| Feature | +Summary | +Benefit | +
|---|---|---|
| SPIFFE authentication | ++ Use the SPIFFE authentication plugin to leverage SPIFFE frameworks based + SVIDS. With the SPIFFEE plugin, clients can authenticate to Vault and + request SVIDs to authenticate in SPIFFE environment. + | ++ Increases flexibility to authenticate workloads with SPIFFE authentication + methods and enables new workloads that require SPIFFE. + | +
| MFA TOTP self-enrollment | ++ Configure multi-factor authenication in Vault to let clients self-enroll + with QR codes during login when they do not have a TOTP configured. + | ++ Applies MFA TOTP enforcements to users before they exist instead of + requiring operators to manually generate and send users an enrollment QR + code. + | +
| KV v2 version attribution | ++ Query the metadata endpoint with read and list requests for for KV v2 + secrets to get the human-readable name of the user who created the + targeted secret version. + | ++ Simplifies information gathering by replacing manual audit log reviews + with a straightforward metadata query. + | +
| Cumulative client counts endpoint | ++ Easily query the number of Vault clients consumed by a namespace and all + its descendants. + | ++ Provides easier access to client utilization data in environments with + nested namespace structures. + | +
| Root rotation for Snowflake key-pairs | ++ Perform on-demand and scheduled rotations for key-pair root credentials in + the Snowflake plugin. + | ++ Fully automates the rotation of key-pair root credentials for Snowflake + | +
| Static roles in the Azure Secret Engine | ++ Rotate Azure static roles tied to long-lived credentials on demand with + initialization or imported credentials. + | ++ Simplify lifecycle management for long-lived Azure credentials for key + workflows instead of juggling dynamic secrets that Vault revokes when the + workflow client disconnects. + | +
| Feature | +Summary | +Improvement | +
|---|---|---|
| Client count dashboard | ++ View a list of individual clients in each client count aggregate from the + new **Client list** tab in the client count dashboard. + | ++ Simplifies data access for preliminary analysis. + | +
| Secret recovery | ++ Use the Vault GUI or API to automatically load snapshots and recover + individual database static roles or SSH config CA/managed keys. + | ++ Lets you delegate recovery of individual secrets and provide a granular, + flexible recovery mechanism for technical and non-technical users. + | +
| Attestation evidence for credential rotation | ++ Use Vault server logs to review the details for successful and failed + automated root rotations and static role rotation for the database and + LDAP secrets engines. + | ++ Improved transparancy and confidence that root credential rotation + happened properly for less complicated compliance checks. + | +
| RACF passphrase support in the LDAP plugin | ++ Use RACF passphrases (up to 100 characters) with the LDAP secrets engine + plugin. + | ++ Supports longer, more secure RACF passphrases and helps you keep up with + changing security policy requirements.. + | +
| Eventing in the LDAP Secrets Engine | ++ The LDAP secrets engine now + [emits events](/vault/docs/concepts/events#event-types) including rotation + success and failure events. + | ++ Expands functionality of the LDAP secrets engine plugin with new events. + | +
| Dedicated rotation URL for LDAP authentication | ++ The LDAP authentication plugin supports root account rotation with a + dedicated URL. + | ++ Supports root account rotation even when you configure the plugin with the + Global Catalog URL of an AD Forest. + | +
| Counter of PKI certificates issued | ++ Track the monthly total number of PKI certificates issued cluster-wide by a + given Vault cluster. + | ++ Improved visibility into PKI usage. + | +
| License utilization and product usage data updates | ++ Vault collects and reports additional data points to HashiCorp for + improved + [license utilization reporting](../license/utilization/auto-reporting) and + [anonymized product usage reporting](../license/product-usage-reporting). + | ++ Improved product insights and roadmap prioritization. + | +
| Companion | +Summary | +Benefit | +
|---|---|---|
| Vault Secrets Operator | ++ Map Vault secrets directly into application pods with shared volumes + as [protected secrets using CSI drivers](/vault/docs/deploy/kubernetes/vso/csi). + | ++ Deliver secrets from Vault to Kubernetes workloads in deployments that + restrict the use of native K8s secrets. + | +
| Vault Secrets Store CSI provider | ++ Red Hat certified the Vault Secrets Store CSI provider for use on + OpenShift. + | ++ Use Vault Secret Store even in environments that require Red Hat Open + Shift certification for all system components. + | +
| MS SQL external key management provider | ++ Grant database administrators full control over the versions of `transit` + keys used to wrap and unwrap data encryption keys for SQL Server. + | ++ Reduce the number of keys and simplify the database restore process + from encrypted backups. + | +