Migrating to Vault v1.19.0-rc1
Version v1.19.0-rc1 introduces 2 breaking changes. This guide details how to update your code.
Released: 2/20/2025
⚠️ Check Your Code
If you use any of these symbols, you need to read this guide:
sys/healthauth/ldapsecrets/awskmipsecrets/pkiraft/snapshotagentauth/alicloudauth/azureauth/cfauth/gcpauth/jwtauth/kerberosauth/kubernetesauth/ocidatabase/couchbasedatabase/elasticsearchdatabase/mongodbatlasdatabase/redis-elasticachedatabase/redisdatabase/snowflakecoresys/storage/raft/joinsecrets/adsecrets/alicloudsecrets/azuresecrets/gcpsecrets/gcpkmssecrets/kubernetessecrets/kvsecrets/mongodbatlassecrets/openldapsecrets/terraformstorage/raftuiBreaking Changes
●Issue #1
auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. Previously, this might have succeeded or returned a warning.
●Issue #2
secrets/aws: The AWS Secrets engine now persists entries to storage between writes. To zero out a previously configured value on an update, users must now explicitly set the field to its zero value.
Migration Steps
- 1If you rely on LDAP authentication returning warnings instead of errors for multi-entry searches, update your client logic to handle the new error.
- 2When updating AWS secrets engine configurations, if you need to clear a previously set field, you must now explicitly set that field to its zero value.
- 3If you are using the PKI secrets engine, review the new issuer constraint enforcement behavior for issuing/signing certificates.
Release Summary
This release introduces Automated Root Rotation capabilities for several plugins (Enterprise only) and enhances HA status reporting via sys/health. It also tightens security by enforcing PKI issuer constraints and updating several bundled plugins.
Need More Details?
View the full release notes and all changes for Vault v1.19.0-rc1.
View Full Changelog