vault Key updates for Vault 1 16 1 Vault 1 16 1 release notes GA date 2024 04 04 layout docs page title 1 16 1 release notes

Answer:
---
layout: docs
page_title: "1.16.1 release notes"
description: |-
  Key updates for  Vault 1.16.1
---

# Vault 1.16.1 release notes

**GA date:** 2024-04-04

@include 'release-notes/intro.mdx'

## Important changes

| Version                     | Change                                                                                |
|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.16.0+                     | [Existing clusters do not show the current Vault version in UI by default](/vault/docs/upgrading/upgrade-to-1.16.x#default-policy-changes)                                                   |
| 1.16.0+                     | [Default LCQ enabled when upgrading pre-1.9](/vault/docs/upgrading/upgrade-to-1.16.x#default-lcq-pre-1.9-upgrade)                                                                            |
| 1.16.0+                     | [External plugin environment variables take precedence over server variables](/vault/docs/upgrading/upgrade-to-1.16.x#external-plugin-variables)                                             |
| 1.16.0+                     | [LDAP auth entity alias names no longer include upndomain](/vault/docs/upgrading/upgrade-to-1.16.x#ldap-auth-entity-alias-names-no-longer-include-upndomain)                                 |
| 1.16.0+                     | [Secrets Sync now requires a one-time flag to operate](/vault/docs/upgrading/upgrade-to-1.16.x#secrets-sync-now-requires-setting-a-one-time-flag-before-use)                                 |
| 1.16.0+                     | [Azure secrets engine role creation failing](/vault/docs/upgrading/upgrade-to-1.16.x#azure-secrets-engine-role-creation-failing)                                                             |
| 1.16.1 - 1.16.3             | [New nodes added by autopilot upgrades provisioned with the wrong version](/vault/docs/upgrading/upgrade-to-1.15.x#new-nodes-added-by-autopilot-upgrades-provisioned-with-the-wrong-version) |
| 1.15.8+                     | [Autopilot upgrade for Vault Enterprise fails](/vault/docs/upgrading/upgrade-to-1.15.x#autopilot)                                                                                |
| 1.16.5                      | [Listener stops listening on untrusted upstream connection with particular config settings](/vault/docs/upgrading/upgrade-to-1.16.x#listener-proxy-protocol-config)                          |
| 1.16.3 - 1.16.6             | [Vault standby nodes not deleting removed entity-aliases from in-memory database](/vault/docs/upgrading/upgrade-to-1.16.x#dangling-entity-alias-in-memory)                                   |
| 0.7.0+                      | [Duplicate identity groups created](/vault/docs/upgrading/upgrade-to-1.16.x#duplicate-identity-groups-created-when-concurrent-requests-sent-to-the-primary-and-pr-secondary-cluster)         |                                                                                |
| Known Issue (0.7.0+)        | [Manual entity merges fail](/vault/docs/upgrading/upgrade-to-1.16.x#manual-entity-merges-sent-to-a-pr-secondary-cluster-are-not-persisted-to-storage)                                        |
| Known Issue (1.16.7-1.16.8) | [Some values in the audit logs not hmac'd properly](/vault/docs/upgrading/upgrade-to-1.16.x#client-tokens-and-token-accessors-audited-in-plaintext)                                          |
| New default (1.16.13)       | [Vault product usage metrics reporting](/vault/docs/upgrading/upgrade-to-1.6.x#product-usage-reporting)                                                                                |
| Deprecation (1.16.13)       | [`default_report_months` is deprecated for the `sys/internal/counters` API](/vault/docs/upgrading/upgrade-to-1.16.x#activity-log-changes)                                                    |

## Vault companion updates

Companion updates are Vault updates that live outside the main Vault binary.

      Release
      Update
      Description

      Vault Secrets Operator (v0.5)

    ENHANCED

      Use templating to format, transform, and decode secrets before syncing to
      Kubernetes secret.

      Learn more: Secret data transformation

## Core updates

Follow the learn more links for more information, or browse the list of
[Vault tutorials updated to highlight changes for the most recent GA release](/vault/tutorials/new-release).

      Release
      Update
      Description

      Endpoint hardening

    ENHANCED

      Minimize network exposure by selectively redacting select fields like IP
      addresses, cluster names, and Vault version from the HTTP responses of
      your Vault server.

      Learn more:
      <tt>redact_addresses</tt> parameter

      External plugins

    GA

      Run external plugins in their own container with native container platform
      controls.

      Learn more: Containerize Vault plugins

## Enterprise updates

      Release
      Update
      Description

      Long-term support

    GA

      Reduce risk and operational overhead with Vault Enterprise Long-Term
      Support (LTS) releases.

      Learn more: LTS overview

      Vault GUI

    GA

      Configure custom messages and display those messages to targeted users in
      the Vault GUI.

        Learn more: Custom UI messages

      Audit logging

    GA

      Filter audit logs to write data to different destinations based on the content.

      Learn more: Filter syntax for audit results

      Static secret caching

    GA

      Use Vault Proxy to cache static secrets for a set period of time and receive
      event notifications when secrets change.

      Learn more: Vault Proxy static secret caching

      Event notifications

    GA

      Subscribe to notifications for various events in Vault. Includes support
      for filtering, permissions, and cluster configurations with K-V secrets.

      Learn more: Events

      Public Key Infrastructure (PKI)

    BETA

      Automate certificate lifecycle management for IoT/EST enabled devices with
      native EST protocol support

      Learn more: Enrollment over Secure Transport (EST)

      Default lease count quotas

    GA

      New server deployments automatically create a lease count quota in the
      root namespace with a 300K limit.

      Learn more: Lease count quotas

      License utilization reporting

    ENHANCED

      Use the Vault CLI to bundle and report usage data to HashiCorp for
      clusters that do not report license utilization data automatically.

      Learn more: Manual license utilization reporting

      Secrets sync

    GA

      Sync Key Value (KV) v2 data between Vault and secrets managers from AWS,
      Azure, Google Cloud Platform (GCP), GitHub, and Vercel.

      Learn more: Secrets Sync

      AWS plugin

    GA

      Use automatic identity tokes for workload identity federation
      authentication flows with the AWS secret engine without explicitly
      configuring sensitive security credentials.

      Learn more: AWS secrets engine

## Feature deprecations and EOL

Deprecated in 1.16 | Retired in 1.16
------------------ | ---------------
None | None

@include 'release-notes/deprecation-note.mdx'

