From 6cf7ffc26bcbc8f4ef0e4ad2879fcd114332c4e2 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Fri, 10 Apr 2026 09:55:22 -0400 Subject: [PATCH] feat(vault): add skip_ssl_verify option for HashiCorp Vault (#8791) * [ee] feat(vault): add skip_ssl_verify option for HashiCorp Vault Adds an optional skip_ssl_verify boolean to VaultSettings so self-signed Vault deployments can be used in development without needing a custom CA bundle. The flag is surfaced as a Toggle in the HashiCorp Vault section of the secret backend instance settings and plumbed through to the EE Vault HTTP client builder. Co-Authored-By: Claude Opus 4.6 (1M context) * chore: update ee-repo-ref to bcfb663f9e902539abbbf69c517715eb8d4ce8f9 This commit updates the EE repository reference after PR #526 was merged in windmill-ee-private. Previous ee-repo-ref: 7e1372b8f59fe81aaf61212970ebdf2286be864d New ee-repo-ref: bcfb663f9e902539abbbf69c517715eb8d4ce8f9 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.6 (1M context) Co-authored-by: windmill-internal-app[bot] --- backend/ee-repo-ref.txt | 2 +- backend/windmill-api/openapi.yaml | 3 +++ backend/windmill-common/src/secret_backend/mod.rs | 4 ++++ backend/windmill-common/src/secret_backend/tests.rs | 1 + .../tests/secret_backend_integration.rs | 2 ++ .../windmill-common/tests/secret_backend_migration.rs | 1 + .../instanceSettings/SecretBackendConfig.svelte | 11 +++++++++-- 7 files changed, 21 insertions(+), 3 deletions(-) diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt index 3bf97f0d99..5ee5e38328 100644 --- a/backend/ee-repo-ref.txt +++ b/backend/ee-repo-ref.txt @@ -1 +1 @@ -62a462461271b900351c18b0ab1ca78651154b2a +bcfb663f9e902539abbbf69c517715eb8d4ce8f9 diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml index 85357437a0..2a151d966c 100644 --- a/backend/windmill-api/openapi.yaml +++ b/backend/windmill-api/openapi.yaml @@ -19904,6 +19904,9 @@ components: token: type: string description: Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication) + skip_ssl_verify: + type: boolean + description: Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments. AzureKeyVaultSettings: type: object diff --git a/backend/windmill-common/src/secret_backend/mod.rs b/backend/windmill-common/src/secret_backend/mod.rs index 2e0d6d0f21..8caaed6012 100644 --- a/backend/windmill-common/src/secret_backend/mod.rs +++ b/backend/windmill-common/src/secret_backend/mod.rs @@ -129,6 +129,10 @@ pub struct VaultSettings { /// If provided, this is used instead of JWT authentication #[serde(skip_serializing_if = "Option::is_none")] pub token: Option, + /// Skip TLS certificate verification when connecting to Vault + /// Only use for self-signed certificates in development environments + #[serde(skip_serializing_if = "Option::is_none")] + pub skip_ssl_verify: Option, } #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)] diff --git a/backend/windmill-common/src/secret_backend/tests.rs b/backend/windmill-common/src/secret_backend/tests.rs index 2a6962f8dd..630b6cf023 100644 --- a/backend/windmill-common/src/secret_backend/tests.rs +++ b/backend/windmill-common/src/secret_backend/tests.rs @@ -28,6 +28,7 @@ mod tests { jwt_role: Some("windmill-secrets".to_string()), namespace: None, token: Some("test-root-token".to_string()), + skip_ssl_verify: None, } } diff --git a/backend/windmill-common/tests/secret_backend_integration.rs b/backend/windmill-common/tests/secret_backend_integration.rs index 817a8d0e65..542dba12b4 100644 --- a/backend/windmill-common/tests/secret_backend_integration.rs +++ b/backend/windmill-common/tests/secret_backend_integration.rs @@ -96,6 +96,7 @@ mod tests { token: Some( std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()), ), + skip_ssl_verify: None, } } @@ -108,6 +109,7 @@ mod tests { jwt_role: Some("windmill-secrets".to_string()), // JWT mode namespace: None, token: None, // No static token - use JWT + skip_ssl_verify: None, } } diff --git a/backend/windmill-common/tests/secret_backend_migration.rs b/backend/windmill-common/tests/secret_backend_migration.rs index baa2940319..1915b90630 100644 --- a/backend/windmill-common/tests/secret_backend_migration.rs +++ b/backend/windmill-common/tests/secret_backend_migration.rs @@ -36,6 +36,7 @@ fn test_vault_settings() -> VaultSettings { token: Some( std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()), ), + skip_ssl_verify: None, } } diff --git a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte index 8e33b75300..c2ebc581aa 100644 --- a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte +++ b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte @@ -4,6 +4,7 @@ import { SettingService } from '$lib/gen' import { sendUserToast } from '$lib/toast' import TextInput from '../text_input/TextInput.svelte' + import Toggle from '../Toggle.svelte' import { Database, Lock, Server, ArrowLeft, ArrowRight, Cloud } from 'lucide-svelte' import type { Writable } from 'svelte/store' import { enterpriseLicense } from '$lib/stores' @@ -67,7 +68,8 @@ mount_path: $values['secret_backend']?.mount_path ?? 'windmill', jwt_role: $values['secret_backend']?.jwt_role ?? 'windmill-secrets', namespace: $values['secret_backend']?.namespace ?? null, - token: $values['secret_backend']?.token ?? null + token: $values['secret_backend']?.token ?? null, + skip_ssl_verify: $values['secret_backend']?.skip_ssl_verify ?? false } } else if (type === 'AzureKeyVault') { $values['secret_backend'] = { @@ -105,7 +107,8 @@ mount_path: $values['secret_backend'].mount_path, jwt_role: $values['secret_backend'].jwt_role, namespace: $values['secret_backend'].namespace || undefined, - token: $values['secret_backend'].token || undefined + token: $values['secret_backend'].token || undefined, + skip_ssl_verify: $values['secret_backend'].skip_ssl_verify || undefined } } @@ -357,6 +360,10 @@ vault write auth/jwt/role/windmill-secrets \ Vault Enterprise namespace +
+ + Disables TLS verification when connecting to Vault. Only enable for self-signed certificates in development. +