chore(deps): update terraform vault to v3.25.0

This MR contains the following updates:

Package	Type	Update	Change
vault (source)	required_provider	minor	3.16.0 -> 3.25.0

---

Release Notes

hashicorp/terraform-provider-vault (vault)

v3.25.0

Compare Source

FEATURES:

• Add destination and association resources to support Secrets Sync. Requires Vault 1.16+ (#​2098).
• Add support for configuration of plugin WIF to the AWS Secret Backend. Requires Vault 1.16+ (#​2138).
• Add support for Oracle database plugin configuration options split_statements and disconnect_sessions: (#​2085)

IMPROVEMENTS:

• Add an API client lock to the vault_identity_group_alias resource: (#​2140)

v3.24.0

Compare Source

FEATURES:

• Add support for ext_key_usage_oids in vault_pki_secret_backend_role (#​2108)
• Adds support to vault_gcp_auth_backend for common backend tune parameters (#​1997).
• Adds support to vault_azure_secret_backend_role for sign_in_audience and tags. Requires Vault 1.16+. (#​2101).

BUGS:

• fix vault_kv_secret_v2 drift when "data" is in secret name/path (#​2104)
• fix vault_database_secret_backend_connection: allow mysql_rds,mysql_aurora,mysql_legacy options of vault_database_secret_backend_connection terraform resource to allow specifying tls_ca and tls_certificate_key (#​2106)
• Fix ignored description updates for aws_secret_backend resource (#​2057)

IMPROVEMENTS:

• Updated dependencies (#​2129):
  • cloud.google.com/go/iam v1.1.2 -> v1.1.5
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0 -> v1.9.1
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0 -> v1.5.0
  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.1.1 -> v1.2.0
  • github.com/aws/aws-sdk-go v1.45.24 -> v1.49.22
  • github.com/google/uuid v1.3.1 -> v1.5.0
  • github.com/hashicorp/go-hclog v1.5.0 -> v1.6.2
  • github.com/hashicorp/go-retryablehttp v0.7.4 -> v0.7.5
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 -> v0.1.8
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0 -> v2.31.0
  • github.com/hashicorp/vault-plugin-auth-jwt v0.17.0 -> v0.18.0
  • github.com/hashicorp/vault/sdk v0.10.0 -> v0.10.2
  • golang.org/x/crypto v0.14.0 -> v0.18.0
  • golang.org/x/net v0.15.0 -> v0.20.0
  • golang.org/x/oauth2 v0.12.0 -> v0.16.0
  • google.golang.org/api v0.144.0 -> v0.156.0
  • google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 -> v0.0.0-20240116215550-a9fa1716bcac
  • k8s.io/utils v0.0.0-20230726121419-3b25d923346b -> v0.0.0-20240102154912-e7106e64919e

v3.23.0

Compare Source

FEATURES:

• Add support for lazily authenticating to Vault: (#​2049)

BUGS:

• Fix vault_identity_group loses externally managed policies on updates when external_policies = true (#​2084)
• Fix regression in vault_azure_access_credentials where we returned prematurely on 401 responses:(#​2086)

v3.22.0

Compare Source

FEATURES:

• Add support for configuring SAML Auth resources (#​2053)
• Add support for custom_metadata on vault_namespace: (#​2033)
• Add support for OCSP* role fields for the cert auth resource: (#​2056)
• Add field set_namespace_from_token to Provider configuration (#​2070)
• Support authenticating to the root namespace from within an auth_login*: (#​2066)

BUGS:

• Fix panic when reading client_secret from a public oidc client (#​2048)
• Fix API request missing roles field for mongodbatlas_secret_role resource (#​2047)
• Fix bug when updating vault_azure_secret_backend_role: (#​2063)
• Fix audience string ordering for auth_login_gcp causing GCE auth to fail (#​2064)

IMPROVEMENTS:

• Updated dependencies: (#​2038)
  • github.com/aws/aws-sdk-go v1.44.106 -> v1.45.24
• Updated dependencies: (#​2050)
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v0.22.0 -> v1.8.0
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.13.2 -> v1.4.0
  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v0.3.1 -> v1.1.1
  • github.com/Azure/go-autorest/autorest v0.11.29 removed

v3.21.0

Compare Source

FEATURES:

