From e0bf224cfb665c1d9c4cd7f6de29bdb1fd09441a Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 07:13:14 -0600 Subject: [PATCH 01/21] DOCS-892: align SRA transfer protocol and stdout JSON logging docs --- .../configure-gateway/gateway-log-forwarding.md | 4 ++++ .../cli-reference-gateway/cli-reference-sra.md | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/Akeyless Gateway/configure-gateway/gateway-log-forwarding.md b/docs/Akeyless Gateway/configure-gateway/gateway-log-forwarding.md index 1d0299327..7f56d7a5e 100644 --- a/docs/Akeyless Gateway/configure-gateway/gateway-log-forwarding.md +++ b/docs/Akeyless Gateway/configure-gateway/gateway-log-forwarding.md @@ -247,6 +247,10 @@ input { 5. From the **Log Service** dropdown list, select `Standard Output`. +> ℹ️ **Note:** +> +> To emit structured logs to container standard output, set the log format to `JSON`. + ## Sumo Logic 1. Log in to the Akeyless Gateway and go to **Log Forwarding**. diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md b/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md index a070586ce..2bf5d8d02 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md @@ -419,11 +419,11 @@ For HTTP endpoint details that map to these commands, see: ## File Transfer Commands -The Akeyless CLI supports SRA file transfer with `file upload` and `file download` when using version 1.145 or later. +The Akeyless CLI supports SRA file transfer with `file upload` and `file download` when using version 1.146 or later. -These commands run on the client machine and invoke the local `scp`/`ssh` tooling to perform transfer over an SRA tunnel. +These commands run on the client machine and use SFTP over an SRA tunnel. -At runtime, the CLI resolves target and bastion connection parameters (from command flags or profile), requests short-lived access by way of the configured SSH certificate issuer, and then establishes the tunnel used by `scp` for upload/download. +At runtime, the CLI resolves target and bastion connection parameters (from command flags or profile), requests short-lived access by way of the configured SSH certificate issuer, and then establishes the tunnel used by SFTP for upload and download. If local `scp`/`ssh` binaries are missing or not available in `PATH`, file transfer commands fail on the client before transfer starts. From 9f3d35641996b2a3c33089ab1004704cb297ff5d Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 07:22:03 -0600 Subject: [PATCH 02/21] DOCS-892: integrate additional 4.53/1.146 docs updates --- .../dedicated-k8s-auth-service-accounts.md | 4 ++++ docs/Accessing Akeyless/rbac/index.md | 2 ++ docs/Encryption & KMS/kmip-server/index.md | 1 + .../sra-user-guides/sra-akeyless-scp.md | 6 ++--- .../sra-user-guides/sra-portal.md | 24 ++++++++++++------- 5 files changed, 25 insertions(+), 12 deletions(-) diff --git a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md index ae4a3ef3c..bae9cb609 100644 --- a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md +++ b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md @@ -216,6 +216,10 @@ Where: * `token-reviewer-jwt`: The ServiceAccount `JWT` used to access the `TokenReview` API (relevant only to `native_k8s` access type). +> ℹ️ **Note (Gateway 4.53.0+):** +> +> You can configure TokenReview rate limiting for Kubernetes authentication flows. For the current CLI flags, see [CLI Reference - K8S Auth Method](https://docs.akeyless.io/docs/cli-reference-k8s-auth-method#gateway-create-k8s-auth-config). + * `k8s-ca-cert`: The certificate to use to validate the Kubernetes cluster. * `k8s-issuer`: Optional, the [Kubernetes JWT issuer name](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery) (default is `kubernetes/serviceaccount`). diff --git a/docs/Accessing Akeyless/rbac/index.md b/docs/Accessing Akeyless/rbac/index.md index ad46722b2..03a0435c0 100644 --- a/docs/Accessing Akeyless/rbac/index.md +++ b/docs/Accessing Akeyless/rbac/index.md @@ -114,6 +114,8 @@ The existing permissions for Secure Remote Access are as follows: * Upload Files: For RDP only. Allows a user to upload local files to a remote Windows machine using a button on the top menu. More information [here](https://docs.akeyless.io/docs/sra-remote-desktop#download--upload-files). * Download Files: For RDP only. Allows a user to download files from a remote Windows machine