layout  docs page title   1 16 1 release notes  description       Key updates for  Vault 1 16 1        Vault 1 16 1 release notes    GA date    2024 04 04   include  release notes intro mdx      Important changes    Version                       Change                                                                                1 16 0                         Existing clusters do not show the current Vault version in UI by default   vault docs upgrading upgrade to 1 16 x default policy changes                                                        1 16 0                         Default LCQ enabled when upgrading pre 1 9   vault docs upgrading upgrade to 1 16 x default lcq pre 1 9 upgrade                                                                                1 16 0                         External plugin environment variables take precedence over server variables   vault docs upgrading upgrade to 1 16 x external plugin variables                                                  1 16 0                         LDAP auth entity alias names no longer include upndomain   vault docs upgrading upgrade to 1 16 x ldap auth entity alias names no longer include upndomain                                      1 16 0                         Secrets Sync now requires a one time flag to operate   vault docs upgrading upgrade to 1 16 x secrets sync now requires setting a one time flag before use                                      1 16 0                         Azure secrets engine role creation failing   vault docs upgrading upgrade to 1 16 x azure secrets engine role creation failing                                                                  1 16 1   1 16 3                New nodes added by autopilot upgrades provisioned with the wrong version   vault docs upgrading upgrade to 1 15 x new nodes added by autopilot upgrades provisioned with the wrong version      1 15 8                         Autopilot upgrade for Vault Enterprise fails   vault docs upgrading upgrade to 1 15 x autopilot                                                                                1 16 5                         Listener stops listening on untrusted upstream connection with particular config settings   vault docs upgrading upgrade to 1 16 x listener proxy protocol config                               1 16 3   1 16 6                Vault standby nodes not deleting removed entity aliases from in memory database   vault docs upgrading upgrade to 1 16 x dangling entity alias in memory                                        0 7 0                          Duplicate identity groups created   vault docs upgrading upgrade to 1 16 x duplicate identity groups created when concurrent requests sent to the primary and pr secondary cluster                                                                                Known Issue  0 7 0             Manual entity merges fail   vault docs upgrading upgrade to 1 16 x manual entity merges sent to a pr secondary cluster are not persisted to storage                                             Known Issue  1 16 7 1 16 8     Some values in the audit logs not hmac d properly   vault docs upgrading upgrade to 1 16 x client tokens and token accessors audited in plaintext                                               New default  1 16 13           Vault product usage metrics reporting   vault docs upgrading upgrade to 1 6 x product usage reporting                                                                                Deprecation  1 16 13            default report months  is deprecated for the  sys internal counters  API   vault docs upgrading upgrade to 1 16 x activity log changes                                                            Vault companion updates  Companion updates are Vault updates that live outside the main Vault binary    table     thead       tr         th style  Release  th         th style  Update  th         th style  Description  th        tr      thead     tbody      tr       td style         Vault Secrets Operator  v0 5        td       td style  ENHANCED  td       td style         Use templating to format  transform  and decode secrets before syncing to       Kubernetes secret         br    br          Learn more   a href   vault docs platform k8s vso secret transformation  Secret data transformation  a        td      tr      tbody    table      Core updates  Follow the learn more links for more information  or browse the list of  Vault tutorials updated to highlight changes for the most recent GA release   vault tutorials new release     table     thead       tr         th style  Release  th         th style  Update  th         th style  Description  th        tr      thead     tbody      tr       td style         Endpoint hardening       td       td style  ENHANCED  td       td style         Minimize network exposure by selectively redacting select fields like IP       addresses  cluster names  and Vault version from the HTTP responses of       your Vault server         br    br          Learn more  nbsp         a href   vault docs configuration listener tcp redact addresses   tt redact addresses  tt  parameter  a        td      tr      tr       td style         External plugins       td       td style  GA  td       td style         Run external plugins in their own container with native container platform       controls         br    br          Learn more   a href   vault docs plugins containerized plugins  Containerize Vault plugins  a        td      tr       tbody    table      Enterprise updates   table     thead       tr         th style  Release  th         th style  Update  th         th style  Description  th        tr      thead     tbody      tr       td style         Long term support       td       td style  GA  td       td style         Reduce risk and operational overhead with Vault Enterprise Long Term       Support  LTS  releases         br    br          Learn more   a href   vault docs enterprise lts  LTS overview  a        td      tr      tr       td style         Vault GUI       td       td style  GA  td       td style         Configure custom messages and display those messages to targeted users in       the Vault GUI           br    br            Learn more   a href   vault docs ui custom messages  Custom UI messages  a        td      tr      tr       td style         Audit logging       td       td style  GA  td       td style         Filter audit logs to write data to different destinations based on the content         br    br          Learn more   a href   vault docs enterprise audit filtering  Filter syntax for audit results  a        td      tr      tr       td style         Static secret caching       td       td style  GA  td       td style         Use Vault Proxy to cache static secrets for a set period of time and receive       event notifications when secrets change         br    br          Learn more   a href   vault docs agent and proxy proxy caching static secret caching  Vault Proxy static secret caching  a        td      tr      tr       td style         Event notifications       td       td style  GA  td       td style         Subscribe to notifications for various events in Vault  Includes support       for filtering  permissions  and cluster configurations with K V secrets         br    br          Learn more   a href   vault docs concepts events  Events  a        td      tr      tr       td style         Public Key Infrastructure  PKI        td       td style  BETA  td       td style         Automate certificate lifecycle management for IoT EST enabled devices with       native EST protocol support        br    br          Learn more   a href   vault docs secrets pki est  Enrollment over Secure Transport  EST   a        td      tr      tr       td style         Default lease count quotas       td       td style  GA  td       td style         New server deployments automatically create a lease count quota in the       root namespace with a 300K limit         br    br          Learn more   a href   vault docs enterprise lease count quotas  Lease count quotas  a        td      tr      tr       td style         License utilization reporting       td       td style  ENHANCED  td       td style         Use the Vault CLI to bundle and report usage data to HashiCorp for       clusters that do not report license utilization data automatically         br    br          Learn more   a href   vault docs enterprise license manual reporting  Manual license utilization reporting  a        td      tr      tr       td style         Secrets sync       td       td style  GA  td       td style         Sync Key Value  KV  v2 data between Vault and secrets managers from AWS        Azure  Google Cloud Platform  GCP   GitHub  and Vercel         br    br          Learn more   a href   vault docs sync  Secrets Sync  a        td      tr      tr       td style         AWS plugin       td       td style  GA  td       td style         Use automatic identity tokes for workload identity federation       authentication flows with the AWS secret engine without explicitly       configuring sensitive security credentials         br    br          Learn more   a href   vault docs secrets aws  AWS secrets engine  a        td      tr       tbody    table      Feature deprecations and EOL  Deprecated in 1 16   Retired in 1 16                                      None   None   include  release notes deprecation note mdx


vault GA date June 21 2023 Vault 1 14 0 release notes layout docs page title 1 14 0 release notes Key updates for Vault 1 14 0

Answer:
---
layout: docs
page_title: "1.14.0 release notes"
description: |-
  Key updates for  Vault 1.14.0
---

# Vault 1.14.0 release notes

**GA date:** June 21, 2023

@include 'release-notes/intro.mdx'

## Known issues and breaking changes

Version | Issue
------- | ------------------------------------------------------------
1.14.0+ | [Users limited by control groups can only access issuer detail from PKI overview page](/vault/docs/upgrading/upgrade-to-1.14.x#ui-pki-control-groups)
All     | [API calls to update-primary may lead to data loss](/vault/docs/upgrading/upgrade-to-1.14.x#update-primary-data-loss)
1.14.0+ | [AWS static roles ignore changes to rotation period](/vault/docs/upgrading/upgrade-to-1.14.x#aws-static-role-rotation)
1.14.0+ | [UI Collapsed navbar does not allow certain click events](/vault/docs/upgrading/upgrade-to-1.14.x#ui-collapsed-navbar)
1.14.3 - 1.14.5 | [Vault storing references to ephemeral sub-loggers leading to unbounded memory consumption](/vault/docs/upgrading/upgrade-to-1.14.x#vault-is-storing-references-to-ephemeral-sub-loggers-leading-to-unbounded-memory-consumption)
1.14.4 - 1.14.5 | [Internal error when vault policy in namespace does not exist](/vault/docs/upgrading/upgrade-to-1.14.x#internal-error-when-vault-policy-in-namespace-does-not-exist)
1.14.0+ | [Sublogger levels not adjusted on reload](/vault/docs/upgrading/upgrade-to-1.14.x#sublogger-levels-unchanged-on-reload)
1.14.5  | [Fatal error during expiration metrics gathering causing Vault crash](/vault/docs/upgrading/upgrade-to-1.15.x#fatal-error-during-expiration-metrics-gathering-causing-vault-crash)
1.14.5 | [User lockout potential double logging](/vault/docs/upgrading/upgrade-to-1.14.x#user-lockout-logging)
1.14.5 - 1.14.9 | [Deadlock can occur on performance secondary clusters with many mounts](/vault/docs/upgrading/upgrade-to-1.14.x#deadlock-can-occur-on-performance-secondary-clusters-with-many-mounts)

## Vault companion updates

Companion updates are Vault updates that live outside the main Vault binary.

      Release
      Update
      Description

      Vault Secrets Operator for Kubernetes

    GA

      Directly connect Vault secrets into Pods as native Kubernetes Secrets
      without modifying your application code.

      Learn more: Vault Secrets Operator

      Terraform

    GA

      Use LDAP authentication from the unified LDAP engine to Terraform Vault
      Provider.

      Learn more: LDAP Secrets Engine

    ENHANCED

      Support for additional PKI issuers and keys endpoints.

      Learn more: PKI Secrets Engine

## Core updates

Follow the learn more links for more information, or browse the list of
[Vault tutorials updated to highlight changes for the most recent GA release](/vault/tutorials/new-release).

      Release
      Update
      Description

      Public Key Infrastructure (PKI)

    GA

      Use ACME to automate certificate lifecycle management for private PKI
      needs with standard ACME clients like Certbot and k8s cert-manager.
      Request certificates from a Vault server without needing to know Vault
      APIs or authentication mechanisms.

