Enforce minimum cache size for transit backend

builtin/logical/transit/backend.go

@@ -68,6 +68,12 @@ func Backend(ctx context.Context, conf *logical.BackendConfig) (*backend, error)
 		if err != nil {
 			return nil, fmt.Errorf("Error retrieving cache size from storage: %w", err)
 		}
+
+		minCacheSize := 10
+		if cacheSize != 0 && cacheSize < minCacheSize {
+			b.Logger().Warn("size %d is less than default minimum %d. Cache size is set to %d", cacheSize, minCacheSize, minCacheSize)
+			cacheSize = minCacheSize
+		}
 	}
 
 	var err error

builtin/logical/transit/path_cache_config.go

@@ -3,7 +3,7 @@ package transit
 import (
 	"context"
 	"errors"
-
+	"fmt"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -48,6 +48,12 @@ func (b *backend) pathCacheConfigWrite(ctx context.Context, req *logical.Request
 	if cacheSize < 0 {
 		return logical.ErrorResponse("size must be greater or equal to 0"), logical.ErrInvalidRequest
 	}
+    minCacheSize := 10
+    var resp = &logical.Response{}
+    if cacheSize != 0 && cacheSize < minCacheSize {
+		resp.AddWarning(fmt.Sprintf("size %d is less than default minimum %d. Cache size is set to %d", cacheSize, minCacheSize, minCacheSize))
+		cacheSize = minCacheSize
+	}
 
 	// store cache size
 	entry, err := logical.StorageEntryJSON("config/cache", &configCache{
@@ -60,9 +66,7 @@ func (b *backend) pathCacheConfigWrite(ctx context.Context, req *logical.Request
 		return nil, err
 	}
 
-	resp := &logical.Response{
-		Warnings: []string{"cache configurations will be applied when this backend is restarted"},
-	}
+	resp.AddWarning("cache configurations will be applied when this backend is restarted")
 
 	return resp, nil
 }

changelog/12418.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+Enforce minimum cache size for transit backend
+```

website/content/api-docs/secret/transit.mdx

@@ -1307,7 +1307,7 @@ using the [`/sys/plugins/reload/backend`][sys-plugin-reload-backend] endpoint.
 
 - `size` `(int: 0)` - Specifies the size in terms of number of entries. A size of
   `0` means unlimited. A _Least Recently Used_ (LRU) caching strategy is used for a
-  non-zero cache size.
+  non-zero cache size. Must be 0 (default) or a value greater or equal to 10 (minimum cache size).
 
 ### Sample Payload