K/V Versioning

[nickcarenza]

This package stopped working on latest vault k/v store and I think it has something to do with the new versioning feature in Vault.

hashicorp/vault#4281

[kr1sp1n]

@nickcarenza Will have a look at it asap. Thanks for reporting the issue 🙏

[ak1394]

It should be possible to force Vault to use KV Version 1 backend instead of KV Version 2 which looks like a default for the new installs and the dev mode. Reverting to the old backend should solve the issue.

However, it would be nice to get support for the new KV backend in the future.

[shovelend]

@kr1sp1n it would be amazing to have the feature. We're looking forward to use KV Secrets Engine - V2 and we couldn't find a decent library apart from yours. Do you think it will be implemented soon?

[kr1sp1n]

@shovelend We are working on version 1.0.0 atm. That's why there is a slow progress with all the other feature requests. But I think the KV Secrets Engine V2 could be implemented easily and released as 0.9.0 in the meantime. Will work on this next week.

[v6]

// , You can create multiple KV secrets backends in Vault, and have some of them set to v1, with others set to v2. They can coexist, but the paths will be different.

You can set up HashiCorp Vault with a way to support the legacy interface for backwards compatibility without affecting other use cases.

Instead of "${VAULT_ADDR}/v1/secret..." your paths would use "${VAULT_ADDR}/v1/kv1..." or some such thing.

I would ask yourself whether you need the versioning and Check-and-Set (CAS) features, though, first.

Even if you don't need them right now, it might be helpful to have them in the back pocket for later.

[v6]

// , Here's a guide on how to do the operation I mentioned above:

https://www.vaultproject.io/intro/getting-started/secrets-engines.html#enable-a-secrets-engine

[tmackness]

Just notice this was to do with KV v2. Couldn't figure out why it wasn't working. Appreciate the work around.

[petermyers]

As we approach the end of 2019, i was wondering if there was any update on this?

[stevenaldinger]

for what it's worth, you can still read values with this lib if you add /data/ between the secret engine and the secret.

// not sure if apiVersion does anything, didn't look
const vault = require('node-vault')({ endpoint: "your-endpoint.whatever", token: "s.your-token", apiVersion: "v2" })

vault.read(`secret-engine/data/my/secret/here`)
  .then(({ data }) => {
    console.log(data)
  }

I wasn't able to get writing to work the same way but just threw the vault CLI commands into a bash script for myself based on that output for my very specific use case.

[v6]

Yeah I currently do not recommend using this library or the ruby library because of this type of thing.