Add custom key metadata

[ccapurso]

Overview

kv-v2 does not provide the ability to specify custom key metadata to describe a secret. A possible workaround is to store this metadata as part of the secret data itself. Doing so results in the metadata having the same ACL access as the data. This change includes a new custom_metadata field to the key metadata that will allow users to specify arbitrary version-agnostic metadata.

Design of Change

How was this change implemented?
A new custom_metadata field has been added to the key metadata as a map of string-to-string key-value pairs (i.e. map<string, string>). The write (POST and PUT) and read operations for the /<mount>/metadata/:path endpoint have been modified to handle this new field. In the case of a POST or PUT, validation will be run against the input. The provided map cannot have more than 64 keys. If the key count is less than 64, the following checks are performed for each key-value pair:

• 0 < length of key <= 128
• 0 < length of value <= 512
• keys and values cannot include unprintable characters

All errors will be rolled up and returned as a multierror. If no errors are found, the custom_metadata field will be stored alongside the other key metadata. There is no patching support for this field at this time. With that said, the value in storage will be completely overwritten by the provided value in the request. If the custom_metadata field is not provided in a request, the stored value should persist as is.

Related Issues/Pull Requests

Resolves Vault Issue #7905
Associated with Vault PR #12218

Contributor Checklist

• Upstream docs PR - Vault #12218
• Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
• Backwards compatible

[vishalnayak]

🎉 Great work!

[bradly-swart]

Thanks for the awesome work, this is exactly what I was looking for!

I thought it would work out the box included in the main vault binary, but seems not.
How exactly is this fed into the upstream main vault releases ? Or do I need to install this as a custom vault plugin ?

EDIT: Just found that its looking to be included in the Vault 1.9 release -> https://github.com/hashicorp/vault/milestone/100

[ccapurso]

Thanks for the comment, @bradly-swart! I wanted to confirm the statement that you provided in your EDIT. This feature will be part of the Vault 1.9 release.