Key/Value v2 plugin

The key/value (kv) secrets engine stores and versions arbitrary static secrets stored in Vault physical storage.

The kv v2 plugin uses soft deletes to make data inaccessible while allowing data recovery. When an entry is permanently deleted, Vault purges the underlying version data and marks the key metadata as destroyed.

Step-by-step instructions:

Upgrade from kv v1
Set up the kv v2 plugin

API

The KV secrets engine has a full HTTP API. Please see the KV secrets engine API for more details.

Terraform

You can manage KV v2 secret resources programmatically with the Vault Terraform provider. Refer to the Terraform Registry documentation for more details:

KV v2 secret engine resource