Change8

Migrating to Vault v1.19.0-rc1

Version v1.19.0-rc1 introduces 2 breaking changes. This guide details how to update your code.

Released: 2/20/2025

2
Breaking Changes
3
Migration Steps
34
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

sys/healthauth/ldapsecrets/awskmipsecrets/pkiraft/snapshotagentauth/alicloudauth/azureauth/cfauth/gcpauth/jwtauth/kerberosauth/kubernetesauth/ocidatabase/couchbasedatabase/elasticsearchdatabase/mongodbatlasdatabase/redis-elasticachedatabase/redisdatabase/snowflakecoresys/storage/raft/joinsecrets/adsecrets/alicloudsecrets/azuresecrets/gcpsecrets/gcpkmssecrets/kubernetessecrets/kvsecrets/mongodbatlassecrets/openldapsecrets/terraformstorage/raftui

Breaking Changes

Issue #1

auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. Previously, this might have succeeded or returned a warning.

Issue #2

secrets/aws: The AWS Secrets engine now persists entries to storage between writes. To zero out a previously configured value on an update, users must now explicitly set the field to its zero value.

Migration Steps

  1. 1
    If you rely on LDAP authentication returning warnings instead of errors for multi-entry searches, update your client logic to handle the new error.
  2. 2
    When updating AWS secrets engine configurations, if you need to clear a previously set field, you must now explicitly set that field to its zero value.
  3. 3
    If you are using the PKI secrets engine, review the new issuer constraint enforcement behavior for issuing/signing certificates.

Release Summary

This release introduces Automated Root Rotation capabilities for several plugins (Enterprise only) and enhances HA status reporting via sys/health. It also tightens security by enforcing PKI issuer constraints and updating several bundled plugins.

Need More Details?

View the full release notes and all changes for Vault v1.19.0-rc1.

View Full Changelog