Vault 1.12.0-rc1, 1.11.4, 1.10.7, 1.9.10 released
Luciano Di Lalla
Hi folks,
The Vault team is announcing the release candidate of Vault 1.12, as well as 1.11.1, 1.10.7, and 1.9.10.
Open-source binaries can be downloaded at [1, 2, 3, 11]. Enterprise binaries are available to customers as well.
As a reminder, if you believe you have found a security issue in Vault, please responsibly disclose by emailing secu...@hashicorp.com and do not use the public issue tracker. Our security policy and our PGP key can be found at [4].
The major features and improvements in the 1.12 release candidate are:
PKI Key revocation: Improvements are made to Vault’s PKI engine, introducing a new OCSP responder and automatic CRL rebuilding (with up-to-date Delta CRL), that offers significant performance and data transfer improvements to revocation workflows.
BYOK in Transform engines: It now allows users to import their keys generated elsewhere.
KMIP Server Profile: Adds support for additional operations, allowing Vault to claim support for the baseline server profile.
Transform secrets engine: supports time-based auto-key rotation for tokenization.
Path and Role-based Quotas: Extend the existing Vault Quota support by allowing quotas to be extended to the API path suffixes and auth mount roles.
Licensing: Termination behavior has changed where non-evaluation licenses (production licenses) will no longer have a termination date.
Redis Database Secrets Engine: Users can use Vault to manage static role or dynamic credentials for Redis OSS. The engine works similarly to other database secrets engines.
AWS Elasticache Database Secrets Engine: Users may use Vault to manage static credentials for AWS Elasticache instances. The engine will work similarly to other database secrets engines.
See the Changelog at [5] for the full list of improvements and bug fixes.
See the Feature Deprecation Notice and Plans page [9] for our upcoming feature deprecation plans.
Of particular note, we currently publish two versions of Docker images, one under the HashiCorp Verified Publisher account and one as official Dockerhub images. With Vault 1.12, we are announcing that we will cease publication of the official Dockerhub images and make Docker images available only through our Verified Publisher account. Users of Docker images should pull from “hashicorp/vault” instead of “vault”.
OSS [7] and Enterprise [8] Docker images will be available soon.
---
Upgrading
See [6] for general upgrade instructions.
As always, we recommend upgrading and testing this release in an isolated environment. If you experience any non-security issues, please report them on the Vault GitHub issue tracker or post to the Vault Discuss Forum at [10].
We hope you enjoy Vault 1.12!
Sincerely, The Vault Team
[1] https://releases.hashicorp.com/vault/1.12.0-rc1
[2] https://releases.hashicorp.com/vault/1.11.4
[3] https://releases.hashicorp.com/vault/1.10.7
[4] https://www.hashicorp.com/security
[5] https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#1120-rc1
[6] https://www.vaultproject.io/docs/upgrading
[7] https://hub.docker.com/r/hashicorp/vault
[8] https://hub.docker.com/r/hashicorp/vault-enterprise
[9] https://vaultproject.io/docs/deprecation