HashiCorp has released Vault 1.20, focused on reducing the bootstrap-secret problem and improving Kubernetes integration.
Secretless Authentication
New workload identity providers (AWS IMDSv2, GCE metadata, Azure MSI, Kubernetes projected service account tokens) now authenticate directly to Vault without a pre-shared secret. Applications can get credentials on first startup using only their cloud platform identity — eliminating the chicken-and-egg problem of storing the Vault token to retrieve secrets.
Kubernetes Secrets Engine v2
The rewritten engine generates ephemeral ServiceAccount tokens and RBAC role bindings on demand, with automatic cleanup when leases expire. Replaces long-lived kubeconfig files in CI/CD pipelines and break-glass scenarios.
Performance
Enterprise performance replication now uses streaming deltas instead of periodic snapshots, reducing replication lag from minutes to seconds on large clusters.
