HashiCorp Vault Improper Input Validation vulnerability

@@ -1,4 +1,9 @@
-<form onsubmit={{action @doSubmit (hash input=@input algorithm=@algorithm key_version=@key_version)}}>
+<form
+  onsubmit={{action
+    @doSubmit
+    (hash input=@input algorithm=@algorithm key_version=@key_version encodedBase64=@encodedBase64)
+  }}
+>
   <div class="box is-sideless is-fullwidth is-marginless">
     <NamespaceReminder @mode="perform" @noun="HMAC creation" />
     <div class="content">

@@ -322,6 +322,8 @@ module('Integration | Component | transit key actions', function (hooks) {
     `);
     await fillIn('#algorithm', 'sha2-384');
     await blur('#algorithm');
+    await fillIn('[data-test-component="code-mirror-modifier"] textarea', 'plaintext');
+    await click('input[data-test-transit-input="encodedBase64"]');
     await click('button[type="submit"]');
     assert.deepEqual(
       this.storeService.callArgs,
@@ -331,6 +333,7 @@ module('Integration | Component | transit key actions', function (hooks) {
         id: 'akey',
         payload: {
           algorithm: 'sha2-384',
+          input: 'plaintext',
         },
       },
       'passes expected args to the adapter'
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 55bf601122d611e647475c6ea8e54aaf8b99bd4e (#19522)
 website/content/docs/concepts/client-count/index.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/builtin/plugin"
+	"github.com/hashicorp/vault/helper/experiments"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/versions"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -1001,12 +1002,14 @@ func (c *Core) newCredentialBackend(ctx context.Context, entry *MountEntry, sysV
 	}
  
 	config := &logical.BackendConfig{
-		StorageView:  view,
-		Logger:       authLogger,
-		Config:       conf,
-		System:       sysView,
-		BackendUUID:  entry.BackendAwareUUID,
-		EventsSender: pluginEventSender,
+		StorageView: view,
+		Logger:      authLogger,
+		Config:      conf,
+		System:      sysView,
+		BackendUUID: entry.BackendAwareUUID,
+	}
+	if c.IsExperimentEnabled(experiments.VaultExperimentEventsAlpha1) {
+		config.EventsSender = pluginEventSender
 	}
  
 	b, err := f(ctx, config)

@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/builtin/plugin"
+	"github.com/hashicorp/vault/helper/experiments"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/versions"
@@ -1660,12 +1661,14 @@ func (c *Core) newLogicalBackend(ctx context.Context, entry *MountEntry, sysView
 		return nil, "", err
 	}
 	config := &logical.BackendConfig{
-		StorageView:  view,
-		Logger:       backendLogger,
-		Config:       conf,
-		System:       sysView,
-		BackendUUID:  entry.BackendAwareUUID,
-		EventsSender: pluginEventSender,
+		StorageView: view,
+		Logger:      backendLogger,
+		Config:      conf,
+		System:      sysView,
+		BackendUUID: entry.BackendAwareUUID,
+	}
+	if c.IsExperimentEnabled(experiments.VaultExperimentEventsAlpha1) {
+		config.EventsSender = pluginEventSender
 	}
  
 	ctx = context.WithValue(ctx, "core_number", c.coreNumber)
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 3e72c764433b4ea15c822377a33ed073098c4568 (#19622)
 vault/request_handling.go | 13 ++++++++++---
 vault/token_store.go      | 15 +++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)

@@ -31,14 +31,14 @@
       <ConfirmAction
         @buttonClasses="button"
         @confirmMessage="This will remove the CA certificate information."
-        @onConfirmAction={{action "saveConfig" (hash delete=true)}}
+        @onConfirmAction={{this.delete}}
       >
         Delete
       </ConfirmAction>
     </div>
   </div>
 {{else}}
-  <form onsubmit={{action "saveConfig" (hash delete=false)}} data-test-ssh-configure-form="true">
+  <form {{on "submit" this.saveConfig}} data-test-ssh-configure-form="true">
     <div class="box is-fullwidth is-sideless is-marginless">
       <NamespaceReminder @mode="save" @noun="configuration" />
       <div class="field">
@@ -58,13 +58,13 @@
         </div>
       </div>
       <div class="b-checkbox">
-        <input
-          type="checkbox"
+        <Input
+          @type="checkbox"
           id="generateSigningKey"
           class="styled"
-          checked={{@model.generateSigningKey}}
-          onchange={{action (mut @model.generateSigningKey) value="target.checked"}}
-          data-test-ssh-input={{this.generateSigningKey}}
+          @checked={{@model.generateSigningKey}}
+          {{on "change" (fn (mut @model.generateSigningKey) (not @model.generateSigningKey))}}
+          data-test-ssh-input="generate-signing-key-checkbox"
         />
         <label for="generateSigningKey" class="is-label">
           Generate signing key
@@ -78,8 +78,8 @@
       <div class="control">
         <button
           type="submit"
-          class="button is-primary {{if this.loading 'is-loading'}}"
-          disabled={{this.loading}}
+          class="button is-primary {{if @loading 'is-loading'}}"
+          disabled={{@loading}}
           data-test-ssh-input="configure-submit"
         >
           Save

