a3dfde5cec
* conversion stage 1 * correct image paths * add sidebar title to frontmatter * docs/concepts and docs/internals * configuration docs and multi-level nav corrections * commands docs, index file corrections, small item nav correction * secrets converted * auth * add enterprise and agent docs * add extra dividers * secret section, wip * correct sidebar nav title in front matter for apu section, start working on api items * auth and backend, a couple directory structure fixes * remove old docs * intro side nav converted * reset sidebar styles, add hashi-global-styles * basic styling for nav sidebar * folder collapse functionality * patch up border length on last list item * wip restructure for content component * taking middleman hacking to the extreme, but its working * small css fix * add new mega nav * fix a small mistake from the rebase * fix a content resolution issue with middleman * title a couple missing docs pages * update deps, remove temporary markup * community page * footer to layout, community page css adjustments * wip downloads page * deps updated, downloads page ready * fix community page * homepage progress * add components, adjust spacing * docs and api landing pages * a bunch of fixes, add docs and api landing pages * update deps, add deploy scripts * add readme note * update deploy command * overview page, index title * Update doc fields Note this still requires the link fields to be populated -- this is solely related to copy on the description fields * Update api_basic_categories.yml Updated API category descriptions. Like the document descriptions you'll still need to update the link headers to the proper target pages. * Add bottom hero, adjust CSS, responsive friendly * Add mega nav title * homepage adjustments, asset boosts * small fixes * docs page styling fixes * meganav title * some category link corrections * Update API categories page updated to reflect the second level headings for api categories * Update docs_detailed_categories.yml Updated to represent the existing docs structure * Update docs_detailed_categories.yml * docs page data fix, extra operator page remove * api data fix * fix makefile * update deps, add product subnav to docs and api landing pages * Rearrange non-hands-on guides to _docs_ Since there is no place for these on learn.hashicorp, we'll put them under _docs_. * WIP Redirects for guides to docs * content and component updates * font weight hotfix, redirects * fix guides and intro sidenavs * fix some redirects * small style tweaks * Redirects to learn and internally to docs * Remove redirect to `/vault` * Remove `.html` from destination on redirects * fix incorrect index redirect * final touchups * address feedback from michell for makefile and product downloads
78 lines
3.3 KiB
Markdown
78 lines
3.3 KiB
Markdown
---
|
|
layout: "docs"
|
|
page_title: "Upgrading to Vault 0.6.2 - Guides"
|
|
sidebar_title: "Upgrade to 0.6.2"
|
|
sidebar_current: "docs-upgrading-to-0.6.2"
|
|
description: |-
|
|
This page contains the list of deprecations and important or breaking changes
|
|
for Vault 0.6.2. Please read it carefully.
|
|
---
|
|
|
|
# Overview
|
|
|
|
This page contains the list of deprecations and important or breaking changes
|
|
for Vault 0.6.2. Please read it carefully.
|
|
|
|
## Request Forwarding On By Default
|
|
|
|
In 0.6.1 this feature was in beta and required opting-in, but is now enabled by
|
|
default. This can be disabled via the `"disable_clustering"` parameter in
|
|
Vault's [config](/docs/configuration/index.html), or
|
|
per-request with the `X-Vault-No-Request-Forwarding` header.
|
|
|
|
## AppRole Role Constraints
|
|
|
|
Creating or updating a role now requires at least one constraint to be enabled,
|
|
whereas previously it was sufficient to require only the role ID by itself.
|
|
Currently there are two constraints: `bind_secret_id` and `bound_cidr_list`.
|
|
`bind_secret_id` is enabled by default. Roles which were previously using only
|
|
the role ID for authentication will continue to work but will require a
|
|
constraint to be specified if updated.
|
|
|
|
## Convergent Encryption v2
|
|
|
|
New keys in `transit` using convergent mode will use a new nonce derivation
|
|
mechanism rather than require the user to supply a nonce. While not explicitly
|
|
increasing security, it minimizes the likelihood that a user will use the mode
|
|
improperly and impact the security of their keys. Keys in convergent mode that
|
|
were created in 0.6.1 will continue to work with the same mechanism
|
|
(user-supplied nonce).
|
|
|
|
## `etcd` HA Off By Default
|
|
|
|
Following in the footsteps of `dynamodb`, the `etcd` storage backend now
|
|
requires that `ha_enabled` be explicitly specified in the configuration file.
|
|
The backend currently has known broken HA behavior, so this flag discourages
|
|
use by default without explicitly enabling it. If you are using this
|
|
functionality, when upgrading, you should set `ha_enabled` to `"true"` *before*
|
|
starting the new versions of Vault.
|
|
|
|
## Reading Wrapped Responses From `cubbyhole/response` Is Deprecated
|
|
|
|
The `sys/wrapping/unwrap` endpoint should be used instead as it provides
|
|
additional security, auditing, and other benefits. The ability to read directly
|
|
will be removed in a future release.
|
|
|
|
## Default/Max Lease/Token TTLs Now 32 Days
|
|
|
|
In previous versions of Vault the default was 30 days, but changing it to 32
|
|
days allows some operations (e.g. reauthenticating, renewing, etc.) to be
|
|
performed via a monthly cron job.
|
|
|
|
## AppRole Secret ID Endpoints Changed
|
|
|
|
Secret ID and Secret ID accessors are no longer part of request URLs. The `GET`
|
|
and `DELETE` operations are now moved to new endpoints (`/lookup` and
|
|
`/destroy`) which consumes the input from the body via `POST` (or `PUT`) and
|
|
not the URL.
|
|
|
|
## Behavior Change for `bound_iam_role_arn` in AWS-EC2 Backend
|
|
|
|
In prior versions a bug caused the `bound_iam_role_arn` value in the `aws-ec2`
|
|
auth method to actually use the instance profile ARN. This has been
|
|
corrected, but as a result there is a behavior change. To match using the
|
|
instance profile ARN, a new parameter `bound_iam_instance_profile_arn` has been
|
|
added. Existing roles will automatically transfer the value over to the correct
|
|
parameter, but the next time the role is updated, the new meanings will take
|
|
effect.
|