$ the-wire · showcase
Vault confines plugin binaries to plugin_directory, Terraform Kubernetes provider tightens namespace labels
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
Vault closed a plugin catalog path that let a raft-restored entry point at a binary outside plugin_directory, while terraform-provider-kubernetes 3.3.0 began rejecting null metadata entries that previously planned cleanly.
fix(plugincatalog): enforce plugin_directory on catalog lookup (#19150) (#19207) hashicorp/vault
The plugin catalog now enforces plugin_directory containment when reading stored entries, after a raft regression test showed an entry restored from a snapshot, with both snapshot and snapshot-force restores, could start a binary outside the configured directory. The test failed until the lookup itself did the containment check, so the fix is on the read path rather than at plugin registration.
v3.3.0 hashicorp/terraform-provider-kubernetes
Version 3.3.0 is a breaking change for kubernetes_namespace_v1: metadata.labels and metadata.annotations entries must now be non-null strings, and null entries that previously passed are rejected at plan time. Omit the offending entries or supply string values; entire maps may still be omitted or set to null. The same release fixes kubernetes_namespace_v1 reporting a missing metadata value.
[UI] VAULT-50865 Hide secrets engine actions the token cannot perform (#19221) (#19228) hashicorp/vault
The standardized secrets engines list rendered "Enable new engine" and "Delete engine path" for every token, so read-only users could launch actions that fail with a 403, and it offered delete on the built-in cubbyhole/ mount that Vault refuses to disable. The route now checks sys/mounts capabilities and drops the header action when the token lacks them.
http: fix top-level data injection missing for namespaced sys/mounts … (#18527) (#19179) hashicorp/vault
Namespaced sys/mounts requests were dropping top-level data injection; the fix moves the path check inline and adds a regression test in external_tests. If you call sys/mounts through a namespace and depend on that injected field, this is the patch that restores it.
VAULT-45456: RAR Type Registry (#15554) (#16700) hashicorp/vault
The RAR type registry lands as Phase 1, with the type registry code, path and capabilities wiring, and changelog included; discovery endpoints are unauthenticated and API sudo paths were updated. It is a new subsystem rather than a fix, so it is worth reading before it shows up in a release you run.
Vault 51023: Adding Oracle (DB) Plugin Known Issue hashicorp/web-unified-docs
The docs long tail is routine: web-unified-docs added a Vault Oracle plugin known-issue note, documented Base64-encoded secret detection in Vault Radar, linked the TFE 1.2.0 S3-compatible storage configuration from its release notes, and documented previously undocumented proxy support through sentinel.hcl plugin configuration for the Sentinel http import.
Action items
- → Update hashicorp/terraform-provider-kubernetes to 3.3.0 and clear null entries from kubernetes_namespace_v1 metadata.... hashicorp/terraform-provider-kubernetes [plan]
- → Upgrade hashicorp/vault to a build containing the plugin catalog plugin_directory enforcement for any deployment usin... hashicorp/vault [plan]