@@ -0,0 +1,40 @@
+import { click, settled } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import page from 'vault/tests/pages/settings/configure-secret-backends/pki/index';
+import authPage from 'vault/tests/pages/auth';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import { create } from 'ember-cli-page-object';
+import fm from 'vault/tests/pages/components/flash-message';
+const flashMessage = create(fm);
+const SELECTORS = {
+  generateSigningKey: '[data-test-ssh-input="generate-signing-key-checkbox"]',
+  saveConfig: '[data-test-ssh-input="configure-submit"]',
+  publicKey: '[data-test-ssh-input="public-key"]',
+};
+module('Acceptance | settings/configure/secrets/ssh', function (hooks) {
+  setupApplicationTest(hooks);
+ 
+  hooks.beforeEach(function () {
+    return authPage.login();
+  });
+ 
+  test('it configures ssh ca', async function (assert) {
+    const path = `ssh-${new Date().getTime()}`;
+    await enablePage.enable('ssh', path);
+    await settled();
+    await page.visit({ backend: path });
+    await settled();
+    assert.dom(SELECTORS.generateSigningKey).isChecked('generate_signing_key defaults to true');
+    await click(SELECTORS.generateSigningKey);
+    await click(SELECTORS.saveConfig);
+    assert.strictEqual(
+      flashMessage.latestMessage,
+      'missing public_key',
+      'renders warning flash message for failed save'
+    );
+    await click(SELECTORS.generateSigningKey);
+    await click(SELECTORS.saveConfig);
+    assert.dom(SELECTORS.publicKey).exists('renders public key after saving config');
+  });
+});
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 7071eb26f463be043a72dfdfcfdec59612fa4755 (#19478)
 website/content/api-docs/secret/identity/entity-alias.mdx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -1171,8 +1171,8 @@ github.com/hashicorp/vault-plugin-secrets-kv v0.14.2 h1:13p50RIltQM/JH32uWZe9sAp
 github.com/hashicorp/vault-plugin-secrets-kv v0.14.2/go.mod h1:cAxt2o3BjRT5CbNLtgXuxTReaejvrgN/qk+no+DnwJ8=
 github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.9.1 h1:WkW8fyHxEdz1wGSTxCnSCrzXvgLXqXr8Iqp7upa/s4E=
 github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.9.1/go.mod h1:p96IECNtVwpvTq8RAw3dLlAYRWpG1n06XOoo0TkJnuk=
-github.com/hashicorp/vault-plugin-secrets-openldap v0.10.0 h1:Q3nKBbHQ6E/kOa3amKvcbhYTbkz4U25BBTwH66LnF+0=
-github.com/hashicorp/vault-plugin-secrets-openldap v0.10.0/go.mod h1:sYuxnuNY2O59fy+LACtvgrqUO/r0cnhAYTMqLajD9FE=
+github.com/hashicorp/vault-plugin-secrets-openldap v0.10.1 h1:EN3/iEjPPmcpX9yihybQNHvewc+YoJw7aoKsio1WK5s=
+github.com/hashicorp/vault-plugin-secrets-openldap v0.10.1/go.mod h1:sYuxnuNY2O59fy+LACtvgrqUO/r0cnhAYTMqLajD9FE=
 github.com/hashicorp/vault-plugin-secrets-terraform v0.7.0 h1:jgJpVKhV0Eh6EjpUEIf7VYH2D6D0xW2Lry9/3PI8hy0=
 github.com/hashicorp/vault-plugin-secrets-terraform v0.7.0/go.mod h1:GzYAJYytgbNNyT3S7rspz1cLE53E1oajFbEtaDUlVGU=
 github.com/hashicorp/vault-testing-stepwise v0.1.1/go.mod h1:3vUYn6D0ZadvstNO3YQQlIcp7u1a19MdoOC0NQ0yaOE=
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 28b0037787d7cbc3df6836a4a54db869c802483c (#19645)
 website/content/docs/commands/plugin/deregister.mdx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -0,0 +1,91 @@
+import { visit, currentURL } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { create } from 'ember-cli-page-object';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import parseURL from 'core/utils/parse-url';
+import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+import authPage from 'vault/tests/pages/auth';
+ 
+const shell = create(consoleClass);
+ 
+const createNS = async (name) => {
+  await shell.runCommands(`write sys/namespaces/${name} -force`);
+};
+const SELECTORS = {
+  authTab: (path) => `[data-test-auth-method="${path}"] a`,
+};
+ 
+module('Acceptance | Enterprise | oidc auth namespace test', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+ 
+  hooks.beforeEach(async function () {
+    this.namespace = 'test-ns';
+    this.rootOidc = 'root-oidc';
+    this.nsOidc = 'ns-oidc';
+ 
+    this.server.post(`/auth/:path/config`, () => {});
+ 
+    this.enableOidc = (path, role = '') => {
+      return shell.runCommands([
+        `write sys/auth/${path} type=oidc`,
+        `write auth/${path}/config default_role="${role}" oidc_discovery_url="https://example.com"`,
+        // show method as tab
+        `write sys/auth/${path}/tune listing_visibility="unauth"`,
+      ]);
+    };
+ 
+    this.disableOidc = (path) => shell.runCommands([`delete /sys/auth/${path}`]);
+  });
+ 
+  test('oidc: request is made to auth_url when a namespace is inputted', async function (assert) {
+    assert.expect(5);
+ 
+    this.server.post(`/auth/${this.rootOidc}/oidc/auth_url`, (schema, req) => {
+      const { redirect_uri } = JSON.parse(req.requestBody);
+      const { pathname, search } = parseURL(redirect_uri);
+      assert.strictEqual(
+        pathname + search,
+        `/ui/vault/auth/${this.rootOidc}/oidc/callback`,
+        'request made to auth_url when the login page is visited'
+      );
+    });
+    this.server.post(`/auth/${this.nsOidc}/oidc/auth_url`, (schema, req) => {
+      const { redirect_uri } = JSON.parse(req.requestBody);
+      const { pathname, search } = parseURL(redirect_uri);
+      assert.strictEqual(
+        pathname + search,
+        `/ui/vault/auth/${this.nsOidc}/oidc/callback?namespace=${this.namespace}`,
+        'request made to correct auth_url when namespace is filled in'
+      );
+    });
+ 
+    await authPage.login();
+    // enable oidc in root namespace, without default role
+    await this.enableOidc(this.rootOidc);
+    // create child namespace to enable oidc
+    await createNS(this.namespace);
+    // enable oidc in child namespace with default role
+    await authPage.loginNs(this.namespace);
+    await this.enableOidc(this.nsOidc, `${this.nsOidc}-role`);
+    await authPage.logout();
+ 
+    await visit('/vault/auth');
+    assert.dom(SELECTORS.authTab(this.rootOidc)).exists('renders oidc method tab for root');
+    await authPage.namespaceInput(this.namespace);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/auth?namespace=${this.namespace}&with=${this.nsOidc}%2F`,
+      'url updates with namespace value'
+    );
+    assert.dom(SELECTORS.authTab(this.nsOidc)).exists('renders oidc method tab for child namespace');
+ 
+    // disable methods to cleanup test state for re-running
+    await authPage.login();
+    await this.disableOidc(this.rootOidc);
+    await this.disableOidc(this.nsOidc);
+    await shell.runCommands([`delete /sys/auth/${this.namespace}`]);
+    await authPage.logout();
+  });
+});

@@ -11,6 +11,7 @@ export default create({
   tokenInput: fillable('[data-test-token]'),
   usernameInput: fillable('[data-test-username]'),
   passwordInput: fillable('[data-test-password]'),
+  namespaceInput: fillable('[data-test-auth-form-ns-input]'),
   login: async function (token) {
     // make sure we're always logged out and logged back in
     await this.logout();
@@ -39,4 +40,17 @@ export default create({
     await this.passwordInput(password).submit();
     return;
   },
+  loginNs: async function (ns) {
+    // make sure we're always logged out and logged back in
+    await this.logout();
+    await settled();
+    // clear session storage to ensure we have a clean state
+    window.localStorage.clear();
+    await this.visit({ with: 'token' });
+    await settled();
+    await this.namespaceInput(ns);
+    await settled();
+    await this.tokenInput(rootToken).submit();
+    return;
+  },
 });
 changelog/19460.txt                           |   3 +
 ui/app/routes/vault/cluster/oidc-callback.js  |  10 +-
 .../vault/cluster/oidc-callback-test.js       | 162 ++++++++++--------
 3 files changed, 106 insertions(+), 69 deletions(-)
 create mode 100644 changelog/19460.txt

@@ -29,6 +29,53 @@ The AliCloud auth plugin will now require the `role` parameter on login. This
 has always been documented as a required field but the requirement will now be
 enforced.
  