• Add GCP CloudSQL support to Postgres, MySQL DB engines: (#​2012)
• Add support for DB Adv TTL Mgmt: (#​2011)
• Add support for setting not_before_duration argument on vault_ssh_secret_backend_role: (#​2019)
• Add support for hmac key type and key_size to vault_transit_secret_backend_key: (#​2034)
• Add support for roles to both rate limit and lease count quotas: (#​1994)
• Add allowed_email_sans field to write and update functions of vault_cert_auth_backend_role: (#​1140)
• Add support for local parameter in aws secret engine: (#​2013)

BUGS:

• Fix duplicate timestamp and incorrect level messages: (#​2031)
• Fix panic when setting key_usage to an array of empty string and enable it to unset the key usage constraints: (#​2036)
• Add state migrator for external_member_group_ids in Identity Group (#​2043)
• Fix drift detection for the kv-v2 secrets resource when disable_read is enabled: (#​2039)
• Add state migrator in secrets/auth backends for disable_remount parameter (#​2037)
• Fix failure when auth_login is specified and vault token is picked up from the runtime/execution environment: (#​2029)
• Remove logging of password key: (#​2044)

IMPROVEMENTS:

• Oracle DB engine enablement on HCP Vault: (#​2006)
• Ensure sensitive values are masked in vault_approle_auth_backend_login plan output (#​2008)
• Updated dependencies: (#​2038)
  • cloud.google.com/go/compute v1.10.0 removed
  • cloud.google.com/go/compute/metadata v0.2.3 added
  • cloud.google.com/go/iam v0.3.0 -> v1.1.2
  • github.com/Azure/go-autorest/autorest v0.11.24 -> v0.11.29
  • github.com/cenkalti/backoff/v4 v4.1.2 -> v4.2.1
  • github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f -> v0.0.0-20230601102743-20bbbf26f4d8
  • github.com/denisenkom/go-mssqldb v0.12.0 -> v0.12.3
  • github.com/go-sql-driver/mysql v1.6.0 -> v1.7.1
  • github.com/google/uuid v1.3.0 -> v1.3.1
  • github.com/gosimple/slug v1.11.0 -> v1.13.1
  • github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 -> v1.4.1-0.20200723130312-85980079f637
  • github.com/hashicorp/go-retryablehttp v0.7.1 -> v0.7.4
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.16.0 -> v2.29.0
  • github.com/hashicorp/vault-plugin-auth-jwt v0.13.2-0.20221012184020-28cc68ee722b -> v0.17.0
  • github.com/hashicorp/vault-plugin-auth-kerberos v0.8.0 -> v0.10.1
  • github.com/hashicorp/vault-plugin-auth-oci v0.13.0-pre -> v0.14.2
  • github.com/hashicorp/vault/api v1.9.3-0.20230628215639-3ca33976762c -> v1.10.0
  • github.com/hashicorp/vault/sdk v0.6.0 -> v0.10.0
  • github.com/jcmturner/gokrb5/v8 v8.4.2 -> v8.4.4
  • golang.org/x/crypto v0.6.0 -> v0.14.0
  • golang.org/x/net v0.7.0 -> v0.15.0
  • golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 -> v0.12.0
  • google.golang.org/api v0.98.0 -> v0.144.0
  • google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e -> v0.0.0-20231002182017-d307bd883b97
  • k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 -> v0.0.0-20230726121419-3b25d923346b

v3.20.1

Compare Source

IMPROVEMENTS:

• Update dependencies (#​1958)
  • github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6 -> v0.2.3
• Add local variable to aws_secret_backend resource, in order to mark the mount as non - replicated

BUGS:

• Update k8s-auth config to support unsetting the K8s CA Cert: (#​2005)

v3.20.0

Compare Source

FEATURES:

• Add support for setting permanently_delete argument on resource_azure_secret_backend_role: (#​1958)
• Add use_sts_region_from_client to AWS Auth Config: (#​1963)
• Add accessor attribute for vault_gcp_auth_backend resource: (#​1980)

BUGS:

• Fixes a panic that can occur when Vault lookup-self API returns nil token info (#​1978)
• Resolve TF state for PKI Multi-Issuer workflows: (#​1973)
• Check the seal-status on the default namespace: (#​1967)

v3.19.0

Compare Source

FEATURES:

• Add support for User ID configuration for PKI Secrets Engine: (#​1936)
• Add support for use_sts_region_from_client in vault_aws_auth_backend_client available in Vault v1.15.0+: (#​1963)

