# Vault **URL:** https://discuss.hashicorp.com/c/vault/30.md?page=1 [Latest](https://discuss.hashicorp.com/latest.md) · [Categories](https://discuss.hashicorp.com/categories.md) · [Tags](https://discuss.hashicorp.com/tags.md) **Page:** 2 --- ## [It appears the Hashicorp package repository is down](https://discuss.hashicorp.com/t/it-appears-the-hashicorp-package-repository-is-down/77425)
**Author:** [@mvanderlee](https://discuss.hashicorp.com/u/mvanderlee)\ **Replies:** 3\ **Last updated:** [May 15, 2026, 3:07pm UTC](https://discuss.hashicorp.com/t/it-appears-the-hashicorp-package-repository-is-down/77425 "2026-05-15T15:07:04Z")
0 main/binary-amd64/Packages Package list is empty preventing us from installing any packages I tried Ubuntu 24 & 26 --- ## [Raft FSM db file has wider permissions than needed](https://discuss.hashicorp.com/t/raft-fsm-db-file-has-wider-permissions-than-needed/74602)
**Author:** [@todd-dsm](https://discuss.hashicorp.com/u/todd-dsm)\ **Replies:** 2\ **Last updated:** [May 12, 2026, 9:19am UTC](https://discuss.hashicorp.com/t/raft-fsm-db-file-has-wider-permissions-than-needed/74602 "2026-05-12T09:19:31Z")
Hey all, I’ve been seeing this message in the logs \[WARN\[\] storage.raft.fsm: raft FSM db file has wider permissions than needed: needed=-rw------- existing=-rw-rw---- I’m working on an EKS cluster and installing via H… --- ## [Kerberos auth enabled shows empty Options map\[\]](https://discuss.hashicorp.com/t/kerberos-auth-enabled-shows-empty-options-map/77409)
**Author:** [@tonymathewt](https://discuss.hashicorp.com/u/tonymathewt)\ **Replies:** 0\ **Last updated:** [May 7, 2026, 1:55pm UTC](https://discuss.hashicorp.com/t/kerberos-auth-enabled-shows-empty-options-map/77409 "2026-05-07T13:55:12Z")
I have enabled kerberos with enable-passthrough for Authorization header as written here: Kerberos - Auth Methods | Vault | HashiCorp Developer. Below is the command executed and its result below: PS E:\\Vault\\vault\_2.0.… --- ## [Add metrics to the Vault Secrets Operator for rollout restart trigger counts](https://discuss.hashicorp.com/t/add-metrics-to-the-vault-secrets-operator-for-rollout-restart-trigger-counts/77406)
**Author:** [@mnacharov](https://discuss.hashicorp.com/u/mnacharov)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 3:11pm UTC](https://discuss.hashicorp.com/t/add-metrics-to-the-vault-secrets-operator-for-rollout-restart-trigger-counts/77406 "2026-05-06T15:11:55Z")
Hi, vault team! I’ve prepared PR to add metrics which could help me to increase observability of one of the cool features of the VSO, please give me some feedback, I’ll be happy to have it in future releases: --- ## [Release version 2.0 required for vault/api](https://discuss.hashicorp.com/t/release-version-2-0-required-for-vault-api/77396)
**Author:** [@pavan-d2](https://discuss.hashicorp.com/u/pavan-d2)\ **Replies:** 0\ **Last updated:** [May 4, 2026, 2:43am UTC](https://discuss.hashicorp.com/t/release-version-2-0-required-for-vault-api/77396 "2026-05-04T02:43:56Z")
Hi, The CVE-2026-34986 was fixed as part of the commit Backport \[VAULT-43813\] go: resolve CVE-2026-34986 and GHSA-78h2-9frx-… · hashicorp/vault@58d7286 · GitHub . However, this is not available as a release version, wit… --- ## [Vault UI color change](https://discuss.hashicorp.com/t/vault-ui-color-change/41403)
**Author:** [@angelafevi95](https://discuss.hashicorp.com/u/angelafevi95)\ **Replies:** 1\ **Last updated:** [May 1, 2026, 1:41pm UTC](https://discuss.hashicorp.com/t/vault-ui-color-change/41403 "2026-05-01T13:41:58Z")
Hi, I want to change the background/theme color on Vault and Consul UI to differentiate production from other environments. Would that be possible? In case it is, how? Thanks --- ## [Helm for vault 2.0](https://discuss.hashicorp.com/t/helm-for-vault-2-0/77388)