+### Mounts associated with removed builtin plugins will result in core shutdown on upgrade
+ 
+As of 1.13.0 Standalone (logical) DB Engines and the AppId Auth Method have been
+marked with the `Removed` status. Any attempt to unseal Vault with
+mounts backed by one of these builtin plugins will result in an immediate
+shutdown of the Vault core.
+ 
+-> **NOTE** In the event that an external plugin with the same name and type as
+a deprecated builtin is deregistered, any subsequent unseal will continue to
+unseal with an unusable auth backend, and a corresponding ERROR log.
+ 
+```shell-session
+$ vault plugin register -sha256=c805cf3b69f704dfcd5176ef1c7599f88adbfd7374e9c76da7f24a32a97abfe1 auth app-id
+Success! Registered plugin: app-id
+$ vault auth enable -plugin-name=app-id plugin
+Success! Enabled app-id auth method at: app-id/
+$ vault auth list -detailed | grep "app-id"
+app-id/    app-id    auth_app-id_3a8f2e24    system         system     default-service    replicated     false        false                      map[]      n/a                        0018263c-0d64-7a70-fd5c-50e05c5f5dc3    n/a        n/a                      c805cf3b69f704dfcd5176ef1c7599f88adbfd7374e9c76da7f24a32a97abfe1    n/a
+$ vault plugin deregister auth app-id
+Success! Deregistered plugin (if it was registered): app-id
+$ vault plugin list -detailed | grep "app-id"
+app-id                               auth        v1.13.0+builtin.vault                                 removed
+$ curl --header "X-Vault-Token: $VAULT_TOKEN" --request POST http://127.0.0.2:8200/v1/sys/seal
+$ vault operator unseal <key1>
+...
+$ vault operator unseal <key2>
+...
+$ vault operator unseal <key3>
+...
+$ grep "app-id" /path/to/vault.log
+[ERROR] core: skipping deprecated auth entry: name=app-id path=app-id/ error="mount entry associated with removed builtin"
+[ERROR] core: skipping initialization for nil auth backend: path=app-id/ type=app-id version="v1.13.0+builtin.vault"
+```
+ 
+The remediation for affected mounts is to downgrade to the previously-used version of Vault
+environment variable and replace any `Removed` feature with the
+[preferred alternative
+feature](/vault/docs/deprecation/faq#q-what-should-i-do-if-i-use-mount-filters-appid-or-any-of-the-standalone-db-engines).
+ 
+For more information on the phases of deprecation, see the [Deprecation Notices
+FAQ](/vault/docs/deprecation/faq#q-what-are-the-phases-of-deprecation).
+ 
+#### Impacted Versions
+ 
+Affects upgrading from any version of Vault to 1.13.x. All other upgrade paths
+are unaffected.
+ 
 ## Known Issues
  
 @include 'tokenization-rotation-persistence.mdx'
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 b48e826d261e4f6166f4f5e0d112851b582a149f (#19590)
 changelog/19585.txt          |  3 ++
 http/sys_mount_test.go       | 66 ++++++++++++++++++++++++++++++++++++
 vault/logical_system.go      |  8 ++---
 vault/logical_system_test.go | 16 +++++----
 4 files changed, 83 insertions(+), 10 deletions(-)
 create mode 100644 changelog/19585.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+events: Suppress log warnings triggered when events are sent but the events system is not enabled.
+```
+ 

@@ -2,7 +2,7 @@
   <p.top>
     <KeyValueHeader
       @baseKey={{hash id=this.id}}
-      @path="vault.cluster.secrets.backend.show"
+      @path="vault.cluster.secrets.backend.list"
       @mode="show"
       @showCurrent={{true}}
       @root={{this.backendCrumb}}

@@ -0,0 +1,29 @@
+import { create } from 'ember-cli-page-object';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { click, currentURL, fillIn, visit } from '@ember/test-helpers';
+import authPage from 'vault/tests/pages/auth';
+import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+ 
+const consolePanel = create(consoleClass);
+ 
+module('Acceptance | kv | breadcrumbs', function (hooks) {
+  setupApplicationTest(hooks);
+ 
+  test('it should route back to parent path from metadata tab', async function (assert) {
+    await authPage.login();
+    await consolePanel.runCommands(['delete sys/mounts/kv', 'write sys/mounts/kv type=kv-v2']);
+    await visit('/vault/secrets/kv/list');
+    await click('[data-test-secret-create]');
+    await fillIn('[data-test-secret-path]', 'foo/bar');
+    await click('[data-test-secret-save]');
+    await click('[data-test-secret-metadata-tab]');
+    await click('[data-test-secret-breadcrumb="foo"]');
+    assert.strictEqual(
+      currentURL(),
+      '/vault/secrets/kv/list/foo/',
+      'Routes back to list view on breadcrumb click'
+    );
+    await consolePanel.runCommands(['delete sys/mounts/kv']);
+  });
+});
 .github/workflows/enos-fmt.yml                      | 3 ---
 .github/workflows/enos-run-k8s.yml                  | 3 ---
 .github/workflows/test-enos-scenario-ui.yml         | 3 ---
 .github/workflows/test-run-enos-scenario-matrix.yml | 3 ---
 4 files changed, 12 deletions(-)

@@ -6,20 +6,28 @@ import { action } from '@ember/object';
  *
  * @example
  * ```js
- *  <ConfigureSshSecret 
-      @model={{model}} 
-      @configured={{configured}} 
-      @saveConfig={{action "saveConfig"}} />
+ * <ConfigureSshSecret
+ *    @model={{this.model}}
+ *    @configured={{this.configured}}
+ *    @saveConfig={{action "saveConfig"}}
+ *    @loading={{this.loading}}
+ *  />
  * ```
  *
  * @param {string} model - ssh secret engine model
  * @param {Function} saveConfig - parent action which updates the configuration
- * 
+ * @param {boolean} loading - property in parent that updates depending on status of parent's action
+ *
  */
 export default class ConfigureSshSecretComponent extends Component {
   @action
-  saveConfig(data, event) {
+  delete() {
+    this.args.saveConfig({ delete: true });
+  }
+ 
+  @action
+  saveConfig(event) {
     event.preventDefault();
-    this.args.saveConfig(data);
+    this.args.saveConfig({ delete: false });
   }
 }

