chore(deps): update terraform vault to v5.9.0#144
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/vault-5.x
branch
3 times, most recently
from
31ca24f to
d20ec03
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/vault-5.x
branch
from
d20ec03 to
82d054e
Compare
renovate
Bot
force-pushed
the
renovate/vault-5.x
branch
from
82d054e to
2197a70
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.6.0→5.9.0Release Notes
hashicorp/terraform-provider-vault (vault)
v5.9.0Compare Source
BREAKING CHANGES:
vault_pki_external_ca_. (#2838)FEATURES:
vault_os_secret_backend,vault_os_secret_backend_host, andvault_os_secret_backend_accountresources for managing operating system credentials via SSH. Requires Vault 2.0.0+. (#2865)vault_rotation_policyfor managing rotation policies. Requires Vault 2.0.0+. (#2844)vault_quota_configresource. (#2837)vault_alicloud_secret_backend,vault_alicloud_secret_backend_role, and ephemeral resourcevault_alicloud_access_credentialsfor managing AliCloud secrets engine. (#2858, #2874)vault_plugin_runtimefor managing plugin runtimes in Vault's plugin runtimes catalog. Requires Vault 1.15 or later.(#2835)vault_sys_config_corsresource and data source for managing and reading Vault's CORS (Cross-Origin Resource Sharing) settings. (#2849)IMPROVEMENTS:
vault_cf_auth_backend_config: Addedcf_password_wo_versionto trigger updates when onlycf_password_wochanges.(#2878)vault_pki_secret_backend_config_acme: Added new fields that control the PKI ACME challenge worker IP ranges that they can connect. ([#2839]#2839)azure_access_credentialsandresource_azure_secret_backend_roleresources. (#2734vault_pluginresource. (#2707)vault_ldap_secret_backend: Add self-managed support to ldap secrets engine. Requires Vault Enterprise 2.0+. (#2845)azure_static_role: Add support for importing existing credentials via new Vault import endpoint. (#2756)cloud.google.com/go/authv0.18.2 -> v0.20.0cloud.google.com/go/cloudsqlconnv1.4.3 -> v1.20.2cloud.google.com/go/iamv1.7.0 -> v1.9.0filippo.io/edwards25519v1.1.1 -> v1.2.0github.com/Azure/azure-sdk-for-go/sdk/azcorev1.21.0 -> v1.21.1github.com/Azure/azure-sdk-for-go/sdk/internalv1.11.2 -> v1.12.0github.com/aws/aws-sdk-go-v2v1.41.5 -> v1.41.6github.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.21 -> v1.4.22github.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.21 -> v2.7.22github.com/aws/aws-sdk-go-v2/service/iamv1.53.7 -> v1.53.8github.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.7 -> v1.13.8github.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.21 -> v1.13.22github.com/aws/aws-sdk-go-v2/service/stsv1.41.10 -> v1.42.0github.com/aws/smithy-gov1.24.3 -> v1.25.0github.com/docker/dockerv28.3.3+incompatible -> v28.5.2+incompatiblegithub.com/docker/go-connectionsv0.5.0 -> v0.7.0github.com/fatih/colorv1.18.0 -> v1.19.0github.com/go-jose/go-jose/v3v3.0.4 -> v3.0.5github.com/go-jose/go-jose/v4v4.1.3 -> v4.1.4github.com/googleapis/gax-go/v2v2.20.0 -> v2.21.0github.com/hashicorp/consul/apiv1.33.7 -> v1.34.1github.com/hashicorp/go-secure-stdlib/plugincontainerv0.4.2 -> v0.5.0github.com/hashicorp/terraform-plugin-muxv0.23.0 -> v0.23.1github.com/hashicorp/vault/sdkv0.25.0 -> v0.25.1github.com/jackc/pgtypev1.14.3 -> v1.14.4github.com/oklog/runv1.1.0 -> v1.2.0github.com/opencontainers/image-specv1.1.0 -> v1.1.1go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.61.0 -> v0.67.0go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.61.0 -> v0.67.0go.opentelemetry.io/otelv1.42.0 -> v1.43.0go.opentelemetry.io/otel/metricv1.42.0 -> v1.43.0go.opentelemetry.io/otel/tracev1.42.0 -> v1.43.0golang.org/x/cryptov0.49.0 -> v0.50.0golang.org/x/modv0.33.0 -> v0.34.0golang.org/x/netv0.52.0 -> v0.53.0golang.org/x/sysv0.42.0 -> v0.43.0golang.org/x/textv0.35.0 -> v0.36.0golang.org/x/toolsv0.42.0 -> v0.43.0google.golang.org/apiv0.273.1 -> v0.276.0google.golang.org/genprotov0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260420184626-e10c466a9529google.golang.org/genproto/googleapis/apiv0.0.0-20260401001100-f93e5f3e9f0f -> v0.0.0-20260414002931-afd174a4e478google.golang.org/genproto/googleapis/rpcv0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260414002931-afd174a4e478google.golang.org/grpcv1.79.3 -> v1.80.0k8s.io/utilsv0.0.0-20260210185600-b8788abfbbc2 -> v0.0.0-20260319190234-28399d86e0b5BUGS:
vault_consul_secret_backend: Fixed validation logic to allow computed token values by correcting the condition that checks for token presence during plan phase. (#2823)vault_pki_external_ca_secret_backend_acme_account: Provide eab_kid and eab_key values through the ACME account creation request. ([#2851]#2852)provider/auth_login: Fix "Missing Region" error when using genericauth_loginblock for AWS authentication without explicitsts_regionparameter. The provider now properly resolves AWS region from environment variables (AWS_REGION,AWS_DEFAULT_REGION) and EC2 instance metadata service (IMDS), consistent withauth_login_awsbehavior. (#2786)provider/auth_aws: Fixauth_login_awsfor Vault AWS auth backends configured withuse_sts_region_from_client = trueby generating a standard SigV4-signedGetCallerIdentityrequest with anAuthorizationheader, and added support for custom STS endpoints. (#2841)resource_database_secret_backend_connection: Fixes a regression issue forresource_database_secret_backend_connectionfor elasticsearch. Reverted the field name from insecure_tls to insecure.vault_rabbitmq_secret_backend_role: Fixed spurious diff issue forvhostandvhost_topicfields by changing field type from TypeList to TypeSet. (#2872)provider/auth_aws: Fixauth_login_awsto avoid an unintended second STSAssumeRolecall during web identity credential flows, while preserving manual role assumption for explicitly configured or env-derivedaws_role_arnvalues in non-web-identity setups.(#2850)Release Note:
1.18.x. This means that going forward only Vault server version1.19.xand greater will be officially tested against.v5.8.0Compare Source
FEATURES:
vault_cf_auth_backend_configandvault_cf_auth_backend_roleresources, andvault_cf_auth_loginephemeral resource for short-lived Vault tokens.vault_kmip_secret_ca_generated,vault_kmip_secret_ca_imported,vault_kmip_secret_listener, and add support for thecafield invault_kmip_secret_role: (#2773)vault_secrets_sync_azure_destination: Add support for Workload Identity Federation (WIF) fieldsidentity_token_audience,identity_token_audience_wo_version,identity_token_ttl, andidentity_token_keyto enable token-based authentication with Azure. Requires Vault 2.0.0+. (#2790)vault_secrets_sync_aws_destination: Add support for Workload Identity Federation (WIF) fieldsidentity_token_audience,identity_token_ttl, andidentity_token_keyto enable token-based authentication with AWS. Requires Vault 2.0.0+. (#2792)vault_secrets_sync_gcp_destination: Add support for Workload Identity Federation (WIF) fieldsidentity_token_audience_wo,identity_token_audience_wo_version,identity_token_ttl,identity_token_key_wo,identity_token_key_wo_versionandservice_account_emailto enable token-based authentication with GCP. Requires Vault 2.0.0+. (#2798)vault_generic_secret(#2735)vault_terraform_token, by @drewmullen (#2616)IMPROVEMENTS:
