diff --git a/changelog/66213.fixed.md b/changelog/66213.fixed.md new file mode 100644 index 000000000000..96f3a3139e84 --- /dev/null +++ b/changelog/66213.fixed.md @@ -0,0 +1 @@ +Fix vault module doesn't respect `server.verify` option during unwrap if verify is set to `False` or CA file on the disk diff --git a/salt/utils/vault/client.py b/salt/utils/vault/client.py index 0553646ae749..5dfa84673a19 100644 --- a/salt/utils/vault/client.py +++ b/salt/utils/vault/client.py @@ -240,17 +240,14 @@ def unwrap(self, wrapped, expected_creation_path=None): namespace=self.namespace, verify=self.verify, ) - url = self._get_url("sys/wrapping/unwrap") + endpoint = "sys/wrapping/unwrap" headers = self._get_headers() payload = {} if "X-Vault-Token" not in headers: headers["X-Vault-Token"] = str(wrapped) else: payload["token"] = str(wrapped) - res = self.session.request("POST", url, headers=headers, json=payload) - if not res.ok: - self._raise_status(res) - return res.json() + return self.post(endpoint=endpoint, add_headers=headers, payload=payload) def wrap_info(self, wrapped): """ diff --git a/tests/pytests/unit/utils/vault/test_client.py b/tests/pytests/unit/utils/vault/test_client.py index 883d656bc6f2..66902964ed4a 100644 --- a/tests/pytests/unit/utils/vault/test_client.py +++ b/tests/pytests/unit/utils/vault/test_client.py @@ -280,6 +280,24 @@ def test_vault_client_unwrap_should_default_to_token_header_before_payload( assert headers.get("X-Vault-Token") == token +@pytest.mark.usefixtures("server_config") +@pytest.mark.parametrize( + "server_config", + ({"verify": "/usr/local/share/ca-certificates/my-ca.crt"},), + indirect=True, +) +def test_vault_client_unwrap_respects_verify_option(role_id_response, client, req): + """ + As unwrap is special call which can be done both authenticated and unauthenticated + we need to ensure that in both cases it respects verify option. + """ + token = "test-wrapping-token" + req.return_value = _mock_json_response(role_id_response) + client.unwrap(token) + verify = req.call_args.kwargs.get("verify", None) + assert verify == client.get_config()["verify"] + + @pytest.mark.parametrize("func", ["unwrap", "token_lookup"]) @pytest.mark.parametrize( "req_failed,expected",