upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-06-13 10:56:26 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Fix pkixternalca feature bugs in Vault Agent (#13613) (#13623) (#13625)

Browse source 
* Fix pkiexternalca feature bugs in vault agent

* Add changelog

* Add regression tests

Co-authored-by: Zlaticanin <60530402+Zlaticanin@users.noreply.github.com>
This commit is contained in:
Vault Automation 2026-04-06 10:20:54 -06:00 committed by GitHub
parent 3ef4f6125c
commit 2e6346b2f4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
changelog/_13613.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:bug
agent/pkiexternalca: Fix token distribution to PKI system and HTTP-01 challenge server shutdown preventing certificate acquisition and retries
```

13
command/agent.go
View file

@ -864,13 +864,10 @@ func (c *AgentCommand) Run(args []string) int {
cancelFunc()
})
// ah.TemplateTokenCh is a buffered channel of size 1 — each token sent by
// the auth handler is consumed by exactly one reader. When a PKI external CA
// server is also running, both it and the template server need every token.
// Without a fan-out, they race and one silently misses tokens, leaving the
// template runner never started and templates never rendered.
// The fan-out goroutine reads each token once and forwards it to a separate
// channel for each consumer.
// When a PKI external CA server is running, both it and the template server
// need every token. The auth handler sends tokens to ah.PKIExternalCATokenCh
// when PKI is configured. This fan-out goroutine reads each token once from
// ah.PKIExternalCATokenCh and forwards it to separate channels for each consumer.
templateTokenCh := ah.TemplateTokenCh
var pkiTokenCh chan string
if ps != nil {
@ -881,7 +878,7 @@ func (c *AgentCommand) Run(args []string) int {
select {
case <-ctx.Done():
return
case token, ok := <-ah.TemplateTokenCh:
case token, ok := <-ah.PKIExternalCATokenCh:
if !ok {
return
}