vault_managed_keys: Add support for GCP Cloud KMS managed keys with parameters:credentials,project,key_ring,region,crypto_key,crypto_key_version, andalgorithm. (#2769)vault_okta_auth_backend: Add support for write-only field api_token_wo with version counters to prevent sensitive credentials from being stored in Terraform state. Deprecateorganizationandtokenand replace withorg_nameandapi_tokenrespectively invault_okta_auth_backendresource. (#2736)vault_kubernetes_secret_backend_role: Add support fortoken_default_audiencesfield to configure default audiences for generated Kubernetes tokens. Requires Vault 1.15+. (#2722)vault_raft_snapshot_agent_config: Add support forazure_auth_modeandazure_client_idfields for Azure Managed Identity authentication (Vault Enterprise 1.18.0+), andautoload_enabledfield for automatic snapshot restoration (Vault Enterprise 1.21.0+). (#2758)vault_ssh_secret_backend_role: Add support for fields (default_extensions_template,exclude_cidr_list,port) and improve handling of key-type-specific fields (default_extensions,default_extensions_template,exclude_cidr_list,port) to prevent drift. Fields that are not applicable to a role's key type (CA or OTP) are now conditionally set in state only when returned by Vault, preventing perpetual drift when users configure fields that Vault ignores. CA key type supports:default_extensions,default_extensions_template. OTP key type supports:port,exclude_cidr_list. (#2747)vault_pki_secret_backend_root_certandresource_pki_secret_backend_sign. (#2760)vault_pki_secret_backend_root_cert: Add support foruse_pssandkey_usagefields to configure PSS signature scheme and X.509 key usage constraints for root CA certificates. Requires Vault 1.18.0+ and 1.19.2+ respectively. (#2754)vault_pki_secret_backend_root_sign_intermediate: Add version check forkey_usagefield to ensure compatibility with Vault 1.19.2+ for configuring X.509 key usage constraints on intermediate CA certificates. (#2754)provider/auth_jwt: Add support fordistributed_claim_access_tokenfield in theauth_login_jwtconfiguration block. (#2782)vault_database_secret: Add support for additional credential types (rsa_private_key,client_certificate,private_key,private_key_type) in the ephemeral resource to support all database credential types available in Vault's database secrets engine. (#2767)github.com/Azure/azure-sdk-for-go/sdk/azcorev1.20.0 -> v1.21.0github.com/aws/aws-sdk-go-v2v1.32.5 -> v1.41.3github.com/aws/aws-sdk-go-v2/service/iamv1.38.1 -> v1.53.5github.com/aws/aws-sdk-go-v2/service/stsv1.33.1 -> v1.41.8github.com/aws/smithy-gov1.22.1 -> v1.24.2github.com/coreos/pkgv0.0.0-20230601102743-20bbbf26f4d8 -> v0.0.0-20240122114842-bbd7aa9bf6fbgithub.com/go-viper/mapstructure/v2v2.4.0 -> v2.5.0github.com/googleapis/enterprise-certificate-proxyv0.3.12 -> v0.3.14github.com/hashicorp/consul/apiv1.33.0 -> v1.33.4github.com/hashicorp/go-secure-stdlib/awsutil/v2v2.1.1 -> v2.1.2github.com/hashicorp/terraform-plugin-frameworkv1.16.1 -> v1.19.0github.com/hashicorp/terraform-plugin-gov0.29.0 -> v0.31.0github.com/hashicorp/terraform-plugin-muxv0.21.0 -> v0.23.0github.com/hashicorp/terraform-plugin-sdk/v2v2.38.1 -> v2.40.0github.com/hashicorp/terraform-plugin-testingv1.13.3 -> v1.15.0github.com/hashicorp/vault-plugin-auth-ociv0.20.0 -> v0.20.1github.com/hashicorp/vault/sdkv0.22.0 -> v0.23.0github.com/spiffe/go-spiffe/v2v2.5.0 -> v2.6.0golang.org/x/cryptov0.45.0 -> v0.49.0golang.org/x/netv0.47.0 -> v0.52.0golang.org/x/oauth2v0.31.0 -> v0.36.0golang.org/x/syncv0.19.0 -> v0.20.0golang.org/x/sysv0.41.0 -> v0.42.0golang.org/x/textv0.34.0 -> v0.35.0golang.org/x/timev0.14.0 -> v0.15.0golang.org/x/toolsv0.41.0 -> v0.42.0google.golang.org/apiv0.251.0 -> v0.271.0google.golang.org/genprotov0.0.0-20250603155806-513f23925822 -> v0.0.0-20260311181403-84a4fc48630cgoogle.golang.org/genproto/googleapis/apiv0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260226221140-a57be14db171google.golang.org/genproto/googleapis/rpcv0.0.0-20260217215200-42d3e9bedb6d -> v0.0.0-20260226221140-a57be14db171google.golang.org/grpcv1.79.1 -> v1.79.2hashicorp/setup-terraformv3 -> v4github.com/cloudflare/circlv1.6.1 -> v1.6.3filippo.io/edwards25519v1.1.0 -> v1.1.1k8s.io/utilsv0.0.0-20240102154912-e7106e64919e -> v0.0.0-20260210185600-b8788abfbbc2BUGS:
vault_ldap_auth_backendresource. (#2813)v5.7.0Compare Source
FEATURES:
vault_approle_auth_backend_role_secret_id- Generate AppRole SecretIDs on-demand with automatic cleanup. Requires Terraform 1.10+.(#2745)vault_kubernetes_service_account_token: (#2712)IMPROVEMENTS:
vault_kmip_secret_role: Add support for additional KMIP operation fields (operation_import,operation_query,operation_encrypt,operation_decrypt,operation_create_key_pair,operation_delete_attribute,operation_rng_retrieve,operation_mac,operation_signature_verify,operation_sign,operation_rng_seed,operation_modify_attribute,operation_mac_verify,operation_rekey_key_pair) to grant granular permissions for KMIP operations. (#2744)vault_saml_auth_backend: Add support forvalidate_assertion_signatureandvalidate_response_signatureparameters to control SAML signature validation (Vault 1.19+)vault_approle_auth_backend_login: Add write-only fieldssecret_id_woandsecret_id_wo_versionto support ephemeral SecretID values without persisting them in state.(#2745)vault_password_policy: Add fieldentropy_sourcefield to specify an override to the default source of entropy (randomness) used to generate the passwords.(#2753)vault_mfa_totp: Add support formax_validation_attemptsfield to configure the maximum number of consecutive failed validation attempts allowed. (#2751)vault_mongodbatlas_secret_backend: Add support for write-only private key fields (private_key_wo,private_key_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2741)vault_consul_secret_backend: Add support for write-only fields (token_wo,token_wo_version,client_key_wo,client_key_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2730)vault_azure_auth_backend_config: Add support for write-only client secret fields (client_secret_wo,client_secret_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2726)vault_azure_secret_backend: Add support for write-onlyclient_secret_woandclient_secret_wo_versionfields to configure the client secret without storing it in state. Requires Terraform 1.11+. (#2721)vault_aws_secret_backend: Add write-onlysecret_key_woandsecret_key_wo_versionfields to allow configuring the AWS secret key without storing it in Terraform state (#2713)vault_gcp_auth_backend: Add write-only credential support viacredentials_woandcredentials_wo_versionfields (#2724)vault_ldap_auth_backend: Add write-only field support forbindpassviabindpass_woandbindpass_wo_versionattributes (#2716)vault_ldap_secret_backend: Add write-only field support forbindpassviabindpass_woandbindpass_wo_versionattributes (#2719)vault_aws_auth_backend_client: Add write-only field support forsecret_key(secret_key_woandsecret_key_wo_version) to prevent sensitive AWS credentials from being stored in Terraform state. (#2717)vault_jwt_auth_backend: Add support for write-onlyoidc_client_secret_woandoidc_client_secret_wo_versionfields to prevent storing sensitive OIDC client secrets in Terraform state. (#2714)vault_cert_auth_backend_role: Add support forocsp_max_retriesandocsp_this_update_max_agefields for OCSP configuration. Requires Vault 1.16+. (#2749)vault_kubernetes_auth_backend_config: Add support for write-onlytoken_reviewer_jwt_wofield withtoken_reviewer_jwt_wo_versionto prevent sensitive JWT token from being stored in Terraform state (#2715)vault_kubernetes_secret_backend: Add write-only fieldsservice_account_jwt_woandservice_account_jwt_wo_versionfor managing service account JWT credentials without storing them in state.(#2720)vault_nomad_secret_backend: Add support for write-only fieldstoken_woandclient_key_wowith version counters to prevent sensitive credentials from being stored in Terraform state. (#2729)Add support for fields:
