Secrets Management

1. Confirm the mount, path, and key-value data.
2. For KV v2: call vault_kv_write. Use cas for check-and-set if updating existing secrets.
3. For KV v1: call vault_kv1_write.
4. Confirm success and show the created/updated version.

Deleting a secret

1. Always show the secret path and ask for explicit confirmation.
2. For KV v2 soft delete: call vault_kv_delete (data can be recovered with vault_kv_undelete).
3. For permanent delete: call vault_kv_metadata_delete (destroys all versions).
4. For KV v1: call vault_kv1_delete (permanent).

Managing secrets engines

1. vault_list_mounts — see all mounted engines.
2. vault_enable_engine — mount a new engine (specify type and options like { version: "2" } for KV v2).
3. vault_disable_engine — unmount an engine (destroys all data; always confirm first).
4. vault_tune_engine — adjust TTLs and description.

Best Practices

• Default to KV v2 for new engines (supports versioning, soft delete, metadata).
• Use cas (check-and-set) when updating critical secrets to prevent overwrites.
• Never display secret values unless the user explicitly asks to read them.
• When creating a new KV engine, use: vault_enable_engine with type: "kv" and options: { version: "2" }.

Reference

See references/kv-engines.md for detailed KV v1 vs v2 differences.