BUGS:

• auth/aws: enable namespace support for AWS backend config identity: (#​1961)
• Retry Write on kv-v2 config: (#​1955)
• Update vault_identity_entity to exclude policies from Vault request if external_policies is true: (#​1950)
• Bump Go version to fix macOS resolver issue: (#​1941)

v3.18.0

Compare Source

FEATURES:

• Add support to set default issuers configuration for PKI Secrets Engine: (#​1937)
• Add new auth_login_token_file method: (#​1928)
• Update HTTP transport wrapper to support TLSConfig cloning: (#​1926)

BUGS:

• secrets/pki: fix server_flag being ignored: (#​1933)

v3.17.0

Compare Source

FEATURES:

• Add support for multi-issuer functionality to PKI: (#​1910)
• Add x509 support to database roles: (#​1901)
• Add AWS Static Roles support: (#​1877)
• Add support for max_page_size in the vault_ldap_auth_backend: (#​1878)

BUGS:

• Fix DB Engine password overwrite for remaining databases: (#​1912)

---

Configuration

Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

Ignore: Close this MR and you won't be reminded about this update again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Renovate Bot.

vault/terraform/.terraform.lock.hcl

@@ -2,19 +2,19 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.opentofu.org/hashicorp/vault" {
-  version     = "3.16.0"
-  constraints = "3.16.0"
+  version     = "3.25.0"
+  constraints = "3.25.0"
   hashes = [
-    "h1:bjDgbzptb1PjhzErnohHXajB0k+n+YmIWq4FSqGaTQU=",
-    "zh:109807dea6b5fd3987e9a95e64c0fba629e807bd7f42a22e89470918c2fe5038",
-    "zh:1b614c7f96a5132d9220f6a9b5ddd74dfd7638e543f294e67d2aacf65841d6a0",
-    "zh:3ac1be04133edde48104eb9003bebe86f8646f88033b4380b2f93ac0cf4463d5",
-    "zh:4cbc16abed01043f5e515befb995199efab14e95279b5d68510a8332c8ad8bc2",
-    "zh:6c6bece6ec79cd9a493f59557e796c17f2ca5511ae5c41e86e40725ad1beb08e",
-    "zh:78b11d5cd30aed6e5cc5306c50541eaa5c132e54deaf006da7b4c47ea3c655e1",
-    "zh:89e3b533354e02674f3cd6e79a199b3a7987ac8eaf0c9c7a3d1f1cc0c704fb2d",
-    "zh:c4bf3118579827dfef2f93edb70f974d2d9007467a4d39aa4746a957f9d2e112",
-    "zh:cf5e279219d174e46d2119366801bc8c7db4eeb0650a1103d9f315233a0b6882",
-    "zh:e771f2756635cbab2de42827c89fd913d02ed2d3f0ad7f2b0aee67ee8101eb06",
+    "h1:2zCa1Cj3mwK+4iin4NM8+nv9lUdJRP3BjRSZsloyZOc=",
+    "h1:3GN5k6zxDAI5gfcKENb/jnJyFGWA/0JoumnD6eyVZjs=",
+    "h1:4B34OwtP7NttC1lMHzlx/PkylaFarXoQnoxeg7hZW6M=",
+    "h1:4KzkyK0u0A8az1Fud/AcW/NYaz3jzJQ6k2hd/LIwlWU=",
+    "h1:9y2/GemP5TP+16AxhVoDl+4p/22zVlyccCJVZYANwNc=",
+    "h1:QjkFFwx5M4cnNi3oDgJMFQWmVgCbUisAN2SXfhmfsac=",
+    "h1:XGuVzeZwCLqLqytBpkPEe240qKtpiQX7nwyZoUkSHMw=",
+    "h1:bKBTVT1YpUG6Mm/YGRfnwzg6EjdI4QxhzY8ntCBrS4U=",
+    "h1:ico8CTFKaeML6y5bB/uAZaXqUjWKEwf1W6tMCeQAbOk=",
+    "h1:kFwB7LM5hdvkkZSrB6zxD0utStl4Aq8NQFQCGIZxtEU=",
+    "h1:vr1E5WSsSiRuLLIMla5NrAbw+hzDvFX3UpyJPhxl/eY=",
   ]
 }