Require vault access token to always be in file #378
Conversation
Codecov ReportAttention: Patch coverage is
❌ Your project status has failed because the head coverage (85.23%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## TDE_REL_17_STABLE #378 +/- ##
=====================================================
- Coverage 85.39% 85.23% -0.17%
=====================================================
Files 22 22
Lines 2602 2533 -69
Branches 393 384 -9
=====================================================
- Hits 2222 2159 -63
+ Misses 304 300 -4
+ Partials 76 74 -2
🚀 New features to boost your workflow:
|
|
I love this PR! Getting rid of unnecessary features this close to release feels amazing 🎉 Do we need to rename unrelated tests though? I think I'd prefer to just leave the holes in the sequence over changing the filenames of them. EDIT: Because commit archaeology gets harder when they're renamed unnecessarily. |
|
Changes approved from docs side, thank you for the replies! |
Before this PR, we allowed for the access token for the Vault key provider to be specified directly in the argument of SQL functions. And that's a security issue.
After this PR, the access token must always be in a file, and SQL functions accept a path to that file.
It also removes the support for external fields from the key provider options parser. The JSON parser now accepts only one-dimensional documents, with option values that must be scalars. Any data extraction and other now should be done by callers.
Fixes PG-1477, PG-1589