to their local machine. More information [here](https://docs.akeyless.io/docs/sra-remote-desktop#download--upload-files). +From Gateway `4.53.0` and later, SRA users can also track Secure Remote Access request lifecycle states from the portal **Access Requests** page. + ## Administrative Rules With Administrative Rules, you can choose whether users have access only to the resources they own (**Own**), access to items users have `list` permission for (**Scoped**), or access to all resources (**All**). diff --git a/docs/Encryption & KMS/kmip-server/index.md b/docs/Encryption & KMS/kmip-server/index.md index a4caf1cfc..5c3829186 100644 --- a/docs/Encryption & KMS/kmip-server/index.md +++ b/docs/Encryption & KMS/kmip-server/index.md @@ -67,6 +67,7 @@ Flags: * `hostname`: Hostname of this KMIP server. * `root`: Required path to store KMIP objects. +* `certificate-ttl`: Optional. Server certificate TTL in days. Gateway `4.53.0` and later supports TTL values longer than one year. * `expiration-event-in`: Optional. Number of days before expiration to notify. Repeat the flag to set multiple events, for example `--expiration-event-in 1 --expiration-event-in 5`. * `gateway-url[=http://localhost:8000]`: Akeyless Gateway URL. diff --git a/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md b/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md index a72076270..226b5516b 100644 --- a/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md +++ b/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md @@ -20,9 +20,9 @@ This page also includes legacy `akeyless-scp` guidance for existing automation t The `akeyless file` command enables secure file transfer to and from remote targets through the SRA bastion. It is built into the Akeyless CLI and supports both upload and download operations without requiring additional scripts. -These commands run on the client machine and invoke the local `scp`/`ssh` tooling to perform transfer over an SRA tunnel. +These commands run on the client machine and use SFTP over an SRA tunnel. -At runtime, the CLI resolves target and bastion connection parameters (from command flags or profile), requests short-lived access by way of the configured SSH certificate issuer, and then establishes the tunnel used by `scp` for upload/download. +At runtime, the CLI resolves target and bastion connection parameters (from command flags or profile), requests short-lived access by way of the configured SSH certificate issuer, and then establishes the tunnel used by SFTP for upload and download. If local `scp`/`ssh` binaries are missing or not available in `PATH`, file transfer commands fail on the client before transfer starts. @@ -35,7 +35,7 @@ If local `scp`/`ssh` binaries are missing or not available in `PATH`, file trans * Akeyless [CLI](https://docs.akeyless.io/docs/cli) (latest version recommended; run `akeyless update` to upgrade). * An [SSH certificate issuer](https://docs.akeyless.io/docs/sra-ssh-certificates). * An [Akeyless Gateway](https://docs.akeyless.io/docs/gateway-overview) with Remote Access enabled. -* A local `ssh` and `scp` client (for example, OpenSSH). +* A local `ssh` client with SFTP support (for example, OpenSSH). * OpenSSH v7.3 or higher on target servers. * The appropriate SRA permission on your certificate issuer: * **Upload**: `sra_upload_files`. diff --git a/docs/Secure Remote Access/sra-user-guides/sra-portal.md b/docs/Secure Remote Access/sra-user-guides/sra-portal.md index c11fe5fb1..3fabfefd4 100644 --- a/docs/Secure Remote Access/sra-user-guides/sra-portal.md +++ b/docs/Secure Remote Access/sra-user-guides/sra-portal.md @@ -16,10 +16,10 @@ All Akeyless-supported [resource types](https://docs.akeyless.io/docs/sra-resour Currently, the SRA Portal supports the following authentication methods: -- [SAML](https://docs.akeyless.io/docs/auth-with-saml) -- [OIDC](https://docs.akeyless.io/docs/auth-with-oidc) -- [Certificate](https://docs.akeyless.io/docs/auth-with-certificate) -- [LDAP](https://docs.akeyless.io/docs/auth-with-ldap) +* [SAML](https://docs.akeyless.io/docs/auth-with-saml) +* [OIDC](https://docs.akeyless.io/docs/auth-with-oidc) +* [Certificate](https://docs.akeyless.io/docs/auth-with-certificate) +* [LDAP](https://docs.akeyless.io/docs/auth-with-ldap) > ✅ **Tip (Allowed redirect URL):** If you are using SAML or OIDC auth methods, ensure your Gateway URL is trusted. @@ -33,9 +33,15 @@ Currently, the SRA Portal supports the following authentication methods: The portal shows all the [resource types](https://docs.akeyless.io/docs/sra-resource-types) that you are authorized to access. -![](https://files.readme.io/11ba4ba151caf6160d6f57e98c41057fd75b7415113415cbce25daaf528c4b0c-Screenshot_2026-06-11_at_12.52.16.png) +![Secure Remote Access Portal resources view](https://files.readme.io/11ba4ba151caf6160d6f57e98c41057fd75b7415113415cbce25daaf528c4b0c-Screenshot_2026-06-11_at_12.52.16.png) -