**Author:** [@harveycggit](https://discuss.hashicorp.com/u/harveycggit)\ **Replies:** 0\ **Last updated:** [April 30, 2026, 4:42pm UTC](https://discuss.hashicorp.com/t/helm-for-vault-2-0/77388 "2026-04-30T16:42:19Z")
Can I deploy vault 2.0.0 on 0.32.0 of Releases · hashicorp/vault-helm · GitHub ? --- ## [Sudden problem with Vault OIDC login](https://discuss.hashicorp.com/t/sudden-problem-with-vault-oidc-login/48773)
**Author:** [@voiprodrigo](https://discuss.hashicorp.com/u/voiprodrigo)\ **Replies:** 5\ **Last updated:** [April 29, 2026, 12:38pm UTC](https://discuss.hashicorp.com/t/sudden-problem-with-vault-oidc-login/48773 "2026-04-29T12:38:45Z")
Hi, I’m suddenly having a login issue after weeks of normal operation with Vault 1.12.2. I click on “Sign in with OIDC provider”, and almost immediately the main window shows “Error: The provider window was closed befo… --- ## [Need visibility of issued PKI certificates & expiry in Vault UI](https://discuss.hashicorp.com/t/need-visibility-of-issued-pki-certificates-expiry-in-vault-ui/77385)
**Author:** [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 8:57am UTC](https://discuss.hashicorp.com/t/need-visibility-of-issued-pki-certificates-expiry-in-vault-ui/77385 "2026-04-29T08:57:19Z")
Hi team, We are currently using the PKI secrets engine in HashiCorp Vault to issue certificates, and we have ensured that certificate storage is enabled (no\_store = false), which allows us to retrieve certificate detail… --- ## [Problem with null values in tfvars, works fine in a .tf file](https://discuss.hashicorp.com/t/problem-with-null-values-in-tfvars-works-fine-in-a-tf-file/77338)
**Author:** [@Matt\_Finnigan](https://discuss.hashicorp.com/u/Matt_Finnigan)\ **Replies:** 4\ **Last updated:** [April 25, 2026, 6:10pm UTC](https://discuss.hashicorp.com/t/problem-with-null-values-in-tfvars-works-fine-in-a-tf-file/77338 "2026-04-25T18:10:03Z")
I’m doing a refactor of our terraform. In the existing code, this works fine (excerpt). It creates an approle with no bound cidrs. inputs.tf: standard\_apps = \[ { "app\_name" : "test\_app" "auth" : \[{ "auth\_path" : "appro… --- ## [How to securely authenticate Vault Agent for long-running apps without a static secret\_id?](https://discuss.hashicorp.com/t/how-to-securely-authenticate-vault-agent-for-long-running-apps-without-a-static-secret-id/77324)
**Author:** [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\ **Replies:** 3\ **Last updated:** [April 16, 2026, 12:33pm UTC](https://discuss.hashicorp.com/t/how-to-securely-authenticate-vault-agent-for-long-running-apps-without-a-static-secret-id/77324 "2026-04-16T12:33:01Z")
Hi everyone, I am configuring Vault Agent for a long-running application and hitting a roadblock with the “Secret Zero” problem when using the AppRole auth method. I want Vault Agent to automatically fetch brand-new to… --- ## [Migration from AD secret engine to LDAP secret engine](https://discuss.hashicorp.com/t/migration-from-ad-secret-engine-to-ldap-secret-engine/77327)
**Author:** [@RachanaDhaked](https://discuss.hashicorp.com/u/RachanaDhaked)\ **Replies:** 0\ **Last updated:** [April 14, 2026, 7:52am UTC](https://discuss.hashicorp.com/t/migration-from-ad-secret-engine-to-ldap-secret-engine/77327 "2026-04-14T07:52:06Z")
We currently have an integration between our ServiceNow MID Server and HashiCorp Vault where the MID Server uses the Vault Credential Resolver to authenticate with Vault using a token and retrieve credentials from a conf… --- ## [Is Vault Restore Before Cluster Initialization a good enhancement?](https://discuss.hashicorp.com/t/is-vault-restore-before-cluster-initialization-a-good-enhancement/77321)