      Learn more:
      PKI Secrets Engine API: ACME

    GA

      Use the improved PKI web UI to manage your PKI instance with intuitive
      configuration and reasonable defaults for workflows, metadata, issuer
      info, mount and tidy configuration, cross signing, multi-issuers etc.and
      includes.

      Learn more:
      PKI Secrets Engine

      Security patches

    ENHANCED

      Various security improvements to remediate low severity and informational
      findings from a 3rd party security audit.

      Learn more: Vault security model

      Vault Agent

    BETA

      Fetch secrets directly into your application as environment variables.

      Learn more: Process Supervisor Mode

    GA

      Use a new subcommand and daemon, Vault Proxy, to access the proxy
      functionality of Vault Agent. Vault Proxy will handle Vault Agent proxy
      functionality going forward to simplify use case decisions for users.

      Learn more: Vault Proxy

      Plugin support

    GA

      Capture plugin metadata in the Vault audit log.

      Learn more: Syslog audit device

    GA

      Use X509 Authentication and Terraform Vault Provider in the MongoDB Atlas
      Database Secrets Engine.

      Learn more:
      MongoDB Atlas Database Secrets Engine

    ENHANCED

      Dependency updates and more robust multiplexing for secrets and
      authentication plugins.

      Learn more:

        Serving a plugin with multiplexing (Plugin Development)

      AWS support

    ENHANCED

      Monitoring and performance enhancements for the Vault Lambda extension.

      Learn more:
      Vault Lambda Extension guide

    GA

      Use static roles for IAM users in the AWS Secrets Engine.

      Learn more: AWS Secrets Engine

      Vault GUI

    ENHANCED

      Streamlined and aligned navigation with HCP Vault UI.

      Learn more: Vault UI

      Transit

    ENHANCED

      Contributed by the Vault community. Support for public-key only Transit
      keys and BYOK-secured export of key material.

      Learn more: Transit Secrets Engine

## Enterprise updates

      Release
      Update
      Description

      Vault replication

    ENHANCED

      Stability improvements based on customer feedback for Vault 1.13. See the

        Vault changelog

      for a full list of bug fixes.

      Learn more:
      Replication overview

      License utilization reporting

    GA

      Enables automatic license utilization reporting for you and HashiCorp to
      ensure transparent, accurate billing.

      Learn more:
      Automated License utilization reporting

## Feature deprecations and EOL

Deprecated in 1.14 | Retired in 1.14
------------------ | ---------------
Vault Agent API proxy support | [Duplicative Docker Images](https://hub.docker.com/_/vault)

@include 'release-notes/deprecation-note.mdx'

layout  docs page title   1 14 0 release notes  description       Key updates for  Vault 1 14 0        Vault 1 14 0 release notes    GA date    June 21  2023   include  release notes intro mdx      Known issues and breaking changes  Version   Issue                                                                        1 14 0     Users limited by control groups can only access issuer detail from PKI overview page   vault docs upgrading upgrade to 1 14 x ui pki control groups  All        API calls to update primary may lead to data loss   vault docs upgrading upgrade to 1 14 x update primary data loss  1 14 0     AWS static roles ignore changes to rotation period   vault docs upgrading upgrade to 1 14 x aws static role rotation  1 14 0     UI Collapsed navbar does not allow certain click events   vault docs upgrading upgrade to 1 14 x ui collapsed navbar  1 14 3   1 14 5    Vault storing references to ephemeral sub loggers leading to unbounded memory consumption   vault docs upgrading upgrade to 1 14 x vault is storing references to ephemeral sub loggers leading to unbounded memory consumption  1 14 4   1 14 5    Internal error when vault policy in namespace does not exist   vault docs upgrading upgrade to 1 14 x internal error when vault policy in namespace does not exist  1 14 0     Sublogger levels not adjusted on reload   vault docs upgrading upgrade to 1 14 x sublogger levels unchanged on reload  1 14 5     Fatal error during expiration metrics gathering causing Vault crash   vault docs upgrading upgrade to 1 15 x fatal error during expiration metrics gathering causing vault crash  1 14 5    User lockout potential double logging   vault docs upgrading upgrade to 1 14 x user lockout logging  1 14 5   1 14 9    Deadlock can occur on performance secondary clusters with many mounts   vault docs upgrading upgrade to 1 14 x deadlock can occur on performance secondary clusters with many mounts      Vault companion updates  Companion updates are Vault updates that live outside the main Vault binary    table     thead       tr         th style  Release  th         th style  Update  th         th style  Description  th        tr      thead     tbody      tr       td style         Vault Secrets Operator for Kubernetes       td       td style  GA  td       td style         Directly connect Vault secrets into Pods as native Kubernetes Secrets       without modifying your application code         br    br          Learn more   a href   vault docs platform k8s vso  Vault Secrets Operator  a        td      tr      tr       td rowspan  2  style         Terraform       td       td style  GA  td       td style         Use LDAP authentication from the unified LDAP engine to Terraform Vault       Provider         br    br          Learn more   a href   vault docs secrets ldap  LDAP Secrets Engine  a        td      tr     tr       td style  ENHANCED  td       td style         Support for additional PKI issuers and keys endpoints         br    br          Learn more   a href   vault docs secrets pki  PKI Secrets Engine  a        td      tr      tbody    table      Core updates  Follow the learn more links for more information  or browse the list of  Vault tutorials updated to highlight changes for the most recent GA release   vault tutorials new release     table     thead       tr         th style  Release  th         th style  Update  th         th style  Description  th        tr      thead     tbody      tr       td rowspan  2  style         Public Key Infrastructure  PKI        td       td style  GA  td       td style         Use ACME to automate certificate lifecycle management for private PKI       needs with standard ACME clients like Certbot and k8s cert manager        Request certificates from a Vault server without needing to know Vault       APIs or authentication mechanisms         br    br          Learn more  nbsp         a href   vault api docs secret pki acme certificate issuance  PKI Secrets Engine API  ACME  a        td      tr     tr       td style  GA  td       td style         Use the improved PKI web UI to manage your PKI instance with intuitive       configuration and reasonable defaults for workflows  metadata  issuer       info  mount and tidy configuration  cross signing  multi issuers etc and       includes         br    br          Learn more  nbsp         a href   vault api docs secret pki acme certificate issuance  PKI Secrets Engine  a        td      tr      tr       td style         Security patches       td       td style  ENHANCED  td       td style         Various security improvements to remediate low severity and informational       findings from a 3rd party security audit         br    br          Learn more   a href   vault docs internals security  Vault security model  a        td      tr      tr       td rowspan  2  style         Vault Agent       td       td style  BETA  td       td style         Fetch secrets directly into your application as environment variables         br    br          Learn more   a href   vault docs agent and proxy agent process supervisor  Process Supervisor Mode  a        td      tr     tr       td style  GA  td       td style         Use a new subcommand and daemon  Vault Proxy  to access the proxy       functionality of Vault Agent  Vault Proxy will handle Vault Agent proxy       functionality going forward to simplify use case decisions for users         br    br          Learn more   a href   vault docs agent and proxy proxy  Vault Proxy  a        td      tr      tr       td rowspan  3  style         Plugin support       td       td style  GA  td       td style         Capture plugin metadata in the Vault audit log         br    br          Learn more   a href   vault docs audit syslog  Syslog audit device  a        td      tr     tr       td style  GA  td       td style         Use X509 Authentication and Terraform Vault Provider in the MongoDB Atlas       Database Secrets Engine         br    br          Learn more  nbsp         a href   vault docs secrets databases mongodbatlas  MongoDB Atlas Database Secrets Engine  a        td      tr     tr       td style  ENHANCED  td       td style         Dependency updates and more robust multiplexing for secrets and       authentication plugins         br    br          Learn more  nbsp         a href   vault docs plugins plugin development serving a plugin with multiplexing           Serving a plugin with multiplexing  Plugin Development          a        td      tr      tr       td rowspan  2  style         AWS support       td       td style  ENHANCED  td       td style         Monitoring and performance enhancements for the Vault Lambda extension         br    br          Learn more  nbsp         a href   vault docs platform aws lambda extension  Vault Lambda Extension guide  a        td      tr     tr       td style  GA  td       td style         Use static roles for IAM users in the AWS Secrets Engine         br    br          Learn more   a href   vault docs secrets aws  AWS Secrets Engine  a        td      tr      tr       td style         Vault GUI       td       td style  ENHANCED  td       td style         Streamlined and aligned navigation with HCP Vault UI         br    br          Learn more   a href   vault docs configuration ui  Vault UI  a        td      tr      tr       td style         Transit       td       td style  ENHANCED  td       td style          b Contributed by the Vault community  b   Support for public key only Transit       keys and BYOK secured export of key material         br    br          Learn more   a href   vault api docs secret transit  Transit Secrets Engine  a        td      tr       tbody    table      Enterprise updates   table     thead       tr         th style  Release  th         th style  Update  th         th style  Description  th        tr      thead     tbody      tr       td style         Vault replication       td       td style  ENHANCED  td       td style         Stability improvements based on customer feedback for Vault 1 13  See the        a href  https   raw githubusercontent com hashicorp vault main CHANGELOG md           Vault changelog         a        for a full list of bug fixes         br    br          Learn more  nbsp         a href   vault docs internals replication  Replication overview  a        td      tr      tr       td style         License utilization reporting       td       td style  GA  td       td style         Enables automatic license utilization reporting for you and HashiCorp to       ensure transparent  accurate billing         br    br          Learn more  nbsp         a href   vault docs enterprise license utilization reporting  Automated License utilization reporting  a        td      tr       tbody    table      Feature deprecations and EOL  Deprecated in 1 14   Retired in 1 14                                      Vault Agent API proxy support    Duplicative Docker Images  https   hub docker com   vault    include  release notes deprecation note mdx