@@ -134,7 +134,7 @@ require (
 	github.com/hashicorp/vault-plugin-secrets-kubernetes v0.3.0
 	github.com/hashicorp/vault-plugin-secrets-kv v0.14.2
 	github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.9.1
-	github.com/hashicorp/vault-plugin-secrets-openldap v0.10.0
+	github.com/hashicorp/vault-plugin-secrets-openldap v0.10.1
 	github.com/hashicorp/vault-plugin-secrets-terraform v0.7.0
 	github.com/hashicorp/vault-testing-stepwise v0.1.3-0.20230203193428-3a789cb2c68f
 	github.com/hashicorp/vault/api v1.9.0

@@ -1,31 +1,284 @@
 ---
 layout: docs
-page_title: 1.14.0
+page_title: "1.14.0 release notes"
 description: |-
-  This page contains release notes for Vault 1.14.0
+  Key updates for  Vault 1.14.0
 ---
  
-# Vault 1.14.0 Release Notes
+# Vault 1.14.0 release notes
  
-**Software Release date:** TBD
+**GA date:** June 21, 2023
  
-**Summary:** Vault Release 1.14.0 offers features and enhancements that improve
-the user experience while solving critical  issues previously encountered by our
-customers. We are providing an overview  of improvements in this set of  release
-notes.
+@include 'release-notes/intro.mdx'
  
-~> Note: these are **draft** notes for a future version of Vault. They should not be considered
-official guidance until the release has been completed.
+## Known issues and breaking changes
  
-## Known issues
+Version | Issue 
+------- | ------------------------------------------------------------
+1.14.0+ | [Users limited by control groups can only access issuer detail from PKI overview page](/vault/docs/upgrading/upgrade-to-1.14.x#ui-pki-control-groups)
+All     | [API calls to update-primary may lead to data loss](/vault/docs/upgrading/upgrade-to-1.14.x#update-primary-data-loss)
  
-@include 'ui-pki-control-groups-known-issue.mdx'
+## Vault companion updates
  
-@include 'update-primary-known-issue.mdx'
+Companion updates are Vault updates that live outside the main Vault binary.
  
-## Feature Deprecations and EOL
+<table>
+  <thead>
+    <tr>
+      <th style={{verticalAlign: 'middle'}}>Release</th>
+      <th style={{verticalAlign: 'middle'}}>Update</th>
+      <th style={{verticalAlign: 'middle'}}>Description</th>
+    </tr>
+  </thead>
+  <tbody>
  
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page
-for up-to-date information on feature deprecations and plans. A [Feature
-Deprecation FAQ](/vault/docs/deprecation/faq) page addresses questions about
-decisions made about Vault feature deprecations.
+  <tr>
+    <td style={{verticalAlign: 'middle'}}>
+      Vault Secrets Operator for Kubernetes
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Directly connect Vault secrets into Pods as native Kubernetes Secrets
+      without modifying your application code.
+      <br /><br />
+      Learn more: <a href="/vault/docs/platform/k8s/vso">Vault Secrets Operator</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td rowspan={2} style={{verticalAlign: 'middle'}}>
+      Terraform
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Use LDAP authentication from the unified LDAP engine to Terraform Vault
+      Provider.
+      <br /><br />
+      Learn more: <a href="/vault/docs/secrets/ldap">LDAP Secrets Engine</a>
+    </td>
+  </tr>
+  <tr>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Support for additional PKI issuers and keys endpoints.
+      <br /><br />
+      Learn more: <a href="/vault/docs/secrets/pki">PKI Secrets Engine</a>
+    </td>
+  </tr>
+  </tbody>
+</table>
+ 
+## Core updates
+ 
+Follow the learn more links for more information, or browse the list of
+[Vault tutorials updated to highlight changes for the most recent GA release](/vault/tutorials/new-release).
+ 
+<table>
+  <thead>
+    <tr>
+      <th style={{verticalAlign: 'middle'}}>Release</th>
+      <th style={{verticalAlign: 'middle'}}>Update</th>
+      <th style={{verticalAlign: 'middle'}}>Description</th>
+    </tr>
+  </thead>
+  <tbody>
+  
+  <tr>
+    <td rowspan={2} style={{verticalAlign: 'middle'}}>
+      Public Key Infrastructure (PKI)
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Use ACME to automate certificate lifecycle management for private PKI
+      needs with standard ACME clients like Certbot and k8s cert-manager.
+      Request certificates from a Vault server without needing to know Vault
+      APIs or authentication mechanisms.
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/api-docs/secret/pki#acme-certificate-issuance">PKI Secrets Engine API: ACME</a>
+    </td>
+  </tr>
+  <tr>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Use the improved PKI web UI to manage your PKI instance with intuitive
+      configuration and reasonable defaults for workflows, metadata, issuer
+      info, mount and tidy configuration, cross signing, multi-issuers etc.and
+      includes.   
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/api-docs/secret/pki#acme-certificate-issuance">PKI Secrets Engine</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td style={{verticalAlign: 'middle'}}>
+      Security patches
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Various security improvements to remediate low severity and informational
+      findings from a 3rd party security audit.
+      <br /><br />
+      Learn more: <a href="/vault/docs/internals/security">Vault security model</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td rowspan={2} style={{verticalAlign: 'middle'}}>
+      Vault Agent
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Fetch secrets directly into your application as environment variables.
+      <br /><br />
+      Learn more: <a href="/vault/docs/agent-and-proxy/agent/process-supervisor">Process Supervisor Mode</a>
+    </td>
+  </tr>
+  <tr>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>TEXT</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Use a new subcommand and daemon, Vault Proxy, to access the proxy
+      functionality of Vault Agent. Vault Proxy will handle Vault Agent proxy
+      functionality going forward to simplify use case decisions for customers.
+      <br /><br />
+      Learn more: <a href="/vault/docs/agent-and-proxy/proxy">Vault Proxy</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td rowspan={3} style={{verticalAlign: 'middle'}}>
+      Plugin support
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Capture plugin metadata in the Vault audit log.
+      <br /><br />
+      Learn more: <a href="/vault/docs/audit/syslog">Syslog audit device</a>
+    </td>
+  </tr>
+  <tr>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Use X509 Authentication and Terraform Vault Provider in the MongoDB Atlas
+      Database Secrets Engine.
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/docs/secrets/databases/mongodbatlas">MongoDB Atlas Database Secrets Engine</a>
+    </td>
+  </tr>
+  <tr>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Dependency updates and more robust multiplexing for secrets and
+      authentication plugins.
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/docs/plugins/plugin-development#serving-a-plugin-with-multiplexing">
+        Serving a plugin with multiplexing (Plugin Development)
+      </a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td rowspan={2} style={{verticalAlign: 'middle'}}>
+      AWS support
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Monitoring and performance enhancements for the Vault Lambda extension.
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/docs/platform/aws/lambda-extension">Vault Lambda Extension guide</a>
+    </td>
+  </tr>
+  <tr>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Use static roles for IAM users in the AWS Secrets Engine.
+      <br /><br />
+      Learn more: <a href="/vault/docs/secrets/aws">AWS Secrets Engine</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td style={{verticalAlign: 'middle'}}>
+      Vault GUI
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Streamlined and aligned navigation with HCP Vault UI.
+      <br /><br />
+      Learn more: <a href="/vault/docs/configuration/ui">Vault UI</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td style={{verticalAlign: 'middle'}}>
+      Transit
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      <b>Contributed by the OSS community</b>. Support for public-key only Transit
+      keys and BYOK-secured export of key material.
+      <br /><br />
+      Learn more: <a href="/vault/api-docs/secret/transit">Transit Secrets Engine</a>
+    </td>
+  </tr>
+ 
+  </tbody>
+</table>
+ 
+## Enterprise updates
+ 
+<table>
+  <thead>
+    <tr>
+      <th style={{verticalAlign: 'middle'}}>Release</th>
+      <th style={{verticalAlign: 'middle'}}>Update</th>
+      <th style={{verticalAlign: 'middle'}}>Description</th>
+    </tr>
+  </thead>
+  <tbody>
+  
+  <tr>
+    <td style={{verticalAlign: 'middle'}}>
+      Vault replication
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Stability improvements based on customer feedback for Vault 1.13. See the 
+      <a href="https://raw.githubusercontent.com/hashicorp/vault/main/CHANGELOG.md">
+        Vault changelog
+      </a>
+      for a full list of bug fixes.
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/docs/internals/replication">Replication overview</a>
+    </td>
+  </tr>
+ 
+  <tr>
+    <td style={{verticalAlign: 'middle'}}>
+      License utilization reporting
+    </td>
+    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
+    <td style={{verticalAlign: 'middle'}}>
+      Enables automatic license utilization reporting for you and HashiCorp to
+      ensure transparent, accurate billing.
+      <br /><br />
+      Learn more:&nbsp;
+      <a href="/vault/docs/enterprise/license/utilization-reporting">Automated License utilization reporting</a>
+    </td>
+  </tr>
+ 
+  </tbody>
+</table>
+ 
+## Feature deprecations and EOL
+ 
+Deprecated in 1.14 | Retired in 1.14
+------------------ | ---------------
+Vault Agent API proxy support | [Duplicative Docker Images](https://hub.docker.com/_/vault)
+ 
+@include 'release-notes/deprecation-note.mdx'