+## Access Requests Lifecycle + +From Gateway `4.53.0` and later, the portal includes an **Access Requests** page that shows request lifecycle states (for example, pending, approved, and denied) for Secure Remote Access requests. + +Use this page to track request progress and quickly identify whether an SRA access request still requires approver action. + +For setup and permissions, see [Request Access](https://docs.akeyless.io/docs/request-access) and [RBAC](https://docs.akeyless.io/docs/rbac). ## Switch the Portal Theme @@ -61,9 +67,9 @@ In addition to existing hosts that are part of the allowed hosts on the [SSH Cer > ℹ️ **Note (Key Features):** > -> - **On-the-Fly Connections**: Users can provide a hostname or IP address for **RDP** or **SSH** sessions as needed. -> - **Temporary Host Addition**: Hostnames added through this feature are temporary and stored in the browser’s cache. -> - **Edit** and **Delete** Capability: Users can edit or remove the last added host from the list. +> * **On-the-Fly Connections**: Users can provide a hostname or IP address for **RDP** or **SSH** sessions as needed. +> * **Temporary Host Addition**: Hostnames added through this feature are temporary and stored in the browser’s cache. +> * **Edit** and **Delete** Capability: Users can edit or remove the last added host from the list. 1. In the SSH or RDP window, choose **Custom Target** and click the **+** button. 2. Select the **Permission Profile**. For example, [SSH Cert Issuer](https://docs.akeyless.io/docs/sra-ssh). From 363cf284ed3ded6f61252e84f074ade6fcdb8060 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 07:24:12 -0600 Subject: [PATCH 03/21] DOCS-892: document connect mysql flags and uid_comment sub-claim --- docs/Accessing Akeyless/rbac/sub-claims.md | 2 ++ .../sra-admin-guides/sra-akeyless-connect.md | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/docs/Accessing Akeyless/rbac/sub-claims.md b/docs/Accessing Akeyless/rbac/sub-claims.md index f943b9757..34ed3e350 100644 --- a/docs/Accessing Akeyless/rbac/sub-claims.md +++ b/docs/Accessing Akeyless/rbac/sub-claims.md @@ -12,6 +12,8 @@ next: --- For some of the Auth Methods like JWT/OIDC, Kubernetes, SAML, and LDAP that contain sub-claims or attribute-based access control (ABAC), also known as policy-based access control, as part of the given signed token, you can restrict the authorizations of the associated role to these specific claims or attributes. In other words, only clients whose tokens contain these sub-claims (in the case of JWT/OIDC) or attributes (in the case of SAML) will be allowed to access the rules defined in the role. +For UID tokens, token comments are available as a sub-claim key named `uid_comment`. + The sub-claims definition is in the structure of a map that contains keys that represent the field name of the sub-claims, and each key can contain several values ​​so the sub-claim must contain one of those values. The keys and values are case-sensitive. For example, assume sub-claims are set to: diff --git a/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md b/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md index d64117bdb..9adb8c3cc 100644 --- a/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md +++ b/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md @@ -215,6 +215,10 @@ akeyless connect -t :27017 -g -n ":3306 -g -n "" ``` +> ℹ️ **Note (CLI v1.146.0+):** +> +> The `connect` command supports MySQL interactive flags. For the current supported options, run `akeyless connect -h`. + ### Amazon EKS ```shell From a22ed398038ea9291e1b5274170cd8ab6d81285e Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 07:53:51 -0600 Subject: [PATCH 04/21] DOCS-892: align SRA request wording with frontend code --- docs/Accessing Akeyless/rbac/index.md | 2 +- docs/Secure Remote Access/sra-user-guides/sra-portal.