Migration from Salt Core

Important

The vault modules found in Salt >=3007 have the same core, so migration from these versions is frictionless. There are some further deprecations you should be aware of though.

This Salt Extension is based on a significant, but backwards-compatible refactoring of the vault modules found in Salt core <3007. If you’re migrating from these older modules, there is a single necessary change to make:

peer_run

This extension uses different endpoints for configuration and credential distribution. While it provides a fallback that keeps legacy configurations working, this requires unnecessary roundtrips and will be removed in some future release.

What was previously

peer_run:
  .*:
    - vault.generate_token

should be changed to:

peer_run:
  .*:
    - vault.get_config
    - vault.generate_new_token

Notable changes

The changelog for version 1.0.0 gives an overview of notable improvements versus the previous Salt core <3007 modules.

Changed config structure

Since there were many additions and changes, a new configuration structure was introduced. The old one is still recognized, but deprecated. Please migrate to the new structure at your convenience. The compatibility layer will be removed in some future release.

Renamed

• auth:token_backend –> cache:backend

• role_name –> issue:token:role_name

• policies –> policies:assign

• url –> server:url

• verify –> server:verify

• namespace –> server:namespace

• auth:allow_minion_override –> issue:allow_minion_override_params

• auth:ttl –>

  • for the master parameter –> issue:token:params:explicit_max_ttl

  • for the minion override –> issue_params:explicit_max_ttl

• auth:uses –>

  • for the master parameter –> issue:token:params:num_uses

  • for the minion override –> issue_params:num_uses

Deprecated functions

Execution module

• vault.clear_token_cache (use vault.clear_cache)

Runner

• vault.generate_token

Changes versus the 3007 release

This extension carries some deprecations that were never part of a Salt core release.

Deprecated defaults/configuration

SDB module

• The SDB module used to overwrite the whole secret when writing a single key. This behavior can be configured now with the patch profile value. This value defaults to false for now, but will be changed to true in the next major release since it is usually the desired behavior and in line with other SDB modules.

Pillar module

• The vault pillar module was previously configured in two styles:

  ext_pillar:
    - vault: path=secret/salt
    - vault:
        conf: path=secret/salt2
  

  This has been simplified to:

  ext_pillar:
    - vault: secret/salt
    - vault:
        path: secret/salt2
  

  Please update your configuration; the previous method will stop working in the next major release.

Deprecated functions

• vault.policy_fetch (use vault_policy.fetch)

• vault.policy_write (use vault_policy.write)

• vault.policy_delete (use vault_policy.delete)

• vault.policies_list (use vault_policy.list)

• vault.read_secret (use vault_secret.read)

• vault.read_secret_meta (use vault_secret.read_meta)

• vault.write_secret (use vault_secret.write)

• vault.write_raw (use vault_secret.write_raw)

• vault.patch_secret (use vault_secret.patch)

• vault.patch_raw (use vault_secret.patch_raw)

• vault.list_secrets (use vault_secret.list)

• vault.delete_secret (use vault_secret.delete)

• vault.restore_secret (use vault_secret.restore)

• vault.destroy_secret (use vault_secret.destroy)

• vault.wipe_secret (use vault_secret.wipe)

Deprecated states

• vault.policy_present (use vault_policy.present)

• vault.policy_absent (use vault_policy.absent)