HashiCorp Vault project - write additional key/value pair without overwritting existing ones

Question

When I put the first key/value pair to Vault:

vault write secret/item/33 item_name='item_name' 

It works well and I get:

vault read secret/item/33

Key                     Value
---                     -----
refresh_interval        768h0m0s
item_name               item_name

But if I want put additional field item_type:

vault write secret/item/33 item_type='item_type' 

It overwrites existing one:

vault read secret/item/33

Key                     Value
---                     -----
refresh_interval        768h0m0s
item_type               item_type

How to write additional field - key/value pair to Vault without replacing existing ones?

Maquette

Answer 1

You can only store one value per key. (Confirmed by Vault developer) Either you think on a data structure that is suitable and write a long string to this key or you are using a single key for each value which could look as follows:

vault write secret/item/33/name item_name='item_name'
vault write secret/item/33/type item_type='item_type'

Abbeyabbi

Answer 2

Vault with kv v2 engine has added this ability.

vault kv patch secret/item newkey=newvalue

Leitman

I am using version 1 which it's not allowed :( – Jasisa

Answer 3

Vault lets adding multiple key=value pairs; like this:

vault kv put -mount=kv demo/keys \
  GOODGUY="ClintEastwood" \
  BADGUY="LeeVanCleef" \
  UGLYGUY="EliWallach"

Contrivance

Answer 4

Vault doesn't allow you to append to an existing secret. It's actually really annoying. You first have to read the previous key/values and then write them back in at the same time that you're writing in the new key/values.

Here is a blog post I found where someone talks about that process: https://www.fritz.ninja/extending-vault-cli-with-some-ruby-love/

Essentially, he wrote his own command line tool that does the append for you automatically. He says he created the tool for his job, so he can't share the code, but he's started an open-source version on Github called Vaulty: https://github.com/playpasshq/vaulty

Shivaree

Answer 5

vault kv put secret/hello foo=world excited=yes even with Key/value v1 you should be able to set multiple as long as you specify both in the same put command.

Cardamom

Answer 6

Late to the OP. Anyways, what I'm doing is create a JSON file with levels and sublevels of data (nested-objects, feature not available only typing plain KEY=VALUE inputs) and then load the file into KV Engine through @ operator, like $ vault kv put -mount=secret foo @data.json, and of course handle file permissions and ownership properly. Whenever I need to rotate the values, just change the JSON file and then reupload it.

IMO it's even better than just type the values after the command because in that way it remains in bash history.

Smelly