Skip to main content

Remount ( API )

The Remount documentation details the endpoints required to trigger and monitor the status of a remount operation.

Move backend​

The /sys/remount endpoint moves an already-mounted backend to a new mount point. Remounting works for both secret engines and auth methods.

OpenBao returns a migration ID when the remount operation completes. You can use the migration ID to look up the status of the mount migration. More details about the remount operation are described in Mount Migration.

warning

Note: This endpoint requires a policy with both sudo and update capabilities to sys/remount

warning

Note: A mount migration will revoke all leases for the secrets of a secrets backend or tokens of an auth backend, depending on which type of backend is being moved.

warning

Before migrating a mount to a new path, one should ensure it is currently not actively used. Using a mount while it's being moved will lead to inconsistent reads on standby nodes.

MethodPath
POST/sys/remount

Parameters​

  • from (string: <required>) – Specifies the previous mount point.

  • to (string: <required>) – Specifies the new destination mount point.

Sample payload ( cross namespace )​

{
  "from": "ns1/ns2/secret",
  "to": "ns1/ns3/new-secret"
}

Sample payload ( cross namespace, auth mount )​

{
  "from": "ns1/ns2/auth/approle",
  "to": "ns1/ns3/auth/new-approle"
}

Sample payload ( within namespace )​

{
  "from": "secret",
  "to": "new-secret"
}

Sample request​

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/sys/remount

Sample response​

{
  "migration_id": "ef3ba21c-8be8-4e5f-8d00-cb46a532c665"
}

Monitor migration status​

This endpoint is used to monitor the status of a mount migration operation, using the ID returned in the response of the sys/remount call. The response contains the passed-in ID, the source and target mounts, and a status field that displays in-progress, success or failure.

MethodPath
GET/sys/remount/status/:migration_id

Parameters​

  • migration_id (string: <required>) – Specifies the id of the mount migration

Sample request​

$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/sys/remount/status/ef3ba21c-8be8-4e5f-8d00-cb46a532c665

Sample response​

{
  "migration_id": "ef3ba21c-8be8-4e5f-8d00-cb46a532c665",
  "migration_info": {
    "source_mount": "ns1/ns2/secret",
    "target_mount": "ns1/ns3/new-secret",
    "status": "in-progress",
  }
}