vault Software Release date March 1 2023 Vault 1 13 0 release notes page title 1 13 0 layout docs This page contains release notes for Vault 1 13 0

Answer:
---
layout: docs
page_title: 1.13.0
description: |-
  This page contains release notes for Vault 1.13.0
---

# Vault 1.13.0 release notes

**Software Release date:** March 1, 2023

**Summary:** Vault Release 1.13.0 offers features and enhancements that improve
the user experience while solving critical  issues previously encountered by our
customers. We are providing an overview  of improvements in this set of  release
notes.

We encourage you to [upgrade](/vault/docs/upgrading) to the latest release of
Vault to take advantage of the new benefits provided. With this latest release,
we offer solutions to critical feature gaps that were identified previously.
Please refer to the
[Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#1130-rc1)
within the Vault release for further information on product improvements,
including a comprehensive list of bug fixes.

Some of these enhancements and changes in this release include the following:

- **PKI improvements:**
   - **Cross Cluster PKI Certificate Revocation:** Introducing a new unified
     OCSP responder and CRL builder that enables a certificate revocations and
     CRL view across clusters for a given PKI mount.
   - **PKI UI Beta:** New UI introducing cross-signing flow, overview page,
     roles and keys view.
   - **Health Checks:** Provide a health overview of PKI mounts for proactive
     actions and troubleshooting.
   - **Command Line:** Simplified CLI to discover, rotate issuers and related
     commands for PKI mounts

- **Azure Auth Improvements:**
   - **Rotate-root support:** Add the ability to rotate the root account's
     client secret defined in the auth method's configuration via the new
     `rotate-root` endpoint.
   - **Managed Identities authentication:** The auth method now allows any Azure
     resource that supports managed identities to authenticate with Vault.
   - **VMSS Flex authentication:** Add support for Virtual Machine Scale Set
     (VMSS) Flex authentication.

- **GCP Secrets Impersonated Account Support:** Add support for GCP service
  account impersonation, allowing callers to generate a GCP access token without
  requiring Vault to store or retrieve a GCP service account key for each role.
- **Managed Keys in Transit Engine:** Support for offloading Transit Key
  operations to HSMs/external KMS.
- **KMIP Secret Engine Enhancements:** Implemented Asymmetric Key Lifecycle
  Server and Advanced Cryptographic Server profiles. Added support for RSA keys
  and operations such as:  MAC, MAC Verify, Sign, Sign Verify, RNG Seed and RNG
  Retrieve.
- **Vault as a SSM:** Support is planned for an upcoming Vault PKCS#11 Provider
  version to include mechanisms for encryption, decryption, signing and
  signature verification for AES and RSA keys.
- **Replication (enterprise):** We fixed a bug that could cause a cluster to
  wind up in a permanent merkle-diff/merkle-sync loop and never enter
  stream-wals, particularly in cases of high write loads on the primary cluster.
- **Share Secrets in Independent Namespaces (enterprise):** You can now add
  users from namespaces outside a namespace hierarchy to a group in a given
  namespace hierarchy. For Vault Agent, you can now grant it access to secrets
  outside the namespace where it authenticated, and reduce the number of Agents
  you need to run.
- **User Lockout:** Vault now supports configuration to lock out users when they
  have consecutive failed login attempts. This feature is **enabled by default**
  in 1.13 for the userpass, ldap, and approle auth methods.
- **Event System (Alpha):** Vault has a new experimental event system. Events
  are currently only generated on writes to the KV secrets engine, but external
  plugins can also be updated to start generating events.
- **Kubernetes authentication plugin bug fix:** Ensures a consistent TLS
  configuration for all k8s API requests. This fixes a bug where it was possible
  for the http.Client's Transport to be missing the necessary root CAs to ensure
  that all TLS connections between the auth engine and the Kubernetes API were
  validated against the configured set of CA certificates.
- **Kubernetes Secretes Engine on Vault UI:** Introducing Kubernetes secret
  engine support on the UI
- **Client Count UI improvements:** Combining current month and previous history
  into one dashboard
- **OCSP Support in the TLS Certificate Auth Method:** The auth method now can
  check for revoked certificates using the OCSP protocol.
- **UI Wizard removal:** The UI Wizard has been removed from the UI since the
  information was occasionally out-of-date and did not align with the latest
  changes. A new and enhanced UI experience is planned in a future release.

- **Vault Agent improvements:**
   - Auto-auth introduced `token_file` method which reads an existing token from
     a file. The token file method is designed for development and testing. It
     is not suitable for production deployment.
   - Listeners for the Vault Agent can define a role set to `metrics_only` so
     that a service can be configured to listen on a particular port to collect
     metrics.
   - Vault Agent can read configurations from multiple files.
   - Users can specify the log file path using the `-log-file` command flag or
     `VAULT_LOG_FILE` environment variable. This is particularly useful when
     Vault Agent is running as a Windows service.

- **OpenAPI-based Go & .NET Client Libraries (Public Beta):** Use the new Go &
  .NET client libraries to interact with the Vault API from your applications.
   - [OpenAPI-based Go client library](https://github.com/hashicorp/vault-client-go/)
   - [OpenAPI-based .NET client library](https://github.com/hashicorp/vault-client-dotnet/)

## Known issues

When Vault is configured without a TLS certificate on the TCP listener, the Vault UI may throw an error that blocks you from performing operational tasks.

The error message: `Q.randomUUID is not a function`

<Note>

Refer to this [Knowledge Base article](https://support.hashicorp.com/hc/en-us/articles/14512496697875) for more details and a workaround.

</Note>

The fix for this UI issue is coming in the Vault 1.13.1 release.

