Upgrade vault-cli
from previous version¶
From 2.x to 3.x¶
Templated values (!template!{{ vault("a").b }}
) aren’t supported anymore.
If you were using those, you will get a warning starting on vault-cli~=2.2.1
.
On 3.x, a --render/--no-render
flag is still available but it does nothing.
From 1.x to 2.x¶
Switch command name from vault
to vault-cli
if you’re using it.
From 0.x to 1.x¶
This version includes some breaking changes about key-value mapping
management. In the previous versions of vault-cli, there was an implicit
key value
that was used everywhere. The goal was to provide a path
<-> value abstraction. But it was hiding the path <-> key/value mapping
reality of vault’s kv engine.
In this release we removed the implicit value
key in order to
expose a key/value mapping instead of a single value. Most of the
commands have been updated in order to add the key parameter.
A new option --omit-single-key
was added to vault-cli env
in order
to ignore the key when the variable names are built and there is only
one key in the mapping. This option case simplify your migration as
there won’t be an additional _VALUE
suffix added to your environment
variables names.
Note
Since 1.0, the official CLI name has switched from vault
to vault-cli
but vault
is kept for backwards compatibility. Because vault-cli 0.x
was
only compatible with the name vault
, the examples below are written with
vault
After 2.0, command vault
has disappeared.
The following list shows how to update your commands:
(old) vault set path/to/creds xxx
(new) vault set path/to/creds value=xxx
(old) vault get path/to/creds
(new) vault get path/to/creds value
(old) vault env --envvar path/to/creds=FOO -- env # FOO=xxx
(new) vault env --envvar path/to/creds=FOO -- env # FOO_VALUE=xxx
(new) vault env --envvar path/to/creds:value=FOO -- env # FOO=xxx
(new) vault env --omit-single_key --envvar path/to/creds=FOO -- env # FOO=xxx
The default output of vault get-all
has also changed and is now flat
by default (this behavior is controlled with the --flat/--no-flat
flags).
$ vault set a/b secret=xxx
$ vault set a/c secret=xxx
$ vault get-all a
---
a/b:
secret: xxx
a/c:
secret: xxx
$ vault get-all --no-flat a
---
a:
b:
secret: xxx
c:
secret: xxx