Method reloadSeals

command/server.go:3290–3395

reloadSeals reloads configuration files and determines whether it needs to re-create the Seal.Access() objects. This function needs do detect that core.SealAccess() is no longer using the seal Wrapper that is specified in the seal configuration files. This function returns true if the newConfig was

(ctx context.Context, grabStateLock bool, core *vault.Core, newConfig *server.Config)

// This function returns true if the newConfig was used to re-create the Seal.Access() objects. In other words,
// if false is returned, there were no changes done to the seals.
func (c *ServerCommand) reloadSeals(ctx context.Context, grabStateLock bool, core *vault.Core, newConfig *server.Config) (bool, error) {
	if core.IsInSealMigrationMode(grabStateLock) {
		c.logger.Debug("not reloading seal configuration since Vault is in migration mode")
		return false, nil
	}

	currentConfig := core.GetCoreConfigInternal()

	// We only want to reload if multiseal is currently enabled, or it is being enabled
	if !(currentConfig.IsMultisealEnabled() || newConfig.IsMultisealEnabled()) {
		c.logger.Debug("not reloading seal configuration since enable_multiseal is not set, nor is it being disabled")
		return false, nil
	}

	if conf, err := core.PhysicalBarrierSealConfig(ctx); err != nil {
		return false, fmt.Errorf("error reading barrier seal configuration from storage while reloading seals: %w", err)
	} else if conf == nil {
		c.logger.Debug("not reloading seal configuration since there is no barrier config in storage (the seal has not been initialized)")
		return false, nil
	}

	if core.SealAccess().BarrierSealConfigType() == vault.SealConfigTypeShamir {
		switch {
		case len(newConfig.Seals) == 0:
			// We are fine, our ServerCommand.reloadConfigFiles() does not do the "automagic" creation
			// of the Shamir seal configuration.
			c.logger.Debug("not reloading seal configuration since the new one has no seal stanzas")
			return false, nil

		case len(newConfig.Seals) == 1 && newConfig.Seals[0].Disabled:
			// If we have only one seal and it is disabled, it means that the newConfig wants to migrate
			// to Shamir, which is not supported by seal reloading.
			c.logger.Debug("not reloading seal configuration since the new one specifies migration to Shamir")
			return false, nil

		case len(newConfig.Seals) == 1 && newConfig.Seals[0].Type == vault.SealConfigTypeShamir.String():
			// Having a single Shamir seal in newConfig is not really possible, since a Shamir seal
			// is specified in configuration by *not* having a seal stanza. If we were to hit this
			// case, though, it is equivalent to trying to migrate to Shamir, which is not supported
			// by seal reloading.
			c.logger.Debug("not reloading seal configuration since the new one has single Shamir stanza")
			return false, nil
		}
	}

	// Verify that the new config we picked up is not trying to migrate from autoseal to shamir
	if len(newConfig.Seals) == 1 && newConfig.Seals[0].Disabled {
		// If we get here, it means the node was not started in migration mode, but the new config says
		// we should go into migration mode. This case should be caught by the core.IsInSealMigrationMode()
		// above.

		return false, errors.New("not reloading seal configuration: moving from autoseal to shamir requires seal migration")
	}

	// Verify that the new config we picked up is not trying to migrate shamir to autoseal
	if core.SealAccess().BarrierSealConfigType() == vault.SealConfigTypeShamir {
		return false, errors.New("not reloading seal configuration: moving from Shamir to autoseal requires seal migration")
	}