@include 'perf-standby-token-create-forwarding-failure.mdx'

@include 'known-issues/update-primary-data-loss.mdx'

@include 'known-issues/internal-error-namespace-missing-policy.mdx'

@include 'known-issues/ephemeral-loggers-memory-leak.mdx'

@include 'known-issues/sublogger-levels-unchanged-on-reload.mdx'

@include 'known-issues/expiration-metrics-fatal-error.mdx'

@include 'known-issues/perf-secondary-many-mounts-deadlock.mdx'

@include 'known-issues/1_13-reload-census-panic-standby.mdx'

## Feature deprecations and EOL

Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page
for up-to-date information on feature deprecations and plans. A [Feature
Deprecation FAQ](/vault/docs/deprecation/faq) page addresses questions about
decisions made about Vault feature deprecations.

layout  docs page title  1 13 0 description       This page contains release notes for Vault 1 13 0        Vault 1 13 0 release notes    Software Release date    March 1  2023    Summary    Vault Release 1 13 0 offers features and enhancements that improve the user experience while solving critical  issues previously encountered by our customers  We are providing an overview  of improvements in this set of  release notes   We encourage you to  upgrade   vault docs upgrading  to the latest release of Vault to take advantage of the new benefits provided  With this latest release  we offer solutions to critical feature gaps that were identified previously  Please refer to the  Changelog  https   github com hashicorp vault blob main CHANGELOG md 1130 rc1  within the Vault release for further information on product improvements  including a comprehensive list of bug fixes   Some of these enhancements and changes in this release include the following       PKI improvements           Cross Cluster PKI Certificate Revocation    Introducing a new unified      OCSP responder and CRL builder that enables a certificate revocations and      CRL view across clusters for a given PKI mount         PKI UI Beta    New UI introducing cross signing flow  overview page       roles and keys view         Health Checks    Provide a health overview of PKI mounts for proactive      actions and troubleshooting         Command Line    Simplified CLI to discover  rotate issuers and related      commands for PKI mounts      Azure Auth Improvements           Rotate root support    Add the ability to rotate the root account s      client secret defined in the auth method s configuration via the new       rotate root  endpoint         Managed Identities authentication    The auth method now allows any Azure      resource that supports managed identities to authenticate with Vault         VMSS Flex authentication    Add support for Virtual Machine Scale Set       VMSS  Flex authentication       GCP Secrets Impersonated Account Support    Add support for GCP service   account impersonation  allowing callers to generate a GCP access token without   requiring Vault to store or retrieve a GCP service account key for each role      Managed Keys in Transit Engine    Support for offloading Transit Key   operations to HSMs external KMS      KMIP Secret Engine Enhancements    Implemented Asymmetric Key Lifecycle   Server and Advanced Cryptographic Server profiles  Added support for RSA keys   and operations such as   MAC  MAC Verify  Sign  Sign Verify  RNG Seed and RNG   Retrieve      Vault as a SSM    Support is planned for an upcoming Vault PKCS 11 Provider   version to include mechanisms for encryption  decryption  signing and   signature verification for AES and RSA keys      Replication  enterprise     We fixed a bug that could cause a cluster to   wind up in a permanent merkle diff merkle sync loop and never enter   stream wals  particularly in cases of high write loads on the primary cluster      Share Secrets in Independent Namespaces  enterprise     You can now add   users from namespaces outside a namespace hierarchy to a group in a given   namespace hierarchy  For Vault Agent  you can now grant it access to secrets   outside the namespace where it authenticated  and reduce the number of Agents   you need to run      User Lockout    Vault now supports configuration to lock out users when they   have consecutive failed login attempts  This feature is   enabled by default     in 1 13 for the userpass  ldap  and approle auth methods      Event System  Alpha     Vault has a new experimental event system  Events   are currently only generated on writes to the KV secrets engine  but external   plugins can also be updated to start generating events      Kubernetes authentication plugin bug fix    Ensures a consistent TLS   configuration for all k8s API requests  This fixes a bug where it was possible   for the http Client s Transport to be missing the necessary root CAs to ensure   that all TLS connections between the auth engine and the Kubernetes API were   validated against the configured set of CA certificates      Kubernetes Secretes Engine on Vault UI    Introducing Kubernetes secret   engine support on the UI     Client Count UI improvements    Combining current month and previous history   into one dashboard     OCSP Support in the TLS Certificate Auth Method    The auth method now can   check for revoked certificates using the OCSP protocol      UI Wizard removal    The UI Wizard has been removed from the UI since the   information was occasionally out of date and did not align with the latest   changes  A new and enhanced UI experience is planned in a future release       Vault Agent improvements         Auto auth introduced  token file  method which reads an existing token from      a file  The token file method is designed for development and testing  It      is not suitable for production deployment       Listeners for the Vault Agent can define a role set to  metrics only  so      that a service can be configured to listen on a particular port to collect      metrics       Vault Agent can read configurations from multiple files       Users can specify the log file path using the   log file  command flag or       VAULT LOG FILE  environment variable  This is particularly useful when      Vault Agent is running as a Windows service       OpenAPI based Go    NET Client Libraries  Public Beta     Use the new Go      NET client libraries to interact with the Vault API from your applications        OpenAPI based Go client library  https   github com hashicorp vault client go         OpenAPI based  NET client library  https   github com hashicorp vault client dotnet       Known issues  When Vault is configured without a TLS certificate on the TCP listener  the Vault UI may throw an error that blocks you from performing operational tasks   The error message   Q randomUUID is not a function    Note   Refer to this  Knowledge Base article  https   support hashicorp com hc en us articles 14512496697875  for more details and a workaround     Note   The fix for this UI issue is coming in the Vault 1 13 1 release    include  perf standby token create forwarding failure mdx    include  known issues update primary data loss mdx    include  known issues internal error namespace missing policy mdx    include  known issues ephemeral loggers memory leak mdx    include  known issues sublogger levels unchanged on reload mdx    include  known issues expiration metrics fatal error mdx    include  known issues perf secondary many mounts deadlock mdx    include  known issues 1 13 reload census panic standby mdx       Feature deprecations and EOL  Please refer to the  Deprecation Plans and Notice   vault docs deprecation  page for up to date information on feature deprecations and plans  A  Feature Deprecation FAQ   vault docs deprecation faq  page addresses questions about decisions made about Vault feature deprecations


vault Software Release Date November 19 2021 layout docs Vault 1 9 0 release notes page title 1 9 0 This page contains release notes for Vault 1 9 0

Answer:
---
layout: docs
page_title: 1.9.0
description: |-
  This page contains release notes for Vault 1.9.0.
---

# Vault 1.9.0 release notes

**Software Release Date**: November 19, 2021

**Summary**: This document captures major updates as part of Vault release 1.9.0, including new features, breaking changes, enhancements, deprecation, and EOL plans. Refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) for additional changes made within the Vault 1.9 release.

## New features

This section describes the new features introduced as part of Vault 1.9.0.

### Client count improvements

Several improvements to client count were made to help customers better track and identify client attribution and reduce overcomputing.

#### Improved computation of client counts and usability within the usage metrics UI

The improvements made include the following:

* New logic enables de-duplication of non-entity tokens, thereby reducing their contribution towards the client count
* New logic allows entities to be created for local auth mounts, thereby eliminating  non-entity-tokens being  issued by the local auth mounts and reducing the overall client count
* Eliminates root tokens from the client count aggregate
* Displays client counts per namespace (top ten, descending order by attribution) in the usage metrics UI with the ability to export data for all namespaces
* Displays clients earlier than a month in the usage metrics UI (within ten minutes since initiation of computation)

### Advanced data protection module (ADP) enhancements

The following section provides details about the ADP module features added in this release.

#### Advanced I/O handling for tranform FPE (ADP-Transform)

Users of the Format Preserving Encryption (FPE) feature of ADP Transform will now benefit from increased flexibility with regards to formatting the input and output of their data. [Transformation templates](/vault/tutorials/adp/transform#advanced-handling) are receiving two new fields- **encode_format** and **decode_formats** -that allow users to specify and format individual [capturing groups](https://www.regular-expressions.info/refcapture.html) within the regular expressions that define their formats.

#### MS SQL TDE (ADP-KM)

We added support to Vault Enterprise for customers who want Vault to manage encryption keys for Transparent Data Encryption on MSSQL servers.

#### Key management Secrets(KMS) engine - GCP (ADP-KM)

The [KMS Engine for GCP](/vault/docs/secrets/gcpkms) provides key management via the Google Cloud KMS to assist with automating many GCP key management functions.

## Other features and enhancements

This section describes other features and enhancements introduced as part of the Vault 1.9 release.

### Vault agent improvements

Improvements were made to the Vault Agent Cache to ensure that [consul-template is always routed through the Vault Agent cache](/vault/docs/agent/template), therefore, eliminating the need for listeners to be defined in the Vault Agent for just templating.

### Customized username generation for database dynamic credentials

This feature enables customization of username for database dynamic credentials. This feature helps customers better manage and correlate usernames for various actions such as troubleshooting, etc. Vault 1.9 supports Postgres, MSSQL, MySQL, Oracle, MongoDB.

### Customizable HTTP headers for Vault

This feature allows security operators to configure [custom response headers](/vault/docs/configuration/listener/tcp) to HTTP root path (`/`) and API endpoints (`/v1/*`), in addition to the previously supported UI paths through the server HCL configuration file.

