From 9e88a6ef97ea026cbf5e0a3cb3e0ae9b65b7a2ef Mon Sep 17 00:00:00 2001 From: Victor Rodriguez Date: Wed, 14 Jun 2023 21:09:29 +0000 Subject: [PATCH] backport of commit 58f029d6082b5231ca49312c75b360300781d399 --- changelog/21223.txt | 3 +++ sdk/physical/cache.go | 5 +++++ 2 files changed, 8 insertions(+) create mode 100644 changelog/21223.txt diff --git a/changelog/21223.txt b/changelog/21223.txt new file mode 100644 index 000000000000..96605f0a4a3f --- /dev/null +++ b/changelog/21223.txt @@ -0,0 +1,3 @@ +```release-note:bug +core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. +``` diff --git a/sdk/physical/cache.go b/sdk/physical/cache.go index af40f5385957..250078c54c42 100644 --- a/sdk/physical/cache.go +++ b/sdk/physical/cache.go @@ -29,6 +29,11 @@ var cacheExceptionsPaths = []string{ "sys/expire/", "core/poison-pill", "core/raft/tls", + + // Add barrierSealConfigPath and recoverySealConfigPlaintextPath to the cache + // exceptions to avoid unseal errors. See VAULT-17227 + "core/seal-config", + "core/recovery-config", } // CacheRefreshContext returns a context with an added value denoting if the