Migrating to Vault v1.19.0
Version v1.19.0 introduces 2 breaking changes. This guide details how to update your code.
Released: 3/5/2025
⚠️ Check Your Code
If you use any of these symbols, you need to read this guide:
sys/healthauth/ldapsecrets/awssecrets/pkikmipcore/hasys/storage/raft/joinBreaking Changes
●Issue #1
The AWS Secrets engine now persists entries to storage between writes. To zero out a previously configured value during an update, users must now explicitly set the field to its zero value.
✓Solution
No fix required, this is a behavioral change. Users updating AWS secrets must now explicitly set fields to their zero value if they intend to clear them.
●Issue #2
The PKI secrets engine now enforces issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates.
✓Solution
Consult the PKI considerations documentation for details on how this affects certificate issuance workflows.
Migration Steps
- 1If you rely on updating AWS secrets by omitting fields, you must now explicitly set fields to their zero value if you intend to clear them.
- 2Review certificate issuance workflows in the PKI secrets engine to ensure compliance with new issuer constraint enforcement.
Release Summary
Vault 1.19.0 is an Enterprise LTS release introducing significant improvements to HA standby health reporting via sys/health and enforcing stricter security constraints in the PKI engine. This version also updates numerous plugins and standardizes IPv6 address formatting across configuration.
Need More Details?
View the full release notes and all changes for Vault v1.19.0.
View Full Changelog