### Support for IBM s390X CPU architecture

This feature adds support for Vault to run on the IBM s390x architecture via the [equivalent binary](https://releases.hashicorp.com/vault/1.9.0+ent/).

### Namespace API lock

This [feature](/vault/docs/concepts/namespace-api-lock) allows namespace administrators to flexibly control operations such as locking APIs from child namespaces to which they have access. This enables them to restrict access to their domain in a multi-tenant environment and perform break-glass procedures in times of emergency to protect a cluster from within their child namespace.

### Vault terraform provider v3

We have upgraded the [Vault Terraform Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) to the latest version of the [Terraform Plugin SDKv2](/terraform/plugin/sdkv2) to leverage new features.

### Azure secrets engine

The following enhancement are included:

* Added `use_microsoft_graph_api` configuration parameter is added to use with Microsoft Graph API. We are targeting to remove Azure Active Directory API by [June 30, 2022](https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview).
* Rotate root API is now available to rotate client_secret immediately after configuration.

### Customized metadata for KV

This [enhancement](/vault/api-docs/secret/kv/kv-v2) provides the ability to set version-agnostic custom key metadata for Vault KVv2 secrets via a metadata endpoint. This custom metadata is also visible in the UI.

## UI enhancements
### Expanding the UI for more DB secrets engines

We have been adding support for DB secrets engines in the UI over the past few releases. In the Vault 1.9 release, we have added support for [Oracle](/vault/docs/secrets/databases/oracle) and [ElasticSearch](/vault/docs/secrets/databases/elasticdb) and [PostgresSQL](/vault/docs/secrets/databases/postgresql) database secrets engines in the UI.

### PKI certificate metadata

The [PKI Secrets Engine](/vault/docs/secrets/pki) now displays additional PKI certificate metadata in the UI, such as date issued, date of expiry, serial number, and subject/name.

## Tech preview features

### KV secrets engine v2 patch operations

This feature provides a more streamlined method for managing [KV v2 secrets](/vault/api-docs/secret/kv/kv-v2), enabling customers to better maintain least privilege security in automated environments. This feature allows performing partial updates to KV v2 secrets without requiring to read the full KV secret's key/value pairs.

### Vault as an OIDC provider

Vault can now act as an OIDC Provider so applications can leverage the pre-existing [Vault identities](/vault/api-docs/secret/identity) to authenticate into applications.

## Breaking changes

The following section details breaking changes introduced in Vault 1.9.

### Removal of HTTP request counters

In Vault 1.9, the [internal HTTP Request count API](/vault/api-docs/system/internal-counters#http-requests) was removed from the product. Calls to the endpoint will result in a **404 error** with a message stating that functionality on this path has been removed.
Please refer to the [upgrade guide](/vault/docs/upgrading/upgrade-to-1.9.x) for more information.

As called out in the documentation, Vault does not make backwards compatible guarantees on internal APIs (those prefaced with `sys/internal`). They are subject to change and may disappear without notice.

## Feature deprecations and EOL

Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page for up-to-date information on feature deprecations and plans. An [FAQ](/vault/docs/deprecation/faq) page is also available to address questions concerning decisions made about Vault feature deprecations.

layout  docs page title  1 9 0 description       This page contains release notes for Vault 1 9 0         Vault 1 9 0 release notes    Software Release Date    November 19  2021    Summary    This document captures major updates as part of Vault release 1 9 0  including new features  breaking changes  enhancements  deprecation  and EOL plans  Refer to the  Changelog  https   github com hashicorp vault blob main CHANGELOG md  for additional changes made within the Vault 1 9 release      New features  This section describes the new features introduced as part of Vault 1 9 0       Client count improvements  Several improvements to client count were made to help customers better track and identify client attribution and reduce overcomputing        Improved computation of client counts and usability within the usage metrics UI  The improvements made include the following     New logic enables de duplication of non entity tokens  thereby reducing their contribution towards the client count   New logic allows entities to be created for local auth mounts  thereby eliminating  non entity tokens being  issued by the local auth mounts and reducing the overall client count   Eliminates root tokens from the client count aggregate   Displays client counts per namespace  top ten  descending order by attribution  in the usage metrics UI with the ability to export data for all namespaces   Displays clients earlier than a month in the usage metrics UI  within ten minutes since initiation of computation       Advanced data protection module  ADP  enhancements  The following section provides details about the ADP module features added in this release        Advanced I O handling for tranform FPE  ADP Transform   Users of the Format Preserving Encryption  FPE  feature of ADP Transform will now benefit from increased flexibility with regards to formatting the input and output of their data   Transformation templates   vault tutorials adp transform advanced handling  are receiving two new fields    encode format   and   decode formats    that allow users to specify and format individual  capturing groups  https   www regular expressions info refcapture html  within the regular expressions that define their formats        MS SQL TDE  ADP KM   We added support to Vault Enterprise for customers who want Vault to manage encryption keys for Transparent Data Encryption on MSSQL servers        Key management Secrets KMS  engine   GCP  ADP KM   The  KMS Engine for GCP   vault docs secrets gcpkms  provides key management via the Google Cloud KMS to assist with automating many GCP key management functions      Other features and enhancements  This section describes other features and enhancements introduced as part of the Vault 1 9 release       Vault agent improvements  Improvements were made to the Vault Agent Cache to ensure that  consul template is always routed through the Vault Agent cache   vault docs agent template   therefore  eliminating the need for listeners to be defined in the Vault Agent for just templating       Customized username generation for database dynamic credentials  This feature enables customization of username for database dynamic credentials  This feature helps customers better manage and correlate usernames for various actions such as troubleshooting  etc  Vault 1 9 supports Postgres  MSSQL  MySQL  Oracle  MongoDB       Customizable HTTP headers for Vault  This feature allows security operators to configure  custom response headers   vault docs configuration listener tcp  to HTTP root path       and API endpoints    v1      in addition to the previously supported UI paths through the server HCL configuration file       Support for IBM s390X CPU architecture  This feature adds support for Vault to run on the IBM s390x architecture via the  equivalent binary  https   releases hashicorp com vault 1 9 0 ent         Namespace API lock  This  feature   vault docs concepts namespace api lock  allows namespace administrators to flexibly control operations such as locking APIs from child namespaces to which they have access  This enables them to restrict access to their domain in a multi tenant environment and perform break glass procedures in times of emergency to protect a cluster from within their child namespace       Vault terraform provider v3  We have upgraded the  Vault Terraform Provider  https   registry terraform io providers hashicorp vault latest docs  to the latest version of the  Terraform Plugin SDKv2   terraform plugin sdkv2  to leverage new features       Azure secrets engine  The following enhancement are included     Added  use microsoft graph api  configuration parameter is added to use with Microsoft Graph API  We are targeting to remove Azure Active Directory API by  June 30  2022  https   docs microsoft com en us graph migrate azure ad graph overview     Rotate root API is now available to rotate client secret immediately after configuration       Customized metadata for KV  This  enhancement   vault api docs secret kv kv v2  provides the ability to set version agnostic custom key metadata for Vault KVv2 secrets via a metadata endpoint  This custom metadata is also visible in the UI      UI enhancements     Expanding the UI for more DB secrets engines  We have been adding support for DB secrets engines in the UI over the past few releases  In the Vault 1 9 release  we have added support for  Oracle   vault docs secrets databases oracle  and  ElasticSearch   vault docs secrets databases elasticdb  and  PostgresSQL   vault docs secrets databases postgresql  database secrets engines in the UI       PKI certificate metadata  The  PKI Secrets Engine   vault docs secrets pki  now displays additional PKI certificate metadata in the UI  such as date issued  date of expiry  serial number  and subject name      Tech preview features      KV secrets engine v2 patch operations  This feature provides a more streamlined method for managing  KV v2 secrets   vault api docs secret kv kv v2   enabling customers to better maintain least privilege security in automated environments  This feature allows performing partial updates to KV v2 secrets without requiring to read the full KV secret s key value pairs       Vault as an OIDC provider  Vault can now act as an OIDC Provider so applications can leverage the pre existing  Vault identities   vault api docs secret identity  to authenticate into applications      Breaking changes  The following section details breaking changes introduced in Vault 1 9       Removal of HTTP request counters  In Vault 1 9  the  internal HTTP Request count API   vault api docs system internal counters http requests  was removed from the product  Calls to the endpoint will result in a   404 error   with a message stating that functionality on this path has been removed  Please refer to the  upgrade guide   vault docs upgrading upgrade to 1 9 x  for more information   As called out in the documentation  Vault does not make backwards compatible guarantees on internal APIs  those prefaced with  sys internal    They are subject to change and may disappear without notice      Feature deprecations and EOL  Please refer to the  Deprecation Plans and Notice   vault docs deprecation  page for up to date information on feature deprecations and plans  An  FAQ   vault docs deprecation faq  page is also available to address questions concerning decisions made about Vault feature deprecations


vault This page contains release notes for Vault 1 11 0 Vault 1 11 0 release notes Software Release date June 21 2022 page title 1 11 0 layout docs

Answer:
---
layout: docs
page_title: 1.11.0
description: |-
  This page contains release notes for Vault 1.11.0
---

# Vault 1.11.0 release notes

**Software Release date:** June 21, 2022

**Summary:** Vault Release 1.11.0 offers features and enhancements that improve the user experience while closing the loop on key issues previously encountered by our customers. We are providing a summary of these improvements in these release notes.