**Author:** [@RohanMittal-01](https://discuss.hashicorp.com/u/RohanMittal-01)\ **Replies:** 0\ **Last updated:** [April 11, 2026, 8:49pm UTC](https://discuss.hashicorp.com/t/is-vault-restore-before-cluster-initialization-a-good-enhancement/77321 "2026-04-11T20:49:08Z")
I am considering working on enabling vault restore without explicitly intializing and unsealing the new vault cluster before. It adds additional steps and resistance in case of recovery. As a newcomer to this forum,… --- ## [Vault Agent: PKI Token Type batch: invalid role or secret ID](https://discuss.hashicorp.com/t/vault-agent-pki-token-type-batch-invalid-role-or-secret-id/77306)
**Author:** [@linuxmail](https://discuss.hashicorp.com/u/linuxmail)\ **Replies:** 5\ **Last updated:** [April 9, 2026, 3:53pm UTC](https://discuss.hashicorp.com/t/vault-agent-pki-token-type-batch-invalid-role-or-secret-id/77306 "2026-04-09T15:53:43Z")
hi, I followed this Tutorial Generate mTLS certificates for Nomad using Vault | Nomad | HashiCorp Developer and it works for round about 30min and then it starts failing with: | \* invalid role or secret ID and I don… --- ## [Is it possible to have multiple Keycloak OIDC Discovery URLs?](https://discuss.hashicorp.com/t/is-it-possible-to-have-multiple-keycloak-oidc-discovery-urls/77308)
**Author:** [@garnett-jason](https://discuss.hashicorp.com/u/garnett-jason)\ **Replies:** 1\ **Last updated:** [April 8, 2026, 8:46pm UTC](https://discuss.hashicorp.com/t/is-it-possible-to-have-multiple-keycloak-oidc-discovery-urls/77308 "2026-04-08T20:46:32Z")
We have a Vault instance that’s accessible from multiple different private networks. We use keycloak for authentication and want the OIDC discovery URL to route the user to the correct keycloak, based on where they acce… --- ## [Designing Vault Agent + PKI + External System (DataPower) for Automated Certificate Rotation](https://discuss.hashicorp.com/t/designing-vault-agent-pki-external-system-datapower-for-automated-certificate-rotation/77292)
**Author:** [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\ **Replies:** 0\ **Last updated:** [March 30, 2026, 1:27pm UTC](https://discuss.hashicorp.com/t/designing-vault-agent-pki-external-system-datapower-for-automated-certificate-rotation/77292 "2026-03-30T13:27:59Z")
Hi everyone, I’m designing an automated certificate rotation system using HashiCorp Vault PKI and Vault Agent, and I’d like feedback on the architecture and best practices. Current setup: Vault Enterprise (AppRole a… --- ## [Why can't I change the unseal/recovery key after migration to transit auto-unseal?](https://discuss.hashicorp.com/t/why-cant-i-change-the-unseal-recovery-key-after-migration-to-transit-auto-unseal/77280)
**Author:** [@au1](https://discuss.hashicorp.com/u/au1)\ **Replies:** 1\ **Last updated:** [March 28, 2026, 10:33pm UTC](https://discuss.hashicorp.com/t/why-cant-i-change-the-unseal-recovery-key-after-migration-to-transit-auto-unseal/77280 "2026-03-28T22:33:31Z")
I have successfully migrated the seal type for a Vault cluster from shamir to transit. During this process, Vault did not create recovery keys. Running the rekey procedure (vault operator rekey) yields an empty list of k… --- ## [Piping environment variable into an exec command](https://discuss.hashicorp.com/t/piping-environment-variable-into-an-exec-command/77193)
**Author:** [@wj.van.den.bosch](https://discuss.hashicorp.com/u/wj.van.den.bosch)\ **Replies:** 1\ **Last updated:** [March 19, 2026, 2:15pm UTC](https://discuss.hashicorp.com/t/piping-environment-variable-into-an-exec-command/77193 "2026-03-19T14:15:37Z")
Good morning, I would like to do the following in my Vault-Agent.hcl: … template\_config { static\_secret\_render\_interval = “5m” exit\_on\_retry\_failure = false max\_connections\_per\_host = 10 } env\_template “SVC\_SECRE… --- ## [Vault on GKE Backup](https://discuss.hashicorp.com/t/vault-on-gke-backup/62272)
