Describe the bug When using Vault with Consul as the storage backend over HTTPS, Vault continuously logs a "tls: failed to verify certificate: x509: certificate signed by unknown authority" error. This error occurs despite correct configuration, and even when the certificates are verified manually...

Describe the bug Configuration tile in UI shows TLS Disabled, for instance where TLS wasn't disabled. To Reproduce Steps to reproduce the behavior: Run vault in kubernetes using official docker image. There is no config file, configuration is supplied via env var VAULT_LOCAL_CONFIG. Open UI, see...

Vault server runs out of memory when many clients try to log in with certificate. We use client certificates for authentication and every client has a separate role. When a whole environment has been shut down and restarted after maintenance, Vault keeps running out of memory and crashes. In our te...

Describe the bug Attempting to log in with using an AWS auth backend with IAM authentication is triggering a stacktrace with a nil pointer derefrence. Ex. vault login -method aws role=myrole. The current Vault leader itself isn't crashing thankfully, but the auth backend is completely broken. Rever...

Describe the bug Even if the annotation "vault.hashicorp.com/agent-copy-volume-mounts" is added to a StatefulSet, the related volume is not mounted neither in the agent init container, nor in the sidercar. To Reproduce Create a StatefulSet with: ... template: metadata: annotations: vault...

Describe the bug Running vault login -no-store -token-only ... incorrectly prints the Enter the passphrase for methodID prompt to stdout, rather than stderr. This breaks the workflow of storing the token directly to an env variable, and not persisting it to disk. To Reproduce Steps to reproduce the...

Is your feature request related to a problem? Please describe. The builtin jwt auth plugin requires a role-name to be specified during authentication. When authenticated, access is only granted based on the policies of that single role. Even though the JWT satisfies multiple roles' bound claims. Thu...

Environment: Vault Version: v1.14.3 Operating System/Architecture: Ubuntu 22.04 Expected Behavior: The vault service should disable core dumps according to "Production hardening - Disable core dumps". cat /lib/systemd/system/vault.service [Unit] Description="HashiCorp Vault - A tool for managi...

Environment: Vault Version: v1.14.3 Operating System/Architecture: Ubuntu 22.04 Expected Behavior: The vault configuration files should not be writable by Vault service account according to "Production hardening - Allow minimal write privileges". ls -l /etc/vault total 4 -r--r--r-- 1 vault vau...

Is your feature request related to a problem? Please describe. There are cases where multiple client certs are issued with different common names (for e.g. ephemeral host names), but the same OU field that contains a role (for e.g. a service). I want a single entity when multiple logins happen with...