We encourage you to upgrade to the latest release to take advantage of the new benefits that we are providing. With this latest release, we offer solutions to critical feature gaps that have been identified previously. For further information on product improvements, including a comprehensive list of bug fixes, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) within the Vault  release.

Some of these enhancements and changes in this release include:

- Vault Consul secrets engine provides a templating policy to allow node and service identities to be set on the Consul token creation
- Snowflake secrets engine added a key/pair-based authentication
- Vault adds a Kubernetes secrets engine to allow creating dynamic k8s service accounts
- ADP-Transform extends its functionality by adding a convergent tokenization mode and a tokenization lookup
- ADP-KM adds four new operations
- Client count tooling improvements to help understand the attribution of clients better
- Integration storage autopilot improvements include auto upgrade and redundancy zones
- Plugin Multiplexing support is extended to secret and auth plugins, allowing them to be managed more efficiently with a single process

## New features

This section describes the new features introduced as part of Vault 1.11.0.

### Configure GCP auth to target non-public good API addresses

The GCP auth method only allows for public API endpoints to be configured for authentication purposes. Workloads running in GCP that do not have external internet access need the ability to authenticate using [Private Google Access](https://cloud.google.com/vpc/docs/private-google-access#pga). In Vault 1.11.0, we allow for customization of certain service endpoints. For more information, refer to the [GCP auth method](/vault/api-docs/auth/gcp#custom_endpoint) documentation.

### Support for key/pair based authentication for snowflake

In Vault 1.11.0, the Snowflake Database Engine supports an additional credential type that can be generated. For users not wanting to rely on the standard user/pass authentication to Snowflake, Vault can now dynamically generate RSA key pairs that allow users to authenticate into Snowflake. For more information, refer to the [Snowflake Database Secrets Engine](/vault/docs/secrets/databases/snowflake) and [Database Secrets Engine (API)](/vault/api-docs/secret/databases) documentation.

### Dynamic kubernetes service account secrets

Kubernetes service accounts must be manually generated and passed to a Kubernetes configuration file or the command line using a CLI tool such as kubectl to interact with Kubernetes clusters. With this method, service account credentials, which contain static secrets, can be exposed and would require a periodic manual rotation. To address this issue, we now support generating short-lived dynamic service accounts and associate role bindings to specific Kubernetes namespaces. For more information, refer to the [Kubernetes Auth Method](/vault/docs/auth/kubernetes) and [Kubernetes Auth Method (API)](/vault/api-docs/auth/kubernetes) documentation.

### New KV secrets engine (v2) utilities

The KV version 2 secrets engine now includes a set of utilities and enhancements for easier retrieval of key-value secrets and metadata. This includes:

* New optional Vault CLI mount flag (`vault kv get -mount=secret foo`).
* New flag to output a sample policy in HCL (`-output-policy`) for any Vault CLI command.
* New KV convenience/helper methods (GET and PUT) added to the Go client library.

For more details, refer to the [Version Key Value Secrets Engine](/vault/tutorials/secrets-management/versioned-kv) tutorial.

### Support for node identity and service identity for Vault consul secrets engine

Within the Consul secrets engine, practitioners writing a Vault role can specify node-identity or service-identity. You can also specify multiples of each identity on a Vault role. For more information, refer to the [Consul Secrets Engine](/vault/docs/secrets/consul) and [Consul Secrets Engine (API)](/vault/api-docs/secret/consul) documentation.

### Autopilot (Vault enterprise)

Vault release 1.7 introduced the Autopilot feature to Integrated Storage. In this release, new Autopilot features are added to Vault Enterprise to perform seamless automatic upgrades and support redundancy zones for improved cluster resiliency. Refer to the [autopilot endpoint](/vault/api-docs/system/storage/raftautopilot#sys-storage-raft-autopilot), [operator raft](/vault/docs/commands/operator/raft), [Autopilot](/vault/docs/concepts/integrated-storage/autopilot),  [Automated Upgrades](/vault/docs/enterprise/automated-upgrades), and [Redundancy Zones](/vault/docs/enterprise/redundancy-zones) documentation for more information.

## Other features and enhancements

This section describes other features and enhancements introduced as part of the Vault 1.11.0 release.

### Import externally-generated keys into transit secrets engine

Historically, Vault has only allowed the Transit secrets engine to utilize keys that were created by Vault itself. In this release, we have introduced an import feature for the Transit secrets engine that enables individuals to bring externally-generated encryption keys into a Transit keyring. These keys can then be used identically to internally-generated Transit keys.

### Improved CA rotation

PKI secrets engine users have sought a way to rotate root or intermediate CAs without causing service interruptions to any entities referencing them. Vault can now create the newly rotated PKI key pairs for servicing new certificates at the same path as the pre-existing keypair. This allows operators to gradually transition entities over to the new root certificate while the old is still active.

### Client count tooling improvements

We have made the following improvements to the Client Count tooling:

* Provide the ability to export the unique clients that contribute to the client count aggregate for the selected billing period via a new [activity export API endpoint](/vault/api-docs/system/internal-counters#activity-export). This feature is available in tech preview mode.
* Provide the ability to view changes to client counts month over month in the UI.

### MFA enhancements

Vault 1.10 introduced [Login MFA](/vault/docs/auth/login-mfa) support for Vault Community Edition. In this release, we included additional enhancements to the Login MFA feature by introducing the ability to configure Login MFA via the UI and providing an enhanced TOTP configuration experience via the QR code scan.

### Vault agent: support for using an existing valid certificate upon re-authentication

Enhancements have been made to the Vault Agent to support the parsing of a certificate that's been fetched. A new certificate will only be fetched upon a re-authentication if the certificate's lifetime has expired. This enhancement drastically reduces the resource overhead that Vault Agent users often experience due to over-fetching certificates.

### Namespace enhancements for Vault terraform

With Terraform Vault provider v3.7.0, we have made enhancements where it’s now possible to specify the namespace directly within the resource or data source. All resource or data source-specific namespaces are relative to their provider’s configured namespace. This enhancement encourages a better workflow for namespaces, reduces execution time when handling failures of a Terraform plan, and eases the burden on system resources such as memory, CPU, etc.

### ADP-Tranform enhancements

Two new enhancements were made to the Transform secrets engine. The first is Convergent Tokenization, which allows tokenization transformations to be configured as _convergent_. When enabled, this guarantees that tokenizing a given plaintext and expiration more than once always results in the same token value being produced. Please refer to the [Convergent Tokenization](/vault/docs/secrets/transform/tokenization#convergence) document for more information. Token Lookup allows you to look up the value of a token given its plaintext. While this is not typically encouraged from a security perspective, it may be necessary for particular circumstances that require this operation. Note that token lookup is only supported when convergence is enabled. For more information on the endpoint, refer to the [Lookup Token](/vault/api-docs/secret/transform#lookup-token) documentation.

### KMIP support for import, query, encryption and decryption

Previously, KMIP did not support certain operations such as import, decrypt, encrypt, and query. These operations are now supported. For a complete list of supported KMIP operations, please refer to the [Supported KMIP Operations](/vault/docs/secrets/kmip) documentation.