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/Accessing Akeyless/rbac/index.md b/docs/Accessing Akeyless/rbac/index.md index 03a0435c0..09a7d9a12 100644 --- a/docs/Accessing Akeyless/rbac/index.md +++ b/docs/Accessing Akeyless/rbac/index.md @@ -114,7 +114,7 @@ The existing permissions for Secure Remote Access are as follows: * Upload Files: For RDP only. Allows a user to upload local files to a remote Windows machine using a button on the top menu. More information [here](https://docs.akeyless.io/docs/sra-remote-desktop#download--upload-files). * Download Files: For RDP only. Allows a user to download files from a remote Windows machine to their local machine. More information [here](https://docs.akeyless.io/docs/sra-remote-desktop#download--upload-files). -From Gateway `4.53.0` and later, SRA users can also track Secure Remote Access request lifecycle states from the portal **Access Requests** page. +From Gateway `4.53.0` and later, SRA users can request access from the portal and approvers can process the request through the Event Center. ## Administrative Rules diff --git a/docs/Secure Remote Access/sra-user-guides/sra-portal.md b/docs/Secure Remote Access/sra-user-guides/sra-portal.md index 3fabfefd4..f9c4c8b8b 100644 --- a/docs/Secure Remote Access/sra-user-guides/sra-portal.md +++ b/docs/Secure Remote Access/sra-user-guides/sra-portal.md @@ -35,11 +35,11 @@ The portal shows all the [resource types](https://docs.akeyless.io/docs/sra-reso ![Secure Remote Access Portal resources view](https://files.readme.io/11ba4ba151caf6160d6f57e98c41057fd75b7415113415cbce25daaf528c4b0c-Screenshot_2026-06-11_at_12.52.16.png) -## Access Requests Lifecycle +## Access Request Flow -From Gateway `4.53.0` and later, the portal includes an **Access Requests** page that shows request lifecycle states (for example, pending, approved, and denied) for Secure Remote Access requests. +From Gateway `4.53.0` and later, the portal supports Secure Remote Access request flows, and approvers can process those requests through the Event Center. -Use this page to track request progress and quickly identify whether an SRA access request still requires approver action. +Use this flow to track request progress and quickly identify whether an SRA access request still requires approver action. For setup and permissions, see [Request Access](https://docs.akeyless.io/docs/request-access) and [RBAC](https://docs.akeyless.io/docs/rbac). From cef60a5c257654db753004b7725a1fb2b1a87c62 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:00:27 -0600 Subject: [PATCH 05/21] DOCS-892: document kmip ttl minimum range --- docs/Encryption & KMS/kmip-server/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Encryption & KMS/kmip-server/index.md b/docs/Encryption & KMS/kmip-server/index.md index 5c3829186..f9757d483 100644 --- a/docs/Encryption & KMS/kmip-server/index.md +++ b/docs/Encryption & KMS/kmip-server/index.md @@ -67,7 +67,7 @@ Flags: * `hostname`: Hostname of this KMIP server. * `root`: Required path to store KMIP objects. -* `certificate-ttl`: Optional. Server certificate TTL in days. Gateway `4.53.0` and later supports TTL values longer than one year. +* `certificate-ttl`: Optional. Server certificate TTL in days. Values must be `90` days or longer. Gateway `4.53.0` and later supports TTL values longer than one year, and the KMIP implementation does not define a smaller product-specific upper bound. * `expiration-event-in`: Optional. Number of days before expiration to notify. Repeat the flag to set multiple events, for example `--expiration-event-in 1 --expiration-event-in 5`. * `gateway-url[=http://localhost:8000]`: Akeyless Gateway URL. @@ -112,7 +112,7 @@ akeyless kmip-create-client \ Flags: * `name`: A unique name of the KMIP client. The name can include the path to the virtual folder where you want to create the new client, using slash `/` separators. If the folder does not exist, it will be created together with the client. -* `certificate-ttl`: Client certificate TTL in days. +* `certificate-ttl`: Client certificate TTL in days. Values must be `90` days or longer. The KMIP implementation does not define a smaller product-specific upper bound. * `expiration-event-in`: Optional. Number of days before expiration to notify. Repeat the flag to set multiple events, for example `--expiration-event-in 1 --expiration-event-in 5`. * `gateway-url[=http://localhost:8000]`: Akeyless Gateway URL (port `8000`). * `output-file-folder`: Folder path to save client certificate files locally (for example, `.