Add paths for seal config to cache exceptions. (#21223)

Add paths for seal config to cache exceptions. Add barrierSealConfigPath and recoverySealConfigPlaintextPath to cacheExceptionsPaths in order to avoid a race that causes some nodes to always see a nil value.
hashicorp · Jun 14, 2023 · 58f029d · 58f029d
1 parent ddff68c
commit 58f029d
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/changelog/21223.txt b/changelog/21223.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures.
+```
diff --git a/sdk/physical/cache.go b/sdk/physical/cache.go
@@ -32,6 +32,11 @@ var cacheExceptionsPaths = []string{
 	"sys/expire/",
 	"core/poison-pill",
 	"core/raft/tls",
+
+	// Add barrierSealConfigPath and recoverySealConfigPlaintextPath to the cache
+	// exceptions to avoid unseal errors. See VAULT-17227
+	"core/seal-config",
+	"core/recovery-config",
 }
 
 // CacheRefreshContext returns a context with an added value denoting if the