From 209fe61dcc35d53a7bb0f1587dd7e6b32a1c3588 Mon Sep 17 00:00:00 2001 From: Andreas Auernhammer Date: Tue, 9 Mar 2021 09:02:35 +0100 Subject: [PATCH] vault: disable Hashicorp Vault with opt-in (#11711) This commit disables the Hashicorp Vault support but provides a way to temp. enable it via the `MINIO_KMS_VAULT_DEPRECATION=off` Vault support has been deprecated long ago and this commit just requires users to take action if they maintain a Vault integration. --- cmd/crypto/config.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cmd/crypto/config.go b/cmd/crypto/config.go index 09a0b314a..6c27a00d1 100644 --- a/cmd/crypto/config.go +++ b/cmd/crypto/config.go @@ -18,6 +18,7 @@ import ( "errors" "math/rand" "net/http" + "os" "reflect" "strconv" "strings" @@ -410,6 +411,9 @@ func NewKMS(cfg KMSConfig) (kms KMS, err error) { } else if cfg.Vault.Enabled && cfg.Kes.Enabled { return kms, errors.New("Ambiguous KMS configuration: vault configuration and kes configuration are provided at the same time") } else if cfg.Vault.Enabled { + if v, ok := os.LookupEnv("MINIO_KMS_VAULT_DEPRECATION"); !ok || v != "off" { // TODO(aead): Remove once Vault support has been removed + return kms, errors.New("Hashicorp Vault is deprecated and will be removed Oct. 2021. To temporarily enable Hashicorp Vault support, set MINIO_KMS_VAULT_DEPRECATION=off") + } kms, err = NewVault(cfg.Vault) if err != nil { return kms, err