Question: why vault-ruby gem is treated as old client?

hunter86bg · September 2, 2022, 1:07pm

As per these comments old clients use “sys/renew” while new ones use “sys/lease/renew”.

Why the vault-ruby is treated as an old client (trial and error helped me figure out that I need the old-client policy for lease renewal) ?

maxb · September 2, 2022, 1:39pm

Because the authors of vault-ruby haven’t updated it, I guess.

hunter86bg · September 2, 2022, 2:36pm

You are right:

github.com

hashicorp/vault-ruby/blob/9ebb47e0c39c49e2fb867c94bbfd7a1d9821bbb7/lib/vault/api/sys/lease.rb#L14


      
          #
          # @example
          #   Vault.sys.renew("aws/username") #=> #<Vault::Secret ...>
          #
          # @param [String] id
          #   the lease ID
          # @param [Fixnum] increment
          #
          # @return [Secret]
          def renew(id, increment = 0)
            json = client.put("/v1/sys/renew/#{id}", JSON.fast_generate(
              increment: increment,
            ))
            return Secret.decode(json)
          end
          
          
# Revoke the secret at the given id. If the secret does not exist, an error
          # will be raised.
          #
          # @example
          #   Vault.sys.revoke("aws/username") #=> true

They use the old path. Yet, the documentation doesn’t mention about the old API and I was wondering why the policy doesn’t work

Topic		Replies	Views
Default policy has sys/leases/renew, wont this allow a bad actor to extend the lease of dynamic secret Vault	2	464	October 14, 2020
Trying to understand token leases and when/how to renew Vault	5	8945	February 19, 2020
Sys/expire/id/auth/aws/login full of entries ...? Vault	2	1330	December 30, 2020
[Solved] Vault ruby gem - aws_iam authentication Vault	6	806	February 23, 2023
Vault username and expired lease Vault	3	320	December 5, 2022

Question: why vault-ruby gem is treated as old client?

Related topics