Vault executes plugin binaries when they are configured and roles established around them. The binary cannot be modified or replaced while running, so upgrades cannot be performed by simply swapping the binary and updating the hash in the plugin catalog.
Instead, you can restart or reload a plugin with the sys/plugins/reload/backend API. Follow these steps to replace or upgrade a Vault plugin binary:
- Register plugin_v1 to the catalog
- Mount the plugin backend
- Register plugin_v2 to the catalog under the same plugin name, but with updated command to run plugin_v2 and updated sha256 of plugin_v2
- Trigger a plugin reload with
sys/plugins/reload/backendto reload all mounted backends using that plugin, or just a subset of the mounts using either thepluginormountsparameter.
Until step 4, the mount will still use plugin_v1, and when the reload is triggered, Vault will kill plugin_v1’s process and start a plugin_v2 process.