@@ -46,11 +46,19 @@ The PKI Secrets Engine documentation is split into the following pieces:
  
 ## Tutorial
  
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
+Refer to the following tutorials for PKI secrets engine usage examples:
+ 
+- [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
+- [Build Certificate Authority (CA) in Vault with an offline Root](/vault/tutorials/secrets-management/pki-engine-external-ca)
+- [Enable ACME with PKI secrets engine](/vault/tutorials/new-release/pki-acme-caddy)
+- [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
+- [PKI Unified CRL and OCSP With Cross Cluster
+  Revocation](/vault/tutorials/secrets-management/pki-unified-crl-ocsp-cross-cluster)
+- [Configure Vault as a Certificate Manager in Kubernetes with
+  Helm](/vault/tutorials/kubernetes/kubernetes-cert-manager)
+- [Generate mTLS Certificates for Nomad using
+  Vault](/vault/tutorials/secrets-management/vault-pki-nomad)
  
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
  
 ## API
  
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 8e40823fe1cf40cecb1e004be29fde5fdb875bdb (#21416)
 website/content/api-docs/secret/cubbyhole.mdx |  2 +-
 website/content/api-docs/secret/kv/kv-v1.mdx  | 16 +++++++++-------
 website/content/api-docs/secret/kv/kv-v2.mdx  |  7 ++++---
 3 files changed, 14 insertions(+), 11 deletions(-)

@@ -1,14 +1,16 @@
 ---
 layout: api
 page_title: KV - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault KV secrets engine.
+description: This is the API documentation for the Vault KV secrets engine, version 1.
 ---
  
 # KV Secrets Engine - Version 1 (API)
  
 This is the API documentation for the Vault KV secrets engine. For general
-information about the usage and operation of the kv secrets engine, please
-see the [Vault kv documentation](/vault/docs/secrets/kv).
+information about the usage and operation of the version 1 KV secrets engine, please
+see the [Vault KV documentation](/vault/docs/secrets/kv/kv-v1). For information
+about the differences between KV version 1 and version 2, please [see the KV overview
+documentation](/vault/docs/secrets/kv).
  
 ~> Note: This documentation assumes the kv secrets engine is enabled at the
 `/secret` path in Vault. Since it is possible to enable secrets engines at any
@@ -53,7 +55,7 @@ $ curl \
 _Note_: the `lease_duration` field, which will be populated if a "ttl" field
 was included in the data, is advisory. No lease is created. This is a way for
 writers to indicate how often a given value should be re-read by the client.
-See the [Vault KV secrets engine documentation](/vault/docs/secrets/kv)
+See the [Vault KV secrets engine documentation](/vault/docs/secrets/kv/kv-v1#ttls)
 for more details.
  
 ## List Secrets
@@ -62,7 +64,7 @@ This endpoint returns a list of key names at the specified location. Folders are
 suffixed with `/`. The input must be a folder; list on a file will not return a
 value. Note that no policy-based filtering is performed on keys; do not encode
 sensitive information in key names. The values themselves are not accessible via
-this command.
+this API.
  
 | Method | Path            |
 | :----- | :-------------- |
@@ -116,11 +118,11 @@ policy granting the `update` capability.
 - `path` `(string: <required>)` – Specifies the path of the secrets to
   create/update. This is specified as part of the URL.
  
-- `:key` `(string: "")` – Specifies a key, paired with an associated value, to
+- `:key` `(string: "")` – Specifies a key in the payload, paired with an associated value, to
   be held at the given location. Multiple key/value pairs can be specified, and
   all will be returned on a read operation. A key called `ttl` will trigger
   some special behavior. See the [Vault KV secrets engine
-  documentation](/vault/docs/secrets/kv) for details.
+  documentation](/vault/docs/secrets/kv/kv-v1#ttls) for details.
  
 ### Sample Payload
  

@@ -1,14 +1,15 @@
 ---
 layout: api
 page_title: KV - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault KV secrets engine.
+description: This is the API documentation for the Vault KV secrets engine, version 2.
 ---
  
 # KV Secrets Engine - Version 2 (API)
  
 This is the API documentation for the Vault KV secrets engine while running in
-versioned mode. For general information about the usage and operation of the kv
-secrets engine, please see the [Vault kv
+versioned mode. For general information about the usage and operation of the version 2
+KV secrets engine, please see the [Vault KV documentation](/vault/docs/secrets/kv/kv-v2).
+For information about the differences between KV version 1 and version 2, please [see the KV overview
 documentation](/vault/docs/secrets/kv).
  
