Vault: delete all secrets under a path

[nickithewatt]

It would be very handy if vault allowed for the deletion of a whole path of secrets, rather than have to delete them one by one.

e.g.

vault delete -recurse=true secret/teams/teamA OR
vault delete secret/teams/teamA/*

would delete everything under this path which may include for example secret/teams/teamA/password1, secret/teams/teamA/password2 but not secret/teams/teamB/password1 etc.

You may say that you can simply mount different teams under different areas and then use unmounting as one option, which is true, however, if for whatever reasons, you choose to partition vault in another way (maybe prod/dev/staging etc) having the ability to bulk delete secrets in this fashion is very handy (at least in the generic backend) provided you have the privs to do so of course

[jefferai]

Hi there,

We looked at it a bit ago as part of another feature we were implementing and found some issues, the main being that deletion behavior across physical backends did not always support recursive delete natively and performing a manual delete within Vault by recursively listing and deleting could have deleterious effects on the backends (especially HA backends) if the number of keys was large. This could mean that an operation could unexpectedly cause both a very long delay within a Vault-using application completing, and could put serious load on the backend.

For now we decided to stick to having clients recursively delete if they desire, but each operation then is much less likely to cause an issue, and the delete can be abandoned by the client at any point along the way and retried later if the backend has become too loaded.

What will help and allow this is that list support will come to generic soon (next release or two), so it then becomes a pretty easy walk of the tree and delete commands.

If we find a good way to support recursive delete across physical backends we will certainly be looking at implementing it.

[nickithewatt]

Thanks Jeff makes sense!

[RulerOf]

I wrote a ruby script to do this in our environment, then cleaned it up and put it in a repo in case anyone needs to do this: https://github.com/BuyerQuest/vault-recursive-delete

[hipyhop]

I came here looking for the same thing and ended up just using a bash for loop
for path in $(vault list database/roles); do vault delete database/roles/${path}; done

[Abukamel]

I have created a script that will recursively delete a path of kv secret engine versions 2.

It may help https://github.com/Abukamel/vault-recursive-delete