` for current working dir). From aab590a7e44b937055179ce4e9bd17334c9578cd Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:02:46 -0600 Subject: [PATCH 06/21] DOCS-892: clarify k8s tokenreview rate limit wording --- .../auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md index bae9cb609..bdf72c870 100644 --- a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md +++ b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md @@ -218,7 +218,7 @@ Where: > ℹ️ **Note (Gateway 4.53.0+):** > -> You can configure TokenReview rate limiting for Kubernetes authentication flows. For the current CLI flags, see [CLI Reference - K8S Auth Method](https://docs.akeyless.io/docs/cli-reference-k8s-auth-method#gateway-create-k8s-auth-config). +> You can configure TokenReview rate limiting for Kubernetes authentication flows through Gateway-side Kubernetes auth configuration. For the current K8s auth config flags, see [CLI Reference - K8S Auth Method](https://docs.akeyless.io/docs/cli-reference-k8s-auth-method#gateway-create-k8s-auth-config). * `k8s-ca-cert`: The certificate to use to validate the Kubernetes cluster. From a40f7ca18227d92187ee0659f9d613805a478a66 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:04:13 -0600 Subject: [PATCH 07/21] DOCS-892: keep kmip ttl range wording --- docs/Encryption & KMS/kmip-server/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Encryption & KMS/kmip-server/index.md b/docs/Encryption & KMS/kmip-server/index.md index f9757d483..798b27eb2 100644 --- a/docs/Encryption & KMS/kmip-server/index.md +++ b/docs/Encryption & KMS/kmip-server/index.md @@ -67,7 +67,7 @@ Flags: * `hostname`: Hostname of this KMIP server. * `root`: Required path to store KMIP objects. -* `certificate-ttl`: Optional. Server certificate TTL in days. Values must be `90` days or longer. Gateway `4.53.0` and later supports TTL values longer than one year, and the KMIP implementation does not define a smaller product-specific upper bound. +* `certificate-ttl`: Optional. Server certificate TTL in days. Values must be `90` days or longer. Gateway `4.53.0` and later supports TTL values longer than one year. * `expiration-event-in`: Optional. Number of days before expiration to notify. Repeat the flag to set multiple events, for example `--expiration-event-in 1 --expiration-event-in 5`. * `gateway-url[=http://localhost:8000]`: Akeyless Gateway URL. @@ -112,7 +112,7 @@ akeyless kmip-create-client \ Flags: * `name`: A unique name of the KMIP client. The name can include the path to the virtual folder where you want to create the new client, using slash `/` separators. If the folder does not exist, it will be created together with the client. -* `certificate-ttl`: Client certificate TTL in days. Values must be `90` days or longer. The KMIP implementation does not define a smaller product-specific upper bound. +* `certificate-ttl`: Client certificate TTL in days. Values must be `90` days or longer. * `expiration-event-in`: Optional. Number of days before expiration to notify. Repeat the flag to set multiple events, for example `--expiration-event-in 1 --expiration-event-in 5`. * `gateway-url[=http://localhost:8000]`: Akeyless Gateway URL (port `8000`). * `output-file-folder`: Folder path to save client certificate files locally (for example, `.` for current working dir). From 58d45809c584a3a16065c9e99f82d3ed21e284bd Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:16:30 -0600 Subject: [PATCH 08/21] DOCS-892: add ISI scanner updates and HashiVault rotated secret docs --- .../identity-and-secrets-intelligence.md | 6 +- .../account-settings/index.md | 2 +- .../rotated-secrets/_order.yaml | 1 + ...create-a-hashicorp-vault-rotated-secret.md | 71 +++++++++++++++++++ .../rotated-secrets/index.md | 1 + .../hc-vault-universal-secrets-connector.md | 2 + .../universal-secrets-connector/index.md | 14 ++-- 7 files changed, 88 insertions(+), 9 deletions(-) create mode 100644 docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md diff --git a/docs/AI Security/identity-and-secrets-intelligence.md b/docs/AI