Don't rely on post-unseal funcs being run in any particular order. (#…

…22362)
hashicorp · Aug 16, 2023 · 5a60c98 · 5a60c98
1 parent 5374b3b
commit 5a60c98
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 8 deletions.
diff --git a/changelog/24170.txt → changelog/21470.txt b/changelog/24170.txt → changelog/21470.txt
diff --git a/changelog/22362.txt b/changelog/22362.txt
@@ -0,0 +1,3 @@
+```release-note:bug 
+core: Fix readonly errors that could occur while loading mounts/auths during unseal
+```
diff --git a/vault/auth.go b/vault/auth.go
@@ -798,10 +798,6 @@ func (c *Core) setupCredentials(ctx context.Context) error {
 		view.setReadOnlyErr(logical.ErrSetupReadOnly)
 		if strutil.StrListContains(singletonMounts, entry.Type) {
 			defer view.setReadOnlyErr(origViewReadOnlyErr)
-		} else {
-			c.postUnsealFuncs = append(c.postUnsealFuncs, func() {
-				view.setReadOnlyErr(origViewReadOnlyErr)
-			})
 		}
 
 		// Initialize the backend
@@ -914,6 +910,9 @@ func (c *Core) setupCredentials(ctx context.Context) error {
 					postUnsealLogger.Error("skipping initialization for nil auth backend")
 					return
 				}
+				if !strutil.StrListContains(singletonMounts, localEntry.Type) {
+					view.setReadOnlyErr(origViewReadOnlyErr)
+				}
 
 				err := backend.Initialize(ctx, &logical.InitializationRequest{Storage: view})
 				if err != nil {

diff --git a/vault/mount.go b/vault/mount.go
@@ -1514,10 +1514,6 @@ func (c *Core) setupMounts(ctx context.Context) error {
 		view.setReadOnlyErr(logical.ErrSetupReadOnly)
 		if strutil.StrListContains(singletonMounts, entry.Type) {
 			defer view.setReadOnlyErr(origReadOnlyErr)
-		} else {
-			c.postUnsealFuncs = append(c.postUnsealFuncs, func() {
-				view.setReadOnlyErr(origReadOnlyErr)
-			})
 		}
 
 		var backend logical.Backend
@@ -1603,6 +1599,9 @@ func (c *Core) setupMounts(ctx context.Context) error {
 					postUnsealLogger.Error("skipping initialization for nil backend", "path", localEntry.Path)
 					return
 				}
+				if !strutil.StrListContains(singletonMounts, localEntry.Type) {
+					view.setReadOnlyErr(origReadOnlyErr)
+				}
 
 				err := backend.Initialize(ctx, &logical.InitializationRequest{Storage: view})
 				if err != nil {