@include 'pgx-params.mdx'

## Known issues

When you use Vault 1.11.0+ as a Consul's Connect CA, you may encounter an issue generating the leaf certificates ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Upgrade your [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid running into this problem.

-> Refer to this [Knowledge Base article](https://support.hashicorp.com/hc/en-us/articles/11308460105491) for more details.

## Feature deprecations and EOL

Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page for up-to-date information on feature deprecations and plans. An [Feature Deprecation FAQ](/vault/docs/deprecation/faq) page is also available to address questions concerning decisions made about Vault feature deprecations.

layout  docs page title  1 11 0 description       This page contains release notes for Vault 1 11 0        Vault 1 11 0 release notes    Software Release date    June 21  2022    Summary    Vault Release 1 11 0 offers features and enhancements that improve the user experience while closing the loop on key issues previously encountered by our customers  We are providing a summary of these improvements in these release notes   We encourage you to upgrade to the latest release to take advantage of the new benefits that we are providing  With this latest release  we offer solutions to critical feature gaps that have been identified previously  For further information on product improvements  including a comprehensive list of bug fixes  please refer to the  Changelog  https   github com hashicorp vault blob main CHANGELOG md  within the Vault  release    Some of these enhancements and changes in this release include     Vault Consul secrets engine provides a templating policy to allow node and service identities to be set on the Consul token creation   Snowflake secrets engine added a key pair based authentication   Vault adds a Kubernetes secrets engine to allow creating dynamic k8s service accounts   ADP Transform extends its functionality by adding a convergent tokenization mode and a tokenization lookup   ADP KM adds four new operations   Client count tooling improvements to help understand the attribution of clients better   Integration storage autopilot improvements include auto upgrade and redundancy zones   Plugin Multiplexing support is extended to secret and auth plugins  allowing them to be managed more efficiently with a single process      New features  This section describes the new features introduced as part of Vault 1 11 0       Configure GCP auth to target non public good API addresses  The GCP auth method only allows for public API endpoints to be configured for authentication purposes  Workloads running in GCP that do not have external internet access need the ability to authenticate using  Private Google Access  https   cloud google com vpc docs private google access pga   In Vault 1 11 0  we allow for customization of certain service endpoints  For more information  refer to the  GCP auth method   vault api docs auth gcp custom endpoint  documentation        Support for key pair based authentication for snowflake  In Vault 1 11 0  the Snowflake Database Engine supports an additional credential type that can be generated  For users not wanting to rely on the standard user pass authentication to Snowflake  Vault can now dynamically generate RSA key pairs that allow users to authenticate into Snowflake  For more information  refer to the  Snowflake Database Secrets Engine   vault docs secrets databases snowflake  and  Database Secrets Engine  API    vault api docs secret databases  documentation       Dynamic kubernetes service account secrets  Kubernetes service accounts must be manually generated and passed to a Kubernetes configuration file or the command line using a CLI tool such as kubectl to interact with Kubernetes clusters  With this method  service account credentials  which contain static secrets  can be exposed and would require a periodic manual rotation  To address this issue  we now support generating short lived dynamic service accounts and associate role bindings to specific Kubernetes namespaces  For more information  refer to the  Kubernetes Auth Method   vault docs auth kubernetes  and  Kubernetes Auth Method  API    vault api docs auth kubernetes  documentation       New KV secrets engine  v2  utilities  The KV version 2 secrets engine now includes a set of utilities and enhancements for easier retrieval of key value secrets and metadata  This includes     New optional Vault CLI mount flag   vault kv get  mount secret foo      New flag to output a sample policy in HCL    output policy   for any Vault CLI command    New KV convenience helper methods  GET and PUT  added to the Go client library   For more details  refer to the  Version Key Value Secrets Engine   vault tutorials secrets management versioned kv  tutorial       Support for node identity and service identity for Vault consul secrets engine  Within the Consul secrets engine  practitioners writing a Vault role can specify node identity or service identity  You can also specify multiples of each identity on a Vault role  For more information  refer to the  Consul Secrets Engine   vault docs secrets consul  and  Consul Secrets Engine  API    vault api docs secret consul  documentation       Autopilot  Vault enterprise   Vault release 1 7 introduced the Autopilot feature to Integrated Storage  In this release  new Autopilot features are added to Vault Enterprise to perform seamless automatic upgrades and support redundancy zones for improved cluster resiliency  Refer to the  autopilot endpoint   vault api docs system storage raftautopilot sys storage raft autopilot    operator raft   vault docs commands operator raft    Autopilot   vault docs concepts integrated storage autopilot     Automated Upgrades   vault docs enterprise automated upgrades   and  Redundancy Zones   vault docs enterprise redundancy zones  documentation for more information      Other features and enhancements  This section describes other features and enhancements introduced as part of the Vault 1 11 0 release       Import externally generated keys into transit secrets engine  Historically  Vault has only allowed the Transit secrets engine to utilize keys that were created by Vault itself  In this release  we have introduced an import feature for the Transit secrets engine that enables individuals to bring externally generated encryption keys into a Transit keyring  These keys can then be used identically to internally generated Transit keys       Improved CA rotation  PKI secrets engine users have sought a way to rotate root or intermediate CAs without causing service interruptions to any entities referencing them  Vault can now create the newly rotated PKI key pairs for servicing new certificates at the same path as the pre existing keypair  This allows operators to gradually transition entities over to the new root certificate while the old is still active       Client count tooling improvements  We have made the following improvements to the Client Count tooling     Provide the ability to export the unique clients that contribute to the client count aggregate for the selected billing period via a new  activity export API endpoint   vault api docs system internal counters activity export   This feature is available in tech preview mode    Provide the ability to view changes to client counts month over month in the UI       MFA enhancements  Vault 1 10 introduced  Login MFA   vault docs auth login mfa  support for Vault Community Edition  In this release  we included additional enhancements to the Login MFA feature by introducing the ability to configure Login MFA via the UI and providing an enhanced TOTP configuration experience via the QR code scan       Vault agent  support for using an existing valid certificate upon re authentication  Enhancements have been made to the Vault Agent to support the parsing of a certificate that s been fetched  A new certificate will only be fetched upon a re authentication if the certificate s lifetime has expired  This enhancement drastically reduces the resource overhead that Vault Agent users often experience due to over fetching certificates       Namespace enhancements for Vault terraform  With Terraform Vault provider v3 7 0  we have made enhancements where it s now possible to specify the namespace directly within the resource or data source  All resource or data source specific namespaces are relative to their provider s configured namespace  This enhancement encourages a better workflow for namespaces  reduces execution time when handling failures of a Terraform plan  and eases the burden on system resources such as memory  CPU  etc       ADP Tranform enhancements  Two new enhancements were made to the Transform secrets engine  The first is Convergent Tokenization  which allows tokenization transformations to be configured as  convergent   When enabled  this guarantees that tokenizing a given plaintext and expiration more than once always results in the same token value being produced  Please refer to the  Convergent Tokenization   vault docs secrets transform tokenization convergence  document for more information  Token Lookup allows you to look up the value of a token given its plaintext  While this is not typically encouraged from a security perspective  it may be necessary for particular circumstances that require this operation  Note that token lookup is only supported when convergence is enabled  For more information on the endpoint  refer to the  Lookup Token   vault api docs secret transform lookup token  documentation       KMIP support for import  query  encryption and decryption  Previously  KMIP did not support certain operations such as import  decrypt  encrypt  and query  These operations are now supported  For a complete list of supported KMIP operations  please refer to the  Supported KMIP Operations   vault docs secrets kmip  documentation    include  pgx params mdx      Known issues  When you use Vault 1 11 0  as a Consul s Connect CA  you may encounter an issue generating the leaf certificates   GH 15525  https   github com hashicorp consul pull 15525    Upgrade your  Consul version that includes the fix  https   support hashicorp com hc en us articles 11308460105491 01GMC24E6PPGXMRX8DMT4HZYTW  to avoid running into this problem       Refer to this  Knowledge Base article  https   support hashicorp com hc en us articles 11308460105491  for more details      Feature deprecations and EOL  Please refer to the  Deprecation Plans and Notice   vault docs deprecation  page for up to date information on feature deprecations and plans  An  Feature Deprecation FAQ   vault docs deprecation faq  page is also available to address questions concerning decisions made about Vault feature deprecations