Security/identity-and-secrets-intelligence.md index 5b66325a0..539fb6cec 100644 --- a/docs/AI Security/identity-and-secrets-intelligence.md +++ b/docs/AI Security/identity-and-secrets-intelligence.md @@ -41,7 +41,11 @@ The current Inventory implementation exposes finding details for secret, identit The current Scanner implementation supports creating scanners, starting scans, stopping active scans, reviewing scan history, and navigating from a running scan directly to **Inventory**. -Current early-access scanner coverage includes GCP Scanner support and AWS Scanner support for cloud identities. +Current early-access scanner coverage includes: + +* **GCP Scanner** support, including enrichment of secret findings with last-access timestamps from Cloud Audit Logs when those logs are available in the scanned environment. +* **GCP Scanner** identity resolution support for group-member identities. +* **AWS Scanner** support for cloud identities, including scanner operation by way of AWS targets that use **Gateway Cloud Identity**. ## Operational Views diff --git a/docs/Advanced Functionality/account-settings/index.md b/docs/Advanced Functionality/account-settings/index.md index 3d572b809..d7a9b8644 100644 --- a/docs/Advanced Functionality/account-settings/index.md +++ b/docs/Advanced Functionality/account-settings/index.md @@ -70,7 +70,7 @@ To update the address information on the account, click on the pencil icons, upd #### Secret Versions -When enabled, this feature allows the user to choose the maximum number of versions of Static Secrets, Rotated Secrets, and Targets to keep in the account for a given item. To update it, click on the pencil icon, choose a number, and click the check mark to save. In addition, you can choose to **force** a new version on update when versions are enabled in the account. +When enabled, this feature allows the user to choose the maximum number of versions of Static Secrets, Rotated Secrets, and Targets to keep in the account for a given item and review version history from the item details view. To update it, click on the pencil icon, choose a number, and click the check mark to save. In addition, you can choose to **force** a new version on update when versions are enabled in the account. #### Delete Protection diff --git a/docs/Secrets Management/rotated-secrets/_order.yaml b/docs/Secrets Management/rotated-secrets/_order.yaml index a5e2b0508..6ef73c77d 100644 --- a/docs/Secrets Management/rotated-secrets/_order.yaml +++ b/docs/Secrets Management/rotated-secrets/_order.yaml @@ -3,6 +3,7 @@ - create-a-database-rotated-secret - create-a-docker-hub-rotated-secret - gcp-rotated-secret +- create-a-hashicorp-vault-rotated-secret - create-an-ldap-rotated-secret - linked-target-rotated-secret - openai-rotated-secret diff --git a/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md b/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md new file mode 100644 index 000000000..a15d50e03 --- /dev/null +++ b/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md @@ -0,0 +1,71 @@ +--- +title: HashiCorp Vault Rotated Secret +excerpt: '' +deprecated: false +hidden: false +metadata: + title: '' + description: '' + robots: index +next: + description: '' +--- +You can create a Rotated Secret for a HashiCorp Vault target when you want Akeyless to manage a rotated secret item stored in HashiCorp Vault. + +## Prerequisites + +* An [Akeyless Gateway](https://docs.akeyless.io/docs/gateway-overview). +* A [HashiCorp Vault Target](https://docs.akeyless.io/docs/hashicorp-vault-target) with permissions to create, delete, update, read, and list secrets. + +## Create a HashiCorp Vault Rotated Secret with the CLI + +To create a HashiCorp Vault Rotated Secret using the Akeyless CLI, run the following command: + +```shell +akeyless rotated-secret create hashi-vault \ +--name \ +--gateway-url 'https://:8000' \ +--target-name \ +--auto-rotate \ +--rotation-interval <1-365> +``` + +Where: + +* `name`: A unique name of the Rotated Secret. The name can include the path to the virtual folder where you want to create the new Rotated Secret, using slash `/` separators. If the folder does not exist, it will be created together with the Rotated Secret. + +* `gateway-url`: Akeyless Gateway URL (port `8000`). + +* `target-name`: The name of the [HashiCorp Vault