forked from rook/rook
Sébastien Han
7e0b58cc27
By default, keys stored in Vault KV Secret Engine are versioned and keys are soft-deleted, see Vault documentation: When deleting data the standard vault kv delete command will perform a soft delete. It will mark the version as deleted and populate a deletion_time timestamp. Soft deletes do not remove the underlying version data from storage, which allows the version to be undeleted. The vault kv undelete command handles undeleting versions. A version's data is permanently deleted only when the key has more versions than are allowed by the max-versions setting, or when using vault kv destroy. When the destroy command is used the underlying version data will be removed and the key metadata will be marked as destroyed. If a version is cleaned up by going over max-versions the version metadata will also be removed from the key. Signed-off-by: Sébastien Han <seb@redhat.com>