Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29238

Hashicorp Plugin: Key rotation creates infinity request loop to vault (dos)

    XMLWordPrintable

Details

    • Bug
    • Status: Stalled (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 10.9.1
    • 10.11
    • Encryption
    • None
    • Ubuntu 22.04
      Using apt packages:
      mariadb-server 1:10.9.1+maria~jammy
      mariadb-plugin-hashicorp-key-management 1:10.9.1+maria~jammy
      Vault v1.11.2

    Description

      Hi,

      during evaluation of the Hashicorp Plugin I noticed the problem, that after a rotation of the encryption key in vault (set version 2 of the secret) and a restart of mariadbd I got an request loop (dos) from the hashicorp plugin against vault.

      Reproduce by:

      • Install mariadb-server & mariadb-plugin-hashicorp-key-management 10.9.1
      • Install hashicorp vault, init and unseal vault
      • create secret engine & set a secret key and enable audit_log for debugging purpose:

        vault secrets enable -path /mariadb -version=2 kv
        vault kv put /mariadb/1 data=$(openssl rand -hex 32)
        vault audit enable file file_path=/hashicorp/vault_audit.log
        

      • enable encryption by adding the following block to mariadb section in /etc/mysql/mariadb.conf.d/50-server.cnf:

        [mariadb]
         
        plugin_load_add = hashicorp_key_management
        hashicorp-key-management-vault-url=http://127.0.0.1:8200/v1/mariadb
        hashicorp-key-management-token=xxxxxxxxxxxxxxxxx
         
        innodb_encrypt_tables = FORCE
        innodb_encrypt_log = ON
        innodb_encrypt_temporary_tables = ON
         
        encrypt_tmp_disk_tables = ON
        encrypt_tmp_files = ON
        encrypt_binlog = ON
        aria_encrypt_tables = ON
         
        innodb_encryption_threads = 4
        innodb_encryption_rotation_iops = 2000
        log_error=server.log
        

      • set new key version

        vault kv put /mariadb/1 data=$(openssl rand -hex 32)
        

      • service mariadb restart
      • check /hashicorp/vault_audit.log mariadbd sends an endless loop of requests to vault
        Load of my 1vCPU Instance increases to 7 due to high cpu load of vault & mariadbd

      Attachments

        Activity

          People

            sysprg Julius Goryavsky
            Slm0n Simon Stier
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.