Target](https://docs.akeyless.io/docs/hashicorp-vault-target) with which the Rotated Secret should be associated. + +* `auto-rotate`: Enable auto-rotation if you need to update the secret regularly. + +* `rotation-interval`: The number of days to wait between every automatic rotation (1-365). + +The HashiCorp Vault variant also supports the shared rotated-secret settings for protection keys, max versions, tags, and description. For the full parameter list, see the [CLI Reference - Rotated Secrets](https://docs.akeyless.io/docs/cli-reference-rotated-secrets#hashi-vault) section. + +## Create a HashiCorp Vault Rotated Secret in the Console + +1. Log in to the Akeyless Console, and go to **Items > New > Rotated Secret > HashiCorp Vault**. + +2. Define a **Name** of the Rotated Secret, and specify the **Location** as a path to the virtual folder where you want to create the new Rotated Secret, using slash `/` separators. If the folder does not exist, it will be created together with the Rotated Secret. + +3. Define the remaining settings as follows: + + * **Target:** Select an existing [HashiCorp Vault Target](https://docs.akeyless.io/docs/hashicorp-vault-target). + + * **Gateway:** Select the desired corresponding Gateway. + + * **Description:** Optional, enter a description of the Rotated Secret. + + * **Tags:** Optional. Select one or more tags for the Rotated Secret, or enter the name of a new tag to be added as part of the creation process. + + * **Protection Key:** Optional, select the key used to encrypt the secret value. + + * **Auto rotate:** Enable automatic rotation and define the rotation interval. + +4. Click **Finish**. + +## Working With Version History + +If secret versioning is enabled for the account, you can review the available versions for the rotated secret from the item details view. diff --git a/docs/Secrets Management/rotated-secrets/index.md b/docs/Secrets Management/rotated-secrets/index.md index 2c2166bfa..5ddf23e69 100644 --- a/docs/Secrets Management/rotated-secrets/index.md +++ b/docs/Secrets Management/rotated-secrets/index.md @@ -28,6 +28,7 @@ You can configure: * [Database Rotated Secret](https://docs.akeyless.io/docs/create-a-database-rotated-secret) * [Docker Hub Rotated Secret](https://docs.akeyless.io/docs/create-a-docker-hub-rotated-secret) * [GCP Rotated Secret](https://docs.akeyless.io/docs/gcp-rotated-secret) +* [HashiCorp Vault Rotated Secret](https://docs.akeyless.io/docs/create-a-hashicorp-vault-rotated-secret) * [LDAP Rotated Secret](https://docs.akeyless.io/docs/create-an-ldap-rotated-secret) * [Linked Target Rotated Secret](https://docs.akeyless.io/docs/linked-target-rotated-secret) * [Splunk Rotated Secret](https://docs.akeyless.io/docs/splunk-rotated-secret) diff --git a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md index 22e324e37..d9d5193b3 100644 --- a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md +++ b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md @@ -163,4 +163,6 @@ Once connected to a Target, you can access a Universal Secrets Connector in your More information and secret value can be viewed by selecting a specific secret, additionally, you will have the option to perform actions on the secret. +When the account has secret versioning enabled, the console can also show version history for supported secrets. For larger HashiCorp Vault structures, you can sync the contents of an entire folder by using the folder sync commands. + _Note:_ The **KV Secrets Engine v1** is not supported. Please use **KV Secrets Engine v2** when working with the Vault Universal Secrets Connector. diff --git a/docs/Universal Secret Connector/universal-secrets-connector/index.md b/docs/Universal Secret Connector/universal-secrets-connector/index.md index 52260c7ae..aa8f7e60d 100644 --- a/docs/Universal Secret Connector/universal-secrets-connector/index.md +++ b/docs/Universal Secret Connector/universal-secrets-connector/index.md @@ -17,7 +17,7 @@ When a user is granted `read` access to a **USC** item, they can act using the p Universal Secret Connector is also supported by the Akeyless [Kubernetes Injector](https://docs.akeyless.io/docs/akeyless-kubernetes-secrets-injector), allowing Kubernetes applications and workloads to access secrets and credentials sourced through USC securely. -After connecting to your Universal Secrets source, you