Which Version is my Vault KV Mount?

Introduction

Overview

Newer versions of Vault allow you directly determine the version of a KV Secrets Engine mount by querying `/sys/mounts/:path/tune`, then extracting the "options" and "version" key from the data.

Procedures

Using `jq`, and given mounts named "example-one" and "example-two", a KV v1/v2 mounts will look like the following when queried via `/sys/mounts`:

$ vault read -format=json /sys/mounts/example-one/tune | \
    jq -r '.data.options.version'
1
$ vault read -format=json /sys/mounts/example-two/tune | \
    jq -r '.data.options.version'
2

Using `curl`,

$ curl -s -H "X-Vault-Token: $VAULT_TOKEN" \
    $VAULT_ADDR/v1/sys/mounts/example-one/tune | \
    jq -r '.data.options.version'
1
$ curl -s -H "X-Vault-Token: $VAULT_TOKEN" \
    $VAULT_ADDR/v1/sys/mounts/example-two/tune | \
    jq -r '.data.options.version'
2

Additional Information: 

• Vault `/sys/mounts` API, Reading Mount Configuration