Conditionally overwrite TLS parameters for MySQL secrets engine#9729
Merged
Conversation
Overwrite MySQL TLS configuration in MySQL DSN only if have `tls_ca` or `tls_certificate_key` set Current logic always overwrites it
pcman312
approved these changes
Aug 17, 2020
catsby
added a commit
that referenced
this pull request
Aug 18, 2020
* master: Add a section to the MySQL secrets plugin docs about x509 (#9757) Update documentation for MySQL Secrets Engine (#9671) Conditionally overwrite TLS parameters for MySQL secrets engine (#9729) Correctly mark Cassandra as not supporting static roles (#9750) changelog++ pki: Allow to use not only one variable during templating in allowed_domains #8509 (#9498) agent/templates: update consul-template to v0.25.1 (#9626) Restoring the example policies for blocking sha1 (#9677) changelog++ changelog++ Document the new SSH signing algorithm option. (#9197) CHANGELOG-+ CHANGELOG++ Trail of bits 018 (#9674)
Contributor
Author
|
Would it be possible to know, when this change will be in a public release? |
|
My sincerest apologies. It looks like this was slated for an earlier release but the backport got bungled and didn't make it into the release. |
|
We'll be releasing it as part of the 1.5.5 release which should be in the next couple weeks. Once again, apologies that this wasn't released sooner. |
Valarissa
pushed a commit
that referenced
this pull request
Oct 1, 2020
* Conditionally overwrite TLS parameters in MySQL DSN Overwrite MySQL TLS configuration in MySQL DSN only if have `tls_ca` or `tls_certificate_key` set Current logic always overwrites it * Add test for MySQL DSN with a valid TLS parameter in query string
Valarissa
pushed a commit
that referenced
this pull request
Oct 1, 2020
… (#10073) * Conditionally overwrite TLS parameters in MySQL DSN Overwrite MySQL TLS configuration in MySQL DSN only if have `tls_ca` or `tls_certificate_key` set Current logic always overwrites it * Add test for MySQL DSN with a valid TLS parameter in query string Co-authored-by: arnis <8789226+0x63lv@users.noreply.github.com>
sapk
pushed a commit
to sapk-fork/vault
that referenced
this pull request
Oct 6, 2025
hashicorp#9739) (hashicorp#9742) Signed-off-by: Ryan Cragun <me@ryan.ec> Co-authored-by: Ryan Cragun <me@ryan.ec>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes to how connections to MySQL secrets engine are set up, which were introduced with #9181 and released with Vault 1.5.0, broke a working setup in Vault versions prior to 1.5.0, where a valid TLS parameter was set in MySQL DSN (e.g.
...?tls=true).If none of the new parameters introduced with 1.5.0 (
tls_caortls_certificate_key) would be set, the TLS configuration would be empty, and it would be written over the existing TLS parameters in the DSN (e.g.tls=true), resulting in a non-TLS connection attempt to MySQL.This PR would change that behaviour, and only overwrite the TLS parameters in the DSN, if at least one of the
tls_caortls_certificate_keyparameters are set. Otherwise it would leave the TLS configuration set in DSN as-is.Tests also updated with this case.