 ## Configure the KV Engine
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 21bd774c675bffd2cf4093de86765bc04dc1c6f5 (#21417)
 website/data/api-docs-nav-data.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -462,6 +462,12 @@ olcPPolicyHashCleartext: TRUE
 olcPPolicyUseLockout: TRUE
 ```
  
+## Tutorial
+ 
+Refer to the [LDAP Secrets Engine](/vault/tutorials/secrets-management/openldap)
+tutorial to learn how to configure and use the LDAP secrets engine.
+ 
+ 
 ## API
  
 The LDAP secrets engine has a full HTTP API. Please see the [LDAP secrets engine API docs](/vault/api-docs/secret/ldap)

@@ -20,7 +20,8 @@ utilization as defined in our contracts. They consist of mostly computed metrics
 and will never contain Personal Identifiable Information (PII) or other
 sensitive information. Automated reporting shares the data with HashiCorp using
 a secure, unidirectional HTTPS API and makes an auditable record in the product
-logs each time it submits a report.
+logs each time it submits a report. The reports are submitted once every 24
+hours.
  
 ## Enable automated reporting
  
@@ -42,11 +43,13 @@ addresses:
  
 ### 2. Upgrade
  
-Upgrade to a release that supports entitlement utilization reporting. These
+Upgrade to a release that supports license utilization reporting. These
 releases include:
  
 - [Vault Enterprise 1.14.0](https://releases.hashicorp.com/vault/) and later
- 
+- [Vault Enterprise 1.13.4](https://releases.hashicorp.com/vault/) and later 1.13.x versions
+- [Vault Enterprise 1.12.8](https://releases.hashicorp.com/vault/) and later 1.12.x versions
+- [Vault Enterprise 1.11.12](https://releases.hashicorp.com/vault/)
  
 ### 3. Check logs
  
 website/content/docs/release-notes/1.14.0.mdx | 289 ++++++++++++++++--
 .../docs/upgrading/upgrade-to-1.14.x.mdx      |  26 +-
 website/content/partials/alerts/rc-alert.mdx  |   7 +
 .../known-issues/ui-pki-control-groups.mdx    |  17 ++
 .../known-issues/update-primary-data-loss.mdx |  64 ++++
 .../release-notes/deprecation-note.mdx        |   4 +
 .../content/partials/release-notes/intro.mdx  |   8 +
 .../ui-pki-control-groups-known-issue.mdx     |  21 +-
 .../partials/update-primary-known-issue.mdx   | 136 ++++-----
 website/data/docs-nav-data.json               |   6 +-
 10 files changed, 458 insertions(+), 120 deletions(-)
 create mode 100644 website/content/partials/alerts/rc-alert.mdx
 create mode 100644 website/content/partials/known-issues/ui-pki-control-groups.mdx
 create mode 100644 website/content/partials/known-issues/update-primary-data-loss.mdx
 create mode 100644 website/content/partials/release-notes/deprecation-note.mdx
 create mode 100644 website/content/partials/release-notes/intro.mdx

@@ -1,12 +1,17 @@
-### Control Groups with Issuer detail reads only accessible in UI from overview
+### Users limited by control groups can only access issuer detail from PKI overview page ((#ui-pki-control-groups))
  
-Given a scenario where a user can only read an Issuer's details after Control Group
-approval, they will constantly be directed to the Control Group Access page when
-attempting to link to the Issuer details page from the Issuer list page.
+#### Affected versions
  
-As a workaround, users constrained by Control Groups can select an Issuer to view
-details for from the overview page rather than through the Issuers list page.
+- Vault 1.14.x
  
-#### Impacted Versions
+#### Issue
  
-Affects all current versions of 1.14.x
+Vault UI users who require control group approval to read issuer details are
+directed to the Control Group Access page when they try to view issuer details
+from links on the Issuer list page.
+ 
+#### Workaround
+ 
+Vault UI users constrained by control groups should select issuers from the
+**PKI overview** page to view detailed information instead of the
+**Issuers list** page.

@@ -82,5 +82,45 @@ tutorial for more details.
  
 If you're currently on a version of Vault before 1.11, or you've chosen to opt-out the Autopilot automated upgrade features when running Vault after 1.11 with Integrated Storage, or if you are running Vault with other storage backend such as Consul. Please refer to our [Vault HA upgrades Pre 1.11/Without Autopilot Upgrade Automation](/vault/docs/upgrading/vault-ha-upgrade) documentation for more details. Please note that this upgrade procedure also applies if you are upgrading Vault from pre 1.11 to post 1.11.
  
+## Enterprise Replication Installations
  
+<Note>
  
+Prior to any upgrade, be sure to also read and follow any instructions in the
+version-specific upgrade notes which are found in the navigation menu for this
+documentation.
+ 
+</Note>
+ 
+Upgrading Vault Enterprise clusters which participate in [Enterprise
+Replication](/vault/docs/enterprise/replication) requires the following basic
+order of operations:
+ 
+- **Upgrade the replication secondary instances first** using appropriate
+  guidance from the previous sections
+- Verify functionality of each secondary instance after upgrading
+- When satisfied with functionality of upgraded secondary instances, upgrade
+  the primary instance
+ 
+<Note>
+ 
+It is not safe to replicate from a newer version of Vault to an older version.
+When upgrading replicated clusters, ensure that upstream clusters are always on
+older versions of Vault than downstream clusters.
+ 
+</Note>
+ 
+Here is an example of upgrading four Vault replicated Vault clusters:
+ 
+![Upgrading multiple replicated clusters](/img/vault-replication-upgrade.png)
+ 
+In the above scenario, the ideal upgrade procedure would be as follows,
+verifying functionality after each cluster upgrade.
+ 
+1. Upgrade Clusters B and D. These clusters have no downstream clusters, so they
+   should be upgraded first, but the ordering of B vs D does not matter.
+2. Upgrade Cluster C, which now has an upgraded downstream cluster (Cluster D).
+   Because Cluster C is a cluster, it should also use the HA upgrade process.
+3. Finally, upgrade Cluster A. All clusters downstream of A will already be
+   upgraded. It should be upgraded last, as it is a Performance Primary and a DR
+   Primary.

@@ -64,14 +64,14 @@ Perform these steps on each standby:
  
 At this point all standby nodes are upgraded and ready to take over. The
 upgrade will not complete until one of the upgraded standby nodes takes over
-active duty. 
+active duty.
  
 To complete the cluster upgrade:
  
 1. Properly shut down the remaining (active) node
  
    <Note>
-   
+ 
    It is important that you shut the node down properly.
    This will perform a step-down and release the HA lock, allowing a standby
    node to take over with a very short delay.
@@ -97,45 +97,4 @@ upgrade notes.
  
 ## Enterprise Replication Installations
  
-<Note>
- 
-Prior to any upgrade, be sure to also read and follow any instructions in the
-version-specific upgrade notes which are found in the navigation menu for this
-documentation.
- 
-</Note>
- 
-Upgrading Vault Enterprise clusters which participate in [Enterprise
-Replication](/vault/docs/enterprise/replication) requires the following basic
-order of operations:
- 
-- **Upgrade the replication secondary instances first** using appropriate
-  guidance from the previous sections depending on whether each secondary
-  instance is non-HA or HA
-- Verify functionality of each secondary instance after upgrading
-- When satisfied with functionality of upgraded secondary instances, upgrade
-  the primary instance
- 
-<Note>
- 
-It is not safe to replicate from a newer version of Vault to an older version.
-When upgrading replicated clusters, ensure that upstream clusters are always on
-older versions of Vault than downstream clusters.
- 
-</Note>
- 
-Here is an example of upgrading four Vault replicated Vault clusters:
- 
-![Upgrading multiple replicated clusters](/img/vault-replication-upgrade.png)
- 
-In the above scenario, the ideal upgrade procedure would be as follows,
-verifying functionality after each cluster upgrade.
- 
-1. Upgrade Clusters B and D, using the HA upgrade process above. These clusters
-   have no downstream clusters, so they should be upgraded first, but the
-   ordering of B vs D does not matter.
-2. Upgrade Cluster C, which now has an upgraded downstream cluster (Cluster D).
-   Because Cluster C is a cluster, it should also use the HA upgrade process.
-3. Finally, upgrade Cluster A. All clusters downstream of A will already be
-   upgraded. It should be upgraded last, as it is a Performance Primary and a DR
-   Primary.
+See the main [upgrading](/vault/docs/upgrading#enterprise-replication-installations) page.
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 5d13092b038397d5970dcaa411c43defe993ab3a (#21422)
 website/content/docs/auth/index.mdx | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

@@ -0,0 +1,17 @@
+### Users limited by control groups can only access issuer detail from PKI overview page ((#ui-pki-control-groups))
+ 
+#### Affected versions
+ 
+- Vault 1.14.x
+ 
+#### Issue
+ 
+Vault UI users who require control group approval to read issuer details are
+directed to the Control Group Access page when they try to view issuer details
+from links on the Issuer list page.
+ 
+#### Workaround
+ 
+Vault UI users constrained by control groups should select issuers from the
+**PKI overview** page to view detailed information instead of the
+**Issuers list** page.

@@ -272,3 +272,10 @@ spec:
     create: true
     name: dynamic2
 ```
+ 
+ 
+## Tutorial
+ 
+Refer to the [The Vault Secrets Operator on
+Kubernetes](/vault/tutorials/new-release/vault-secrets-operator) tutorial to
+learn the end-to-end workflow using the Vault Secrets Operator.

@@ -1,84 +1,64 @@
-### update-primary can lead to data loss
- 
-It's possible to lose data from a Vault cluster given a particular configuration
-and sequence of steps.  This page describes two paths to data loss, both
-associated with the use of
-[update-primary](/vault/api-docs/system/replication/replication-performance#update-performance-secondary-s-primary).
- 
-Normally update-primary does not need to be used.  However, there are a few cases
-where it's needed, e.g. when the known primary cluster addresses of a secondary
-don't contain any of the correct addresses.  But update-primary does more than
-you might think: it does almost everything that enabling a secondary does,
-except that it doesn't wipe storage.  One of the steps that it takes is to
-temporarily remove most of the mount table records: it removes all mount entries
-except for those that are managed automatically by vault, e.g. identity mounts.
- 
-This update-primary behaviour is unintended and we'll be reworking it in an upcoming release.
-Once it lands the changelog entry will be "Fix a race condition with update-primary that could
-result in data loss after a DR failover."
- 
-#### update-primary with local data in shared mounts
- 
-If update-primary is done on a PR secondary with shared mounts containing
-[local data](/vault/docs/enterprise/replication#replicated-data) (e.g. pki certs,
-approle secretids), the merkle tree on the PR secondary may get corrupted due to
-a timing race.
- 
-When this happens, the PR secondary still contains all the stored data, e.g. listing
-local certs from PKI mounts will return the correct results.  However, because the
-merkle tree has been corrupted, a downstream DR secondary will not receive the local
-data, and will delete it if it already had it.  If the PR secondary's DR secondary is promoted before
-the PR secondary is repaired, the newly promoted PR secondary will not contain the local
-data it ought to.  If the former PR secondary is lost or destroyed, the missing data
-will not be recoverable other than via a snapshot restore.
- 
-#### Detection and remediation
- 
-If the TRACE level log line `"cleaning key in merkle tree"` appears immediately subsequent
-to an update-primary on a PR secondary, that's an indicator that the timing race was lost
-and that the merkle tree may be corrupt.
- 
-Repairing the corrupt merkle tree is done by issuing a
+### API calls to update-primary may lead to data loss ((#update-primary-data-loss))
+ 
+#### Affected versions
+ 
+- All current versions of Vault
+ 
+<Tip title="We are actively working on the underlying issue">
+ 
+Look for **Fix a race condition with update-primary that could result in data
+loss after a DR failover.** in a future changelog for the resolution.
+ 
+</Tip>
+ 
+#### Issue
+ 
+The [update-primary](/vault/api-docs/system/replication/replication-performance#update-performance-secondary-s-primary)
+endpoint temporarily removes all mount entries except for those that are managed
+automatically by vault (e.g. identity mounts). In certain situations, a race
+condition between mount table truncation replication repairs may lead to data
+loss when updating secondary replication clusters. 
+ 
+Situations where the race condition may occur:
+ 
+- **When the cluster has local data (e.g., PKI certificates, app role secret IDs)
+  in shared mounts**.
+  Calling `update-primary` on a performance secondary with local data in shared
+  mounts may corrupt the merkle tree on the secondary. The secondary still
+  contains all the previously stored data, but the corruption means that
+  downstream secondaries will not receive the shared data and will interpret the
+  update as a request to delete the information. If the downstream secondary is
+  promoted before the merkle tree is repaired, the newly promoted secondary will
+  not contain the expected local data. The missing data may be unrecoverable if
+  the original secondary is is lost or destroyed.
+- **When the cluster has an `Allow` paths defined.**
+  As of Vault 1.0.3.1, startup, unseal, and calling `update-primary` all trigger a
+  background job that looks at the current mount data and removes invalid entries
+  based on path filters. When a secondary has `Allow` path filters, the cleanup
+  code may misfire in the windown of time after update-primary truncats the mount
+  tables but before the mount tables are rewritten by replication. The cleanup
+  code deletes data associated with the missing mount entries but does not modify
+  the merkle tree. Because the merkle tree remains unchanged, replication will not
+  know that the data is missing and needs to be repaired.
+ 
+#### Workaround 1: PR secondary with local data in shared mounts
+ 
+Watch for `cleaning key in merkle tree` in the TRACE log immediately after an
+update-primary call on a PR secondary to indicate the merkle tree may be
+corrupt. Repair the merkle tree by issuing a
 [replication reindex request](/vault/api-docs/system/replication#reindex-replication)
 to the PR secondary.
  
-If logs are no longer present (the update-primary was done some time in the past), it's
-probably best to reindex the PR secondary pre-emptively as a precaution.
- 
-#### update-primary with "Allow" path filters
- 
-There is a further path to data loss associated update-primary.
-This issue requires that the PR secondary receiving an update-primary request has an
-associated `Allow` path filter defined for it. Like the first issue, this one too has
-a timing aspect: the problem may or may not manifest, depending on how
-quickly the mount tables truncated by update-primary get repaired by replication.
- 
-At startup/unseal (and after an update-primary), Vault runs a background job that looks
-at the mount data it has stored and tries to delete any that doesn't belong there, based
-on path filters.  This behaviour was introduced in 1.0.3.1 to recover from a regression
-that allowed for inappropriate filtering of data: we needed to ensure that any previously
-unfiltered data got cleaned up on secondaries that ought not have it.
- 
-If a performance secondary has an associated Allow path filter, this cleanup code can
-misfire during the interval between when the truncated mount tables are written by
-update-primary and the time when they get rewritten by replication.  The cleanup code
-will delete the data associated with the missing mount entries.  The cleanup code
-doesn't modify the merkle tree, and as a result this deleted data won't be discovered
-as missing and repaired by replication.
- 
-#### Detection and remediation
- 
-When the cleanup code fires it logs the INFO level message `"deleted mistakenly stored
-mount entry from backend"`.  This is a reliable indicator that the bug was hit.
- 
-If logs aren't available, the other indicator that this problem has manifested is to
-query the shared mount in question. The secondary won't have any of the data that
-the primary does, e.g. roles and configuration will be absent.
+If TRACE logs are no longer available, we recommend pre-emptively reindexing the
+PR secondary as a precaution.
  
-Reindexing the performance secondary will update the merkle tree to reflect the missing
-storage entries and allow missing shared data to be replaced by replication.  **However,
-any local data on shared mounts (such as PKI certs) will not be recoverable.**
+#### Workaround 2: PR secondary with "Allow" path filters
  
-#### Impacted Versions
+Watch for `deleted mistakenly stored mount entry from backend` in the INFO log.
+Reindex the performance secondary to update the merkle tree with the missing
+data and allow replication to disseminate the changes. **You will not be able to
+recover local data on shared mounts (e.g., PKI certificates)**.
  
-Affects all current versions of Vault.
+If INFO logs are no longer available, query the shared mount in question to
+confirm whether your role and configuration data are present on the primary but
+missing from the secondary.

@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`.
+```

@@ -323,6 +323,11 @@ To solve this issue, there are two possible approaches:
 The choice of approach depends on the policies of the organization wishing
 to use ACME.
  
+Another consequence of the Vault unauthenticated nature of ACME requests
+are that role templating, based on entity information, cannot be used as
+there is no token and thus no entity associated with the request, even when
+EAB binding is used.
+ 
 ### ACME and the Public Internet
  
 Using ACME is possible over the public internet; public CAs like Let's Encrypt
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 774d75e63e2481f28f0890f2b4387303ac232755 (#21294)
 .../partials/update-primary-known-issue.mdx   | 128 +++++++++---------
 1 file changed, 64 insertions(+), 64 deletions(-)

@@ -6,12 +6,13 @@ description: Short list of third-party tools that work with or are related to Va
  
 # Related Tools
  
-## Hashicorp Tools
+## HashiCorp Tools
  
-- The [Terraform Vault provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) can read from, write to, and configure Vault from [HashiCorp Terraform](https://www.terraform.io/)
+- [Vault Agent](/vault/docs/agent-and-proxy/agent) can render Vault secrets either to files or directly into a child process as environment variables using `consul-template` templating syntax
+- [Vault Proxy](/vault/docs/agent-and-proxy/proxy) acts as an API Proxy for Vault, and can optionally allow or force interacting clients to use its automatically authenticated token
+- [Terraform Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) can read from, write to, and configure Vault from [HashiCorp Terraform](https://www.terraform.io/)
 - [consul-template](https://github.com/hashicorp/consul-template) is a template renderer, notifier, and supervisor for HashiCorp Consul and Vault data
-- [envconsul](https://github.com/hashicorp/envconsul) allows you to read and set environmental variables for processes from Consul and Vault data
-- The [vault-ssh-helper](https://github.com/hashicorp/vault-ssh-helper) can be used to enable one-time passwords for SSH authentication via Vault
+- [vault-ssh-helper](https://github.com/hashicorp/vault-ssh-helper) can be used to enable one-time passwords for SSH authentication via Vault
  
 ## Third-Party Tools
  
@@ -23,7 +24,6 @@ The following list of tools is maintained by the community of Vault users; Hashi
 - [pouch](https://github.com/tuenti/pouch) - A set of tools to manage provisioning of secrets on hosts based on the AppRole authentication method of Vault
 - [vault-aws-creds](https://github.com/jantman/vault-aws-creds) - Python helper to export Vault-provided temporary AWS creds into the environment
 - [goldfish](https://github.com/Caiyeon/goldfish) - A Vault UI panel written with VueJS and Vault native Go API.
-- [vaultenv](https://github.com/channable/vaultenv) - A tool that fetches secrets in parallel, puts them into the environment and then `exec`s the process that needs them
 - [vault-migrator](https://github.com/nebtex/vault-migrator) - A tool to migrate data between different Vault storage mechanisms
 - [Cryptr](https://github.com/adobe/cryptr) - a desktop Vault UI for Mac, Windows and Linux
 - [sequelize-vault](https://github.com/linyows/sequelize-vault) - A Sequelize plugin for easily integrating Vault secrets.
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
 67927a1e9f0a2145b5a5a1e1a8d6d542fe16b25e (#21355)
 website/content/docs/upgrading/index.mdx      | 40 ++++++++++++++++
 .../docs/upgrading/vault-ha-upgrade.mdx       | 47 ++-----------------
 2 files changed, 43 insertions(+), 44 deletions(-)