context,managed_key_name,managed_key_idinvault_transit_secret_backend_keyresource. (#2743)vault_rabbitmq_secret_backend: Add support for write-onlypassword_woandpassword_wo_versionfields to configure the password without storing it in state. Requires Terraform 1.11+. (#2733)vault_approle_auth_backend_role_secret_id: Add support fortoken_bound_cidrsparameter to specify blocks of IP addresses which can use the auth tokens generated by a SecretID. (#2718)vault_secrets_sync_gcp_destination: Add support for replication field (replication_locations; Vault 1.18+), networking allowlist fields (allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking; Vault 1.19+), and encryption fields (global_kms_key,locational_kms_keys; Vault 1.19+) invault_secrets_sync_gcp_destinationresource. (#2699)Add support for networking allowlist fields (
allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking) invault_secrets_sync_azure_destinationresource. Requires Vault 1.19+. (#2702)vault_database_secret_backend_connection: Add support for MongoDBwrite_concernparameter and TLS parameters (tls_ca,tls_certificate_key) (#2678)Add support for
username_templateparameter invault_database_secret_backend_connectionandvault_database_secrets_mountresource for MongoDB Atlas(#2674)Add support for
username_templateparameter invault_database_secret_backend_connectionandvault_database_secrets_mountresources for HANADB connections: (#2671)Add support for networking allowlist fields (
allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking) invault_secrets_sync_vercel_destinationresource. Requires Vault 1.19+. (#2681)Add support for configuration parameters (
allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking,secrets_location,environment_name) invault_secrets_sync_gh_destinationresource. Requires Vault 1.18+ forsecrets_location,environment_name.Requires Vault 1.19+ forallowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking.(#2697).Add support for
tls_server_name,local_datacenter,socket_keep_alive,consistencyandusername_templateparameters for Cassandra invault_database_secret_backend_connectionresource. (#2677)vault_secrets_sync_aws_destination: Add support for networking configuration parametersallowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports, anddisable_strict_networkingto control outbound connections from Vault to AWS Secrets Manager. Requires Vault 1.19.0+.(#2698)Updated dependencies:
github.com/hashicorp/go-secure-stdlib/awsutilv0.3.0 -> v2.1.1Docs: fix heredoc example for LDAP dynamic role LDIFs ([#2728]#2728)
Docs: Update example to use write-only attribute ([#2731]#2731)
vault_database_secret_backend_connection: Add support for top-levelplugin_versionandpassword_policyfields to allow configuration at the resource level in addition to engine-specific blocks. (#2748)vault_database_secret_backend_connection: Add support forskip_static_role_import_rotationfield to skip initial password rotation when creating static roles. This value is inherited by static roles that do not explicitly setskip_import_rotation. Requires Vault 1.19+ Enterprise. (#2748)vault_database_secret_backend_static_role: Theskip_import_rotationfield now correctly reads Vault's computed value into state. When not set in config, it inherits from the connection'sskip_static_role_import_rotationsetting. Requires Vault 1.19+ Enterprise. (#2748)vault_database_secret_mount: Addedplugin_version,skip_static_role_import_rotationandpassword_policyfields to allow configuration at the resource level(#2748)Add support for
local_secret_idswhich may only be set at role creation. On updates the provider will send the original creation value to Vault to avoid unintentionally attempting to modify this immutable setting.The provider now surfaces Vault's native immutability error when an update attempts to changelocal_secret_ids.(#2723)BUGS:
provider/auth_login_aws: Fix issue where AWS authentication with IAM role assumption (aws_role_arn) was not working correctly due to incorrect credential handling (#2679)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.