**Author:** [@omkar.gujar](https://discuss.hashicorp.com/u/omkar.gujar)\ **Replies:** 5\ **Last updated:** [March 17, 2026, 12:27pm UTC](https://discuss.hashicorp.com/t/vault-on-gke-backup/62272 "2026-03-17T12:27:23Z")
Hello All, I have setup community Vault on Google kubernetes Engine with Google cloud storage as a backend. I am not sure how to take backup of running vault. I have tried to take backup of backend Google cloud storage … --- ## [Frequent active/standby switching is not in line with expectations](https://discuss.hashicorp.com/t/frequent-active-standby-switching-is-not-in-line-with-expectations/77238)
**Author:** [@L-69](https://discuss.hashicorp.com/u/L-69)\ **Replies:** 1\ **Last updated:** [March 16, 2026, 1:18pm UTC](https://discuss.hashicorp.com/t/frequent-active-standby-switching-is-not-in-line-with-expectations/77238 "2026-03-16T13:18:16Z")
MySQL parameter configuration values: interactive\_timeout: 7200 (2h) wait\_timeout: 86400 (24h) Phenomenon: Master-slave failover occurs every 20-40 minutes, which is not as expected. System situation: Cluster deploym… --- ## [Some Grafana metrics are missing in the open-source version of Vault](https://discuss.hashicorp.com/t/some-grafana-metrics-are-missing-in-the-open-source-version-of-vault/77220)
**Author:** [@L-69](https://discuss.hashicorp.com/u/L-69)\ **Replies:** 4\ **Last updated:** [March 16, 2026, 3:18am UTC](https://discuss.hashicorp.com/t/some-grafana-metrics-are-missing-in-the-open-source-version-of-vault/77220 "2026-03-16T03:18:34Z")
Some Grafana metrics are missing in the open-source version of Vault, such as: vault.core.activity.fragment\_size, vault.identity.entity.active.monthly, and vault.identity.nonentity.active.monthlydeng. --- ## [Deploy vault in k8s with integrated storage](https://discuss.hashicorp.com/t/deploy-vault-in-k8s-with-integrated-storage/22425)
**Author:** [@bonyfusolia](https://discuss.hashicorp.com/u/bonyfusolia)\ **Replies:** 1\ **Last updated:** [March 13, 2026, 3:04pm UTC](https://discuss.hashicorp.com/t/deploy-vault-in-k8s-with-integrated-storage/22425 "2026-03-13T15:04:57Z")
I deployed HA vault cluster in local kubernetes (docker desktop). This is without TLS. I have a copied the overide values below, # Vault Helm Chart Value Overrides global: enabled: true tlsDisable: true server… --- ## [Vault raft recovery after Power Outage](https://discuss.hashicorp.com/t/vault-raft-recovery-after-power-outage/77240)
**Author:** [@trepository](https://discuss.hashicorp.com/u/trepository)\ **Replies:** 0\ **Last updated:** [March 13, 2026, 2:59pm UTC](https://discuss.hashicorp.com/t/vault-raft-recovery-after-power-outage/77240 "2026-03-13T14:59:46Z")
Vault Raft Recovery after power outage I am having some issue with my current setup with Vault and kuberentes. Setup : Microk8s HA mode Vault HA mode Rook-ceph : HA mode metallb : setup Recently we had a power outag… --- ## [Vault upgrade from 1.6.0 to 1.8.4 - check and set error](https://discuss.hashicorp.com/t/vault-upgrade-from-1-6-0-to-1-8-4-check-and-set-error/31236)
**Author:** [@daniele](https://discuss.hashicorp.com/u/daniele)\ **Replies:** 7\ **Last updated:** [March 13, 2026, 8:39am UTC](https://discuss.hashicorp.com/t/vault-upgrade-from-1-6-0-to-1-8-4-check-and-set-error/31236 "2026-03-13T08:39:34Z")
Hi everybody. I tried to upgrade from 1.6.0 to 1.8.4 in a test server and I got an issue when I checked some basic functionalities. O.S.: Centos7 HA = disabled storage\_type = file Error After the upgrade I tried to … --- ## [Failure to get responce from v1/auth/token/create when using personal token](https://discuss.hashicorp.com/t/failure-to-get-responce-from-v1-auth-token-create-when-using-personal-token/77221)
