2a954ef072
* Update index.mdx Updated instructions for Vault Upgrade HA * Create vault-ha-upgrade.mdx Moved HA Vault upgrade instruction to a new page and added a Note for disabling automated upgrade procedure * Add the new vault-ha-upgrade page to the side menu * Format and wording edits * Remove extra paracentesis * Fix a typo * Change the title appears on the navigation --------- Co-authored-by: Yoko Hyakuna <yoko@hashicorp.com>
87 lines
4.4 KiB
Plaintext
87 lines
4.4 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Upgrading Vault - Guides
|
|
description: |-
|
|
These are general upgrade instructions for Vault for both non-HA and HA
|
|
setups. Please ensure that you also read the version-specific upgrade notes.
|
|
---
|
|
|
|
# Upgrading Vault
|
|
|
|
These are general upgrade instructions for Vault for both non-HA and HA setups.
|
|
_Please ensure that you also read any version-specific upgrade notes which can be
|
|
found in the sidebar._
|
|
|
|
!> **Important:** Always back up your data before upgrading! Vault does not
|
|
make backward-compatibility guarantees for its data store. Simply replacing the
|
|
newly-installed Vault binary with the previous version will not cleanly
|
|
downgrade Vault, as upgrades may perform changes to the underlying data
|
|
structure that make the data incompatible with a downgrade. If you need to roll
|
|
back to a previous version of Vault, you should roll back your data store as
|
|
well.
|
|
|
|
Vault upgrades are designed such that large jumps (ie 1.3.10 -> 1.7.x) are
|
|
supported. The upgrade notes for each intervening version must be reviewed. The
|
|
upgrade notes may describe additional steps or configuration to update before,
|
|
during, or after the upgrade.
|
|
|
|
## Integrated Storage Autopilot
|
|
|
|
Vault 1.11 introduced [automated
|
|
upgrades](/vault/docs/concepts/integrated-storage/autopilot#automated-upgrades) as
|
|
part of the Integrated Storage Autopilot feature. If your Vault environment is
|
|
configured to use Integrated Storage, consider leveraging this new feature to
|
|
upgrade your Vault environment.
|
|
|
|
-> **Tutorial:** Refer to the [Automate Upgrades with Vault
|
|
Enterprise](/vault/tutorials/raft/raft-upgrade-automation)
|
|
tutorial for more details.
|
|
|
|
## Agent
|
|
|
|
The Vault Agent is an API client of the Vault Server. Vault APIs are almost
|
|
always backwards compatible. When they are not, this is called out in the
|
|
upgrade guide for the new Vault version, and there is a lengthy deprecation
|
|
period. The Vault Agent version can lag behind the Vault Server version, though
|
|
we recommend keeping all Vault instances up to date with the most recent minor Vault version
|
|
to the extent possible.
|
|
|
|
## Testing the Upgrade
|
|
|
|
It's always a good idea to try to ensure that the upgrade will be successful in
|
|
your environment. The ideal way to do this is to take a snapshot of your data
|
|
and load it into a test cluster. However, if you are issuing secrets to third
|
|
party resources (cloud credentials, database credentials, etc.) ensure that you
|
|
do not allow external network connectivity during testing, in case credentials
|
|
expire. This prevents the test cluster from trying to revoke these resources
|
|
along with the non-test cluster.
|
|
|
|
## OSS to Enterprise Installations
|
|
|
|
Upgrading to Vault Enterprise installations follow the same steps as OSS upgrades except that the Vault Enterprise binary is to be used and the license file [applied](/vault/api-docs/system/license#install-license), when applicable. The Enterprise binary and license file can be obtained through your HashiCorp sales team.
|
|
|
|
## Non-HA Installations
|
|
|
|
Upgrading non-HA installations of Vault is as simple as replacing the Vault
|
|
binary with the new version and restarting Vault. Any upgrade tasks that can be
|
|
performed for you will be taken care of when Vault is unsealed.
|
|
|
|
Always use `SIGINT` or `SIGTERM` to properly shut down Vault.
|
|
|
|
Be sure to also read and follow any instructions in the version-specific
|
|
upgrade notes.
|
|
|
|
## HA Installations
|
|
|
|
The recommended upgrade procedure depends on the version of Vault you're currently on and the storage backend of Vault. If you're currently running on Vault 1.11 or later with Integrated Storage and you have Autopilot enabled, you should let Autopilot do the upgrade for you, as that's easier and
|
|
less prone to human error. Please refer to our [automated
|
|
upgrades](/vault/docs/concepts/integrated-storage/autopilot#automated-upgrades) documentation for information on this feature and our
|
|
[Automate Upgrades with Vault
|
|
Enterprise](/vault/tutorials/raft/raft-upgrade-automation)
|
|
tutorial for more details.
|
|
|
|
If you're currently on a version of Vault before 1.11, or you've chosen to opt-out the Autopilot automated upgrade features when running Vault after 1.11 with Integrated Storage, or if you are running Vault with other storage backend such as Consul. Please refer to our [Vault HA upgrades Pre 1.11/Without Autopilot Upgrade Automation](/vault/docs/upgrading/vault-ha-upgrade) documentation for more details. Please note that this upgrade procedure also applies if you are upgrading Vault from pre 1.11 to post 1.11.
|
|
|
|
|
|
|