Describe the bug
Vault exposes root-only API paths. For example: `sys/health.
Ref: https://www.vaultproject.io/docs/enterprise/namespaces#root-only-api-paths
However, a vault.Client with a namespace set via SetNamespace sends the X-Vault-Namespace header to those root-only API paths.
For example:
User-Agent: [Go-http-client/1.1]
X-Vault-Namespace: [test]
X-Vault-Request: [true]
X-Vault-Token: [abc]
Accept-Encoding: [gzip]
This causes Vault 1.9.1 to respond with:
Code: 404. Errors:
unsupported path
To Reproduce
As a simple reproducer - the 1st curl request succeeds while the 2nd fails:
curl -L -X GET "https://localhost:8200/v1/sys/health?drsecondarycode=299&performancestandbycode=299&sealedcode=299&standbycode=299&uninitcode=299"
curl -L -X GET -H 'X-Vault-Namespace: test' "https://localhost:8200/v1/sys/health?drsecondarycode=299&performancestandbycode=299&sealedcode=299&standbycode=299&uninitcode=299"
Expected behavior
Either thevault.Client should not send the X-Vault-Namespace header for root-only API paths or Vault itself should ignore this header in such a case.
Environment:
- Vault Server Version (retrieve with
vault status): 1.9.1
- Vault SDK Version (retrieve with
vault version): 1.5.0
- Server Operating System/Architecture: linux/amd64
Describe the bug
Vault exposes root-only API paths. For example: `sys/health.
Ref: https://www.vaultproject.io/docs/enterprise/namespaces#root-only-api-paths
However, a
vault.Clientwith a namespace set viaSetNamespacesends theX-Vault-Namespaceheader to those root-only API paths.For example:
This causes Vault
1.9.1to respond with:To Reproduce
As a simple reproducer - the 1st curl request succeeds while the 2nd fails:
Expected behavior
Either the
vault.Clientshould not send theX-Vault-Namespaceheader for root-only API paths or Vault itself should ignore this header in such a case.Environment:
vault status):1.9.1vault version):1.5.0