**Author:** [@marijusGood](https://discuss.hashicorp.com/u/marijusGood)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 4:19pm UTC](https://discuss.hashicorp.com/t/failure-to-get-responce-from-v1-auth-token-create-when-using-personal-token/77221 "2026-03-12T16:19:25Z")
Our team member gets “We’ve stopped auto-renewing your token due to inactivity. It will expire in about 1 month on XYZ” even after: Clicking “Renew token” logging off and on again 3. Trying log off and on on a differe… --- ## [Why Vault uses keys envelop?](https://discuss.hashicorp.com/t/why-vault-uses-keys-envelop/77225)
**Author:** [@voipp](https://discuss.hashicorp.com/u/voipp)\ **Replies:** 0\ **Last updated:** [March 11, 2026, 6:42am UTC](https://discuss.hashicorp.com/t/why-vault-uses-keys-envelop/77225 "2026-03-11T06:42:59Z")
After reading through HashiCorp Vault documentation i still don’t understand the meaning to have so many keys : unsealing keys → root key → encryption key → data Why do we need both root and encryption keys? Why don’t… --- ## [Vault (dev mode) crashes during initial startup](https://discuss.hashicorp.com/t/vault-dev-mode-crashes-during-initial-startup/77200)
**Author:** [@eg-ma](https://discuss.hashicorp.com/u/eg-ma)\ **Replies:** 1\ **Last updated:** [March 4, 2026, 10:42pm UTC](https://discuss.hashicorp.com/t/vault-dev-mode-crashes-during-initial-startup/77200 "2026-03-04T22:42:58Z")
Hi, I’m getting started with Vault on Oracle Linux 8, installed via RPM. Everything is default except: When it starts, it fails to bind to port 8200, saying that another process is using the port. I cannot find any oth… --- ## [Can KV secret engine keys reference another key (single source value)?](https://discuss.hashicorp.com/t/can-kv-secret-engine-keys-reference-another-key-single-source-value/77211)
**Author:** [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\ **Replies:** 1\ **Last updated:** [March 4, 2026, 10:40pm UTC](https://discuss.hashicorp.com/t/can-kv-secret-engine-keys-reference-another-key-single-source-value/77211 "2026-03-04T22:40:38Z")
Hi everyone, I am exploring the KV secret engine in Vault and wondering if it supports referencing another key within the same secret. What I want is something conceptually like this: temp = 1 a = temp b = temp c =… --- ## [Vault HA with 2 nodes](https://discuss.hashicorp.com/t/vault-ha-with-2-nodes/77203)
**Author:** [@whitepiratebaku](https://discuss.hashicorp.com/u/whitepiratebaku)\ **Replies:** 1\ **Last updated:** [March 4, 2026, 10:38pm UTC](https://discuss.hashicorp.com/t/vault-ha-with-2-nodes/77203 "2026-03-04T22:38:53Z")
Hi folks, any can please tell if it is possible to achieve active/standby HA setup with 2 Vault instances? maybe if we use s3 as storage backend, can 2 vault instances use same bucket and operate in HA mode? --- ## [Migrate Vault to new OS storage type file](https://discuss.hashicorp.com/t/migrate-vault-to-new-os-storage-type-file/77129)
**Author:** [@johnathan.copeland](https://discuss.hashicorp.com/u/johnathan.copeland)\ **Replies:** 4\ **Last updated:** [March 2, 2026, 3:41pm UTC](https://discuss.hashicorp.com/t/migrate-vault-to-new-os-storage-type-file/77129 "2026-03-02T15:41:24Z")
The current OS my standalone Vault is on is EOL CentOS 8. I would like to migrate everything to a new OS ( Oracle Linux 10). Im having trouble finding a good reference as how to do that. I have seen some say, just tra… [Previous page](https://discuss.hashicorp.com/c/vault/30.md) [Next page](https://discuss.hashicorp.com/c/vault/30.md?page=2)