# Migrate Vault to a new Kubernetes cluster

**URL:** <https://discuss.hashicorp.com/t/migrate-vault-to-a-new-kubernetes-cluster/25619>\
**Category:** Vault\
**Created:** [June 17, 2021, 3:49pm UTC](https://discuss.hashicorp.com/t/migrate-vault-to-a-new-kubernetes-cluster/25619 "2021-06-17T15:49:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashish-shiftright](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ashish-shiftright/32/20099_2.png) [@ashish-shiftright](https://discuss.hashicorp.com/u/ashish-shiftright)\
**Post date:** [June 17, 2021, 3:49pm UTC](https://discuss.hashicorp.com/t/migrate-vault-to-a-new-kubernetes-cluster/25619/1 "2021-06-17T15:49:51Z")

</div>

I am using Kubernetes authentication in Vault.  
Also, I am using Auto unseal using AWS KMS.  
I want to use same vault in new Kubernetes cluster. So, I have to set new Kubernetes auth config in Vault.  
The problem is that I am not able to do that as I do not have access to root key to perform this operation. Is there any other workaround?  
Another option is that

- I create a new Vault instance
- I take backup of all secret data from old vault and put it back to new Vault. But it is going to be painful exercise.

Please let me know what I can do here.

---

<div class="post-metadata">

**Author:** ![hsimon-hashicorp](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/hsimon-hashicorp/32/19684_2.png) [@hsimon-hashicorp](https://discuss.hashicorp.com/u/hsimon-hashicorp)\
**Post date:** [June 18, 2021, 4:05pm UTC](https://discuss.hashicorp.com/t/migrate-vault-to-a-new-kubernetes-cluster/25619/2 "2021-06-18T16:05:13Z")

</div>

Hello!

You can generate a new root token as demonstrated in this guide: [Generate Root Tokens Using Unseal Keys | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/generate-root)

Please let me know if that helps answer your question, or if you have any other issues. Thanks!