Enable the kv-v2 secrets engine
Enable the kv-v2 secrets engine
Enable the kv-v2 secrets engine
Itential supports only kv-v2. kv-v1 is not supported.
You must enable and configure the Hashicorp Vault secrets engine before it can manage and share secrets securely.
Key-value version 2 (kv-v2) is a secrets engine that stores arbitrary secrets as key-value pairs with built-in versioning capabilities.
Version control
Enhanced safety
Audit capabilities
Kv-v2 is HashiCorp’s recommended version for production use. It supersedes KV-V1, which lacks versioning and soft delete capabilities.
Each time you update a secret, kv-v2 creates a new version while preserving previous versions:
Kv-v2 uses a specific API path format that includes /data/:
This /data/ segment distinguishes secret data from metadata and configuration endpoints. You’ll see this reflected in the Itential Platform configuration.
Run the following command to enable the KV secrets engine. Version 2 is recommended for Vault.
Navigate to /opt/pronghorn/current and edit the properties.json file with the location of the token.txt file. See Configure Vault properties for details.
To use Vault, add a vaultProps section to your properties.json file.
Example configuration for token-based authentication:
The endpoint value kv-v2/data includes the /data path segment required by kv-v2 to access secret data. This distinguishes it from metadata or configuration endpoints.
An unspecified authMethod defaults to token-based authentication, maintaining compatibility with previous Itential Platform configurations.
Example configuration for AppRole authentication:
Setup of AppRole authentication and generation of role_id and secret_id must be done separately, including setting valid policies and TTL/usage limits.
The endpoint path can be customized. Here’s an example URL structure where v1 is a hard-coded file path in Itential Platform:
URL components:
http://localhost:8200 - Vault server address/v1 - Vault API version/kv-v2 - Secrets engine mount point/data - kv-v2 data endpoint (required for accessing secret values)The readOnly property in vaultProps controls how secret data is written to Vault. This property defaults to false.
When set to true:
If you change readOnly from false to true after storing passwords in Vault, all passwords will be lost and must be set manually.
After enabling kv-v2 and configuring Vault properties:
Review Platform logs to confirm successful Vault connection:
Look for messages indicating successful Vault authentication.
Create a test secret in Vault and verify Platform can retrieve it. See Create secrets for details.