can manage them from Akeyless, including viewing, adding, updating, deleting, and [syncing secrets](https://docs.akeyless.io/docs/sync-secret). The exact secret information that can be displayed in Akeyless varies between providers according to their unique attributes. +After connecting to your Universal Secrets source, you can manage them from Akeyless, including viewing, adding, updating, deleting, and [syncing secrets](https://docs.akeyless.io/docs/sync-secret). The exact secret information that can be displayed in Akeyless varies between providers according to their unique attributes. For HashiCorp Vault connectors, you can also review secret versions in the console and sync the contents of an entire folder to the connected USC. The **USC** solution operates in a governance loop model. It automatically detects and reflects changes to your secrets, whether those changes are made in Akeyless or in the remote secret management system. Akeyless does not store a copy of external secrets; therefore, data residency and security policies remain unchanged. The USC reflects updates in real time and does not require any configuration changes on the remote secret management endpoint. @@ -27,17 +27,17 @@ Setting up Universal Secret Connector requires the **Defaults** permission on th Akeyless currently supports creating Universal Secrets Connectors for the following services: -- [AWS Universal Secrets Connector](https://docs.akeyless.io/docs/aws-universal-secrets-connector) +* [AWS Universal Secrets Connector](https://docs.akeyless.io/docs/aws-universal-secrets-connector) -- [GCP Universal Secrets Connector](https://docs.akeyless.io/docs/gcp-universal-secrets-connector) +* [GCP Universal Secrets Connector](https://docs.akeyless.io/docs/gcp-universal-secrets-connector) -- [Azure Universal Secrets Connector](https://docs.akeyless.io/docs/azure-universal-secrets-connector) +* [Azure Universal Secrets Connector](https://docs.akeyless.io/docs/azure-universal-secrets-connector) -- [Kubernetes Universal Secrets Connector](https://docs.akeyless.io/docs/kubernetes-universal-secrets-connector) +* [Kubernetes Universal Secrets Connector](https://docs.akeyless.io/docs/kubernetes-universal-secrets-connector) -- [HashiCorp Vault Universal Secret Connector](https://docs.akeyless.io/docs/hc-vault-universal-secrets-connector) +* [HashiCorp Vault Universal Secret Connector](https://docs.akeyless.io/docs/hc-vault-universal-secrets-connector) -- [GitHub Universal Secret Connector](https://docs.akeyless.io/docs/github-universal-secret-connector) +* [GitHub Universal Secret Connector](https://docs.akeyless.io/docs/github-universal-secret-connector) To view all your Universal Secret Connectors, log in to the **Console** then navigate to **Items**, then **Universal Secrets Connector**. From 0111f88c06262aca5ea573a641cfc06c79821e32 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:24:10 -0600 Subject: [PATCH 09/21] DOCS-892: refine scanner/caching text and structure updates --- .../identity-and-secrets-intelligence.md | 3 +- .../gateway-caching/proactive-caching.md | 9 +++- ...create-a-hashicorp-vault-rotated-secret.md | 44 +++++++++---------- .../hc-vault-universal-secrets-connector.md | 5 ++- 4 files changed, 35 insertions(+), 26 deletions(-) diff --git a/docs/AI Security/identity-and-secrets-intelligence.md b/docs/AI Security/identity-and-secrets-intelligence.md index 539fb6cec..421de15f3 100644 --- a/docs/AI Security/identity-and-secrets-intelligence.md +++ b/docs/AI Security/identity-and-secrets-intelligence.md @@ -43,8 +43,7 @@ The current Scanner implementation supports creating scanners, starting scans, s Current early-access scanner coverage includes: -* **GCP Scanner** support, including enrichment of secret findings with last-access timestamps from Cloud Audit Logs when those logs are available in the scanned environment. -* **GCP Scanner** identity resolution support for group-member identities. +* **GCP Scanner** support, including enrichment of secret findings with last-access timestamps from Cloud Audit Logs (when those logs are available in the scanned environment) and identity resolution for group-member identities. * **AWS Scanner** support for cloud identities, including scanner operation by way of AWS targets that use **Gateway Cloud Identity**. ## Operational Views diff --git a/