[3007.x] Fixing vault client unwrap function to respect server.verify option.

[voyvodov]

What does this PR do?

Currently VaultClient.unwrap is doing own request call without respecting verify option. Any other function is reusing self.request or self.raw_request function which are respecting correctly verify opt. This will change unwrap function to also utilize self.post() which is reusing self.request.

What issues does this PR fix or reference?

Fixes: #66213

Previous Behavior

Vault module not working with self-signed certificate on disk or verify: False

New Behavior

Vault modules works as expected.

Merge requirements satisfied?

[NOTICE] Bug fixes or features added to Salt require tests.

• Docs
• Changelog - https://docs.saltproject.io/en/master/topics/development/changelog.html
• Tests written/updated

Commits signed with GPG?

Yes

[twangboy]

Hey @voyvodov, thanks for the submission. Would you mind writing a test case for this?

[lkubb]

Ah, we fixed this in the saltext, but forgot to port it here. The correct fix would be to just pass the verify option since unwrap requests do not need to be authenticated. salt-extensions/saltext-vault#32

[voyvodov]

Ah, we fixed this in the saltext, but forgot to port it here. The correct fix would be to just pass the verify option since unwrap requests do not need to be authenticated. salt-extensions/saltext-vault#32

But why making this different? If we don't need auth, why not just removing the headers? This why, if there is need to change something in the way requests are made, a single place will be touched, not "search-and-replace".

[lkubb]

On a second thought, you might be right. I don't remember the specifics of why I implemented unwrapping in this way tbh, but it was intentional at the time. Suspected it was about limiting token usage or some chicken-and-egg problem, but that doesn't hold up when reflecting on the code.

This patch (necessarily) duplicates some light calls regarding header rendering (_get_headers), but should be fine otherwise if all tests pass. Maybe it really was just about efficiency. Thanks for taking the time to fix this. :)

[voyvodov]

Hey @voyvodov, thanks for the submission. Would you mind writing a test case for this?

Added a small test which verifies that unwrap is respecting verify option correctly

[lkubb]

This should be targeted at the 3007.x branch though, master will become 3008, which - as it stands - will not contain the vault modules when released.

[twangboy]

Looks like you have some pre-commit failures

[voyvodov]

Looks like you have some pre-commit failures

Fixed. I'm not sure why it wasn't catched during the last push

[dmurphy18]

@voyvodov You might want to check and see if you need to implement the same changes to the salt-extension for Vault, which has better support for Vault, see https://github.com/salt-extensions/saltext-vault. Eventually this will be the preferred solution in Salt 3008

[voyvodov]

@voyvodov You might want to check and see if you need to implement the same changes to the salt-extension for Vault, which has better support for Vault, see https://github.com/salt-extensions/saltext-vault. Eventually this will be the preferred solution in Salt 3008

It's already there.