Add patch support

[ccapurso]

Overview

Providing supplemental data or performing a partial update to a KV secret entry currently requires a GET request, local update, and PUT request. This process has both security and data integrity implications. Requiring a user to fetch a KV secret’s data in full when attempting to perform a partial update necessitates the read ACL capability for a given endpoint. One might want to allow a user or system to update secret entries but not read them.

Vault PR #12687 introduces support for HTTP PATCH requests, specifically JSON merge patch requests, along with a new patch ACL capability. The new logical operation to handle backend requests is called PatchOperation.

Design of Change

A PatchOperation handler was added to the data path (/<mount>/data/:path). Like the CreateOperation handler, it uses check-and-set and is specified as the cas field within the options map. The cas validation logic was abstracted so that both the CreateOperation and PatchOperation handlers could perform consistent checks.

A PATCH request must be performed on an existing resource. If a key metadata entry exists without data, a 404 is returned with the version (which should be 0), created_time, deletion_time, and destroyed fields. This response payload is consistent for the same scenario in the ReadOperation handler. If no key metadata or data entry exists for the path requested, the PatchOperation short circuits and will ultimately bubble up to a 404 within Vault's response handling logic.

The JSON merge patch abstraction within Vault (framework.HandlePatchOperation) accepts an optional preprocessor function. This is due to the inconsistency between what API endpoints accept as input and what is ultimately stored. In the case of KV's data endpoint, only the map under the data key needs to be stored. The preprocessor function simply pulls that out as the data to use in the JSON merge patch operation with the existing []byte data read from storage for the current version of the secret.

The logic to cleanup old versions has been abstracted so that is performed consistently between the CreateOperation and PatchOperation handlers.

A successful response will include the version, created_time, deletion_time, and destroyed fields for the newly created version of the secret entry.

Related Issues/Pull Requests

• Issue #1468

• Issue #7437

• Issue #12330

• Vault HTTP PATCH PR #12687

• Vault Docs Update PR #12689

[ncabatoff]

Haven't yet got to the tests but the changes overall look good. And thanks for the wonderful PR description and comments!