Vault 1.17.0 release notes

GA date: 2024-06-12

Release notes provide an at-a-glance summary of key updates to new versions of Vault. For a comprehensive list of product updates, improvements, and bug fixes refer to the changelog included with the Vault code on GitHub.

We encourage you to upgrade to the latest release of Vault to take advantage of continuing improvements, critical fixes, and new features.

Important changes

Change	Description
New default (1.17)	Allowed audit headers now have unremovable defaults
Opt out feature (1.17)	PKI sign-intermediate now truncates `notAfter` field to signing issuer
Beta feature deprecated (1.17)	Request limiter deprecated
Known issue (1.17.0+)	PKI OCSP GET requests can return HTTP redirect responses
Known issue (1.17.0)	Vault Agent and Vault Proxy consume excessive amounts of CPU
Known issue (1.15.8 - 1.15.9, 1.16.0 - 1.16.3)	Autopilot upgrade for Vault Enterprise fails
Known issue (1.17.0 - 1.17.2)	Vault standby nodes not deleting removed entity-aliases from in-memory database
Known issue (1.17.0 - 1.17.3)	AWS Auth AssumeRole requires an external ID even if none is set
Known Issue (0.7.0+)	Duplicate identity groups created
Known Issue (0.7.0+)	Manual entity merges fail
Known Issue (1.17.3-1.17.4)	Some values in the audit logs not hmac'd properly
Known Issue (1.17.0-1.17.5)	Cached activation flags for secrets sync on follower nodes are not updated
New default (1.17.9)	Vault product usage metrics reporting
Deprecation (1.17.9)	`default_report_months` is deprecated for the `sys/internal/counters` API

Vault companion updates

Companion updates are Vault updates that live outside the main Vault binary.

None.

Core updates

Follow the learn more links for more information, or browse the list of Vault tutorials updated to highlight changes for the most recent GA release.

Release	Update	Description
Security patches	ENHANCED	Various security improvements to remediate varying severity and informational findings from a 3rd party security audit.
Vault Agent and Vault Proxy self-healing tokens	ENHANCED	Auto-authentication avoids agent/proxy restarts and config changes by automatically re-authenticating authN tokens to Vault. Learn more: Vault Agent and Vault Proxy auto-auth

Enterprise updates

Release	Update	Description
Adaptive overload protection	BETA	Prevent client requests from overwhelming a variety of server resources that could lead to poor server availability. Learn more: Adaptive overload protection overview
ACME Client Count	ENHANCED	To improve clarity around client counts, Vault now separates ACME clients from non-entity clients.
Public Key Infrastructure (PKI)	GA	Automate certificate lifecycle management for IoT/EST enabled devices with native EST protocol support. Learn more: Enrollment over Secure Transport (EST) overview
Public Key Infrastructure (PKI)	GA	Submit custom metadata with certificate requests and store the additional information in Vault for further analysis. Learn more: PKI secrets engine API
Resource management	ENHANCED	Vault now supports a greater number of namespaces and mounts for large-scale Vault installations.
	GA	Use hierarchical mount paths to organize, manage, and control access to secret engine objects.
	GA	Safely override the max entry size to set different limits for specific storage entries that contain mount tables, auth tables and namespace configuration data. Learn more: `max_mount_and_namespace_table_entry_size` parameter
Transit	GA	Use cipher-based message authentication code (CMAC) with AES symmetric keys in the Vault Transit plugin. Learn more: CMAC support
Plugin identity tokens	GA	Enable AWS, Azure, and GCP authentication flows with workload identity federation (WIF) tokens from the associated secrets plugins without explicitly configuring sensitive security credentials. Learn more: Plugin WIF overview
LDAP Secrets Engine	GA	Use hierarchical paths with roles and set names to define policies that map 1-1 to LDAP secrets engine roles. Learn more: Hierarchical paths overview
Clock skew and lag detection	GA	Use the `sys/health` and `sys/ha-status` endpoints to display lags in performance secondaries and performance standby nodes. Learn more: Clock skew and replication lag overview

Feature deprecations and EOL

Deprecated in 1.17	Retired in 1.17
None	Centrify Auth plugin

Please refer to the Deprecation Plans and Notice page for up-to-date information on feature deprecations and plans or the Feature Deprecation FAQ for general questions about our deprecation process.