hashicorp / hashicorp/vault

KVv2 metadata "updated_time" does not change when the KV path is updated

Open
#32,117 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

**Describe the bug**

The `updated_time` field in kvv2 metadata is supposed to track what is the last time the KV path is updated. However, the field is not updated for these operations

- Metadata update for cas_required, custom_metadata, delete_version_after, max-versions
- KV delete, KV undelete, KV destroy

This is confusing because KV put will bump the value.

**To Reproduce**

```bash

$ vault kv put secret/foo data=1

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.065303Z"

$ vault kv put secret/foo data=2

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.225348Z"

$ vault kv put secret/foo data=3

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv metadata put -cas-required=true secret/foo
Success! Data written to: secret/metadata/foo

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv metadata put -custom-metadata aa=bb secret/secret
Success! Data written to: secret/metadata/secret

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv delete -versions=1 secret/foo
Success! Data deleted (if it existed) at: secret/data/foo

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv undelete -versions=1 secret/foo
Success! Data written to: secret/undelete/foo

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv destroy -versions=1 secret/foo
Success! Data written to: secret/destroy/foo

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv metadata put -delete-version-after=100s secret/foo
Success! Data written to: secret/metadata/foo

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"

$ vault kv metadata put -max-versions=1000 secret/foo
Success! Data written to: secret/metadata/foo

$ vault kv metadata get -format json secret/foo | jq .data.updated_time
"2026-09-17T07:06:46.381244Z"
```

**Expected behavior**

All operations to a KV path should bump the `updated_time`. Unless it's no-op like deleting a deleted version.

**Environment:**
* Vault Server Version (retrieve with `vault status`): 2.1.1

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the listed vault kv put, metadata put, delete, undelete, and destroy commands, then trace the KVv2 metadata and version-operation entry points they exercise. Done means updated_time advances for metadata changes and KV path updates, while remaining unchanged for no-op operations such as deleting an already deleted version.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.