Skip to main content
In this guide, you’ll explore how to enable and manage the Key/Value (KV) version 1 secrets engine in HashiCorp Vault. You will learn to list existing secrets engines, mount a new KV engine, perform CRUD operations on secrets, and filter JSON output with jq.

​
1. List Enabled Secrets Engines

Run the following command to see which secrets engines are mounted:

​
2. Enable a KV Version 1 Secrets Engine

By default, kv enables version 1. Mount it at the path training:
Success! You should see:
Verify the new mount:
If you need KV version 2 (with versioning, metadata, and rollback), use -version=2.

​
3. Verify the Engine Version

Use --detailed to confirm the KV engine version:
Look for an empty Options map (map[]), which indicates KV v1:

​
4. Write and Read Secrets

Write a secret at training/apps/jenkins:
Read it back:
Output:

​
5. Update Secrets

Writing to the same path replaces existing data:
Result:

​
6. Write Multiple Key/Value Pairs

You can include several pairs in one command:
Result:

​
7. Filter JSON Output with jq

Retrieve secret data in JSON:
Sample output:
Extract fields:

​
8. Delete Secrets

In KV v1, deleting a secret permanently removes it—no version history is kept.
You should see:

​
9. List Keys in a Path

First, add a couple of secrets:
List subpaths under training/apps:
To list only data keys (no trailing slash):

​
Conclusion

You’ve now learned how to:
  • Mount the KV version 1 secrets engine
  • Write, read, update, and delete secrets
  • List secrets and filter JSON output
For KV version 2 features like versioning and rollback, see the HashiCorp Vault KV Secrets Engine.

Watch Video