Support kv version 2 secret backend
HT43-bqxFqB opened this issue · comments
Since vault 0.10.0 it support kv secrets backends with versioning (https://www.vaultproject.io/docs/secrets/kv/kv-v2.html). The data migration currently does not work with this backend. Is it possible to add this feature?
Maybe not necessary as one can import in a kv version=1 path and then later update with enable-versioning
.
I bet it wouldn't be too hard to support. I'll take a look.
@HT43-bqxFqB Hmm, so the format for kv
version 2 changed in both the api urls and responses. That's annoying and there's also a versioning component introduced. It seems to me that supporting kv version 2 would be a whole separate flow of code here. (Detect if we're on secret or kv version 1 vs version 2.)
It's possible, but this project would need some changes. I don't think it's useful to just export kv version 2 data as if it's version 1 (and lose versioning information). Would you agree?
Also, I tried exporting version 2 as if it was version 1, but didn't get the same json response from the cli.
$ vault kv get --version=1 -format json kv/foo
{
"request_id": "feffa57c-7718-6308-1db1-fc9a1d63e8ef",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"data": {
"value": "hi"
},
"metadata": {
"created_time": "2018-05-31T21:27:12.300984016Z",
"deletion_time": "",
"destroyed": false,
"version": 1
}
},
"warnings": null
}
Hey @adamdecaf,
no worries. As long as vault enables upgrading I think it's not problematic to only support version 1. Maybe the readme should be updated to mention this way of migrating into version 2 backends.
Kind regards,
Martin
@HT43-bqxFqB Sure thing. I'll mention that.