Modifying Key Vault
This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here. |
|---|
Overview
The section explains how to modify or recreate an Azure Key Vault used by Kyvos, since Azure doesn't allow changing the soft delete / purge protection retention period after vault creation. Kyvos's workaround: create a new Key Vault with the desired retention settings, copy over all secrets, then point Kyvos to the new vault.
Note
Retention policy (soft delete + purge protection) can only be set at vault creation, per Microsoft documentation — cannot be edited later. The same retention interval applies to both soft delete and purge protection policies.
Kyvos's recommended fix: recreate the vault and migrate secrets.
On this page:
Here’s a summary of the steps required to create a new Key Vault and copying all existing secrets from the current Key Vault to the newly created one.
To create the Key Vault, perform the following steps.
Log in to the Azure portal with a user having sufficient permissions and information.
On the Home page, in the search box, type Key Vaults.
On the Key Vaults page, click Create.
The Create a Key Vault page is displayed.
Click the Basics tab.
Select your Subscription account.
Select the name of your Resource Group. You can also create a new resource group using the Create new option.
Note
To add a new resource group, you must add this Managed Application Contributor Role at the subscription level.
Enter the Key vault name.
Select the same Region as the Resource group.
Select the Azure Key Vault Pricing Tier from Standard or Premium.
Under the Recovery options, enter the Days to retain deleted vaults. For example, you can keep the value as 7
From the Purge Protection, select the Enable option.
Click Next. The Access Configuration tab is displayed.
Select the Vault Access Policy option for the permission model.
Select the following checkboxes for the Resource access:
Azure Resource Manager for template deployment
Azure Virtual Machines for deployment
Azure Disk Encryption for volume encryption
Click Create. The Create an access policy dialog is displayed.
In the Secret permissions section, the assigned managed identity must have Secret Permissions (GET, LIST, and SET), then click Next.
On the Principal tab, select the managed identity from the list configured on your cluster, then click Next.
Click Review + Create. The managed identity is displayed with permissions in the Access policies section.
Click Next, and the Networking tab will be displayed.
Modify the networking settings as needed.
Click Next, and the Tag tab is displayed. This is an optional configuration. You can specify the tags using the parameters displayed in the Tags section.
Download the copy_secrets.sh script (available in Azure Installation Files) to copy the secret from the existing vault to the new vault.
Provide the source and destination vault names in the copy_secrets.sh script (available in Azure Installation Files) before executing.
On the Home page, click Cloud Shell.
Upload the script by clicking the Upload button.
Note
If the firewall is enabled on your existing Key Vault (from where we need to copy secrets), you must ensure that the IP address from which the script is accessing the Key Vault is allowed through the firewall.
Run the script.
Copy the new vault URL from the Azure portal once all the secrets are copied to the new Key Vault.