (potentially breaking) [GH-561]
CHANGES
- api: Load all CA certificates specified in environment variables. [GH-574]
- auth/userpass: Drop support for Vault v0.2 password entries with no hash. sys/initialize: Drop support for pre Vault 1.3 stored Shamir share unseal. command/ssh: Drop support for pre Vault 1.1 auto-SSH role detection. plugins: Drop support for pre Vault 0.9.4 non-GRPC communication protocols. core: Drop support for pre Vault 1.10 batch tokens. core: Drop support for pre Vault 1.0 namespaces. [GH-457]
- cli: Remove 'bao transform ...' CLIs as the Transform plugin is not present in OpenBao. [GH-455]
- command/debug: Replace mholt/archiver with standard library utils. This may change file permissions but does not affect archive layout. [GH-611]
- serviceregistration/kubernetes: labels use
openbao
as prefix instead ofvault
. [GH-416] - core: Remove support for Solaris due to lack of Docker support. [GH-710]
FEATURES
- Remove Mount Table Limits: Using transactional storage, we've split the
auth and secret mount tables into separate storage entires, removing the
requirement that the entire table fit into a single storage entry limited by
max_entry_size
. This allows potentially hundreds of thousands of mounts on a single scaled-up server. [GH-622] - Transactional Storage: Plugin developers can now take advantage of safe
storage modification APIs when the underlying physical storage supports
them. The
physical.TransactionalBackend
andlogical.TransactionalStorage
types allow developers to begin read-only and writable transactions, committing or rolling back the desired changes. [GH-292] - Transit: Support PKI CSR and certificate storage alongside key material. This allows callers to securely create keys and submit requests for certificates without the key material leaving Transit. Storage of the certificate on the key avoids the need for an additional K/V mount. Rotation of this certificate and its chain is also supported. [GH-536]
- auth/oidc: Add a new
callback_mode
role option valuedevice
to use the oidc device flow instead of a callback, add a newpoll_interval
role option to control how often to poll for a response, and add a newcallbackmode=device
option to the oidc login method in the cli. [GH-319] - auth/oidc: Add new
callback_mode=direct
role option to cause the oidc callback to be direct to the server instead of the client, and add acallbackmode=direct
option to the oidc login method in the cli. [GH-318] - physical/postgres: Reintroduce Postgres database for OpenBao storage, implementing paginated list support. This feature is currently in preview and breaking changes may occur. [GH-467]
IMPROVEMENTS
- auth/jwt: Allow templating ACL policies from data in claims on JWT or OIDC ID tokens. [GH-618]
- auth/oidc: Add a new
oauth2_metadata
configuration option to enable sending any of the tokens from the token issuer to the client. [GH-320] - core: Add endpoint to inspect request information [GH-513]
- core: Update to Go 1.23.3. [GH-699]
- core: Upgrade RHEL UBI container image to 9.5. [GH-701]
- docker: add
/bin/vault
symlink to docker images [GH-548] - raft: Update to hashicorp/raft@v1.7.1, go.etcd.io/bbolt@v1.3.11 for bug fixes and performance improvements. [GH-633]
- rpm: Fix packaging to properly annotate configs entries for noreplace [GH-639]
- sdk: Use quay.io/openbao/openbao in containerized testing [GH-427]
- secret/pki: Add
revoked_safety_buffer
to control retention on revoked certificates separately from expired certificates. [GH-653] - secret/pki: Delete invalid certificates during tidy via
tidy_invalid_certs=true
if they cannot be parsed due to Go's x509 handling. [GH-665] - secret/pki: Support revoking expired certificates with the
allow_expired_cert_revocation
CRL configuration. [GH-638] - secrets/kv: Implement transactions to prevent canceled operations from corrupting storage. [GH-560]
- secrets/pki: Use transactions for root generation, issuer import [GH-498]
- secrets/pki: add
not_before
parameter to precisely define a certificate's "not before" field. [GH-515] - storage/postgresql: Add support for transactional storage semantics. [GH-608]
- storage/postgresql: Allow table creation to improve first-start UX. [GH-614]
- storage/raft: Add support for transactional storage semantics. [GH-292]
- ui: Remove Vault references on sibebar, splash screen & loading page. [GH-668]
- ui: Update documentation links. [GH-669]
BUG FIXES
- api/output_string: Change vault reference to bao. [GH-511]
- cli: Always pass
BAO_ADDR
to the token helper, so the token helper can know the address even if it was provided through the-address
flag. For compatibility we also setVAULT_ADDR
. [GH-348] - core: Fix server panic on AppRole login requests with invalid parameter typing [GH-512]
- docker: fix collision between the cluster address and local JSON configuration sharing the same variable within the docker-entrypoint script [GH-446]
- docker: fix configuration of bao cluster and redirect address on separate interfaces when using environment variables [GH-682]
- physical/cache: Ensure later modifications to entry do not impact cached value. [GH-483]
- release: remove changelog/ directory from binary release tarballs [GH-641]
- secrets/pki: Fix ACME HTTP-01 challenge validation with IPv6 addresses [GH-559]
- secrets/pki: Fix handling of reusing existing Ed25519 keys [GH-461]
- serviceregistration/k8s: Fix compatibility with legacy VAULT_-prefixed environment variables. [GH-527]
2.1.0-beta20241114
Release date: November 14, 2024
warning
OpenBao's 2.1.0 Beta Release does not include the builtin WebUI! You can only access a running Bao instance via the CLI or API.
SECURITY
- core/identity: fix root namespace privilege escalation via entity modification. HCSEC-2024-21 / CVE-2024-9180. [GH-695]
- raft: Fix memory exhaustion when processing raft cluster join requests; results in longer challenge/answers. HCSEC-2024-26 / CVE-2024-8185. [GH-690]
- secrets/ssh: Deny globally valid certificate issuance without valid_principals or allow_empty_principals override. HCSEC-2024-20 / CVE-2024-7594. (potentially breaking) [GH-561]
CHANGES
- api: Load all CA certificates specified in environment variables. [GH-574]
- auth/userpass: Drop support for Vault v0.2 password entries with no hash. sys/initialize: Drop support for pre Vault 1.3 stored Shamir share unseal. command/ssh: Drop support for pre Vault 1.1 auto-SSH role detection. plugins: Drop support for pre Vault 0.9.4 non-GRPC communication protocols. core: Drop support for pre Vault 1.10 batch tokens. core: Drop support for pre Vault 1.0 namespaces. [GH-457]
- cli: Remove 'bao transform ...' CLIs as the Transform plugin is not present in OpenBao. [GH-455]
- command/debug: Replace mholt/archiver with standard library utils. This may change file permissions but does not affect archive layout. [GH-611]
- serviceregistration/kubernetes: labels use
openbao
as prefix instead ofvault
. [GH-416] - core: Remove support for Solaris due to lack of Docker support. [GH-710]
FEATURES
- Remove Mount Table Limits: Using transactional storage, we've split the
auth and secret mount tables into separate storage entires, removing the
requirement that the entire table fit into a single storage entry limited by
max_entry_size
. This allows potentially hundreds of thousands of mounts on a single scaled-up server. [GH-622] - Transactional Storage: Plugin developers can now take advantage of safe
storage modification APIs when the underlying physical storage supports
them. The
physical.TransactionalBackend
andlogical.TransactionalStorage
types allow developers to begin read-only and writable transactions, committing or rolling back the desired changes. [GH-292] - Transit: Support PKI CSR and certificate storage alongside key material. This allows callers to securely create keys and submit requests for certificates without the key material leaving Transit. Storage of the certificate on the key avoids the need for an additional K/V mount. Rotation of this certificate and its chain is also supported. [GH-536]
- auth/oidc: Add a new
callback_mode
role option valuedevice
to use the oidc device flow instead of a callback, add a newpoll_interval
role option to control how often to poll for a response, and add a newcallbackmode=device
option to the oidc login method in the cli. [GH-319] - auth/oidc: Add new
callback_mode=direct
role option to cause the oidc callback to be direct to the server instead of the client, and add acallbackmode=direct
option to the oidc login method in the cli. [GH-318] - physical/postgres: Reintroduce Postgres database for OpenBao storage, implementing paginated list support. This feature is currently in preview and breaking changes may occur. [GH-467]
IMPROVEMENTS
- auth/jwt: Allow templating ACL policies from data in claims on JWT or OIDC ID tokens. [GH-618]
- auth/oidc: Add a new
oauth2_metadata
configuration option to enable sending any of the tokens from the token issuer to the client. [GH-320] - core: Add endpoint to inspect request information [GH-513]
- core: Update to Go 1.23.3. [GH-699]
- core: Upgrade RHEL UBI container image to 9.5. [GH-701]
- docker: add
/bin/vault
symlink to docker images [GH-548] - raft: Update to hashicorp/raft@v1.7.1, go.etcd.io/bbolt@v1.3.11 for bug fixes and performance improvements. [GH-633]
- rpm: Fix packaging to properly annotate configs entries for noreplace [GH-639]
- sdk: Use quay.io/openbao/openbao in containerized testing [GH-427]
- secret/pki: Add
revoked_safety_buffer
to control retention on revoked certificates separately from expired certificates. [GH-653] - secret/pki: Delete invalid certificates during tidy via
tidy_invalid_certs=true
if they cannot be parsed due to Go's x509 handling. [GH-665] - secret/pki: Support revoking expired certificates with the
allow_expired_cert_revocation
CRL configuration. [GH-638] - secrets/kv: Implement transactions to prevent canceled operations from corrupting storage. [GH-560]
- secrets/pki: Use transactions for root generation, issuer import [GH-498]
- secrets/pki: add
not_before
parameter to precisely define a certificate's "not before" field. [GH-515] - storage/postgresql: Add support for transactional storage semantics. [GH-608]
- storage/postgresql: Allow table creation to improve first-start UX. [GH-614]
- storage/raft: Add support for transactional storage semantics. [GH-292]
- ui: Remove Vault references on sibebar, splash screen & loading page. [GH-668]
- ui: Update documentation links. [GH-669]
BUG FIXES
- api/output_string: Change vault reference to bao. [GH-511]
- cli: Always pass
BAO_ADDR
to the token helper, so the token helper can know the address even if it was provided through the-address
flag. For compatibility we also setVAULT_ADDR
. [GH-348] - core: Fix server panic on AppRole login requests with invalid parameter typing [GH-512]
- docker: fix collision between the cluster address and local JSON configuration sharing the same variable within the docker-entrypoint script [GH-446]
- docker: fix configuration of bao cluster and redirect address on separate interfaces when using environment variables [GH-682]
- physical/cache: Ensure later modifications to entry do not impact cached value. [GH-483]
- release: remove changelog/ directory from binary release tarballs [GH-641]
- secrets/pki: Fix ACME HTTP-01 challenge validation with IPv6 addresses [GH-559]
- secrets/pki: Fix handling of reusing existing Ed25519 keys [GH-461]
- serviceregistration/k8s: Fix compatibility with legacy VAULT_-prefixed environment variables. [GH-527]