Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS] Manual cherry pick PR 28746 to 1.17.x doc #29186

Merged
merged 2 commits into from
Dec 13, 2024
Merged

[DOCS] Manual cherry pick PR 28746 to 1.17.x doc #29186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5120230
Docs/secrets sync ssrf private endpoints (#28746)
pixambi Dec 13, 2024
8fda8c0
Remove extra include
yhyakuna Dec 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions website/content/docs/upgrading/upgrade-to-1.17.x.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,3 +203,5 @@ more details, and information about opt-out.
@include 'known-issues/aws-auth-external-id.mdx'

@include 'known-issues/sync-activation-flags-cache-not-updated.mdx'

@include 'known-issues/1_17_secrets-sync-ssrf-private-endpoints.mdx'
21 changes: 21 additions & 0 deletions website/content/partials/known-issues/1_17_secrets-sync-ssrf-private-endpoints.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
### Secrets Sync SSRF Protection May Block Private Endpoints

As of version 1.17.3, Vault's Secrets Sync includes additional Server-Side Request Forgery (SSRF) protection measures. This security enhancement prevents sync operations to certain IP ranges by introducing a new SSRF-safe HTTP client. The client specifically blocks requests to private IP ranges (such as 10.0.0.0/8), which affects users accessing cloud provider secret stores through private endpoints.

**Impact:**
- Secrets Sync operations to private IP ranges will be blocked
- Affects all destinations when accessed via private endpoints

**Example error message:**

<CodeBlockConfig hideClipboard>

```plaintext
couldn't sync secret with store: failed to publish event: dial tcp [IP]: prohibited IP address: [IP] is not a permitted destination (denied by: 10.0.0.0/8)
```

</CodeBlockConfig>

**Current Workaround:**
1. Remain on Vault version 1.17.2 or earlier if you require Secrets Sync with private endpoints
2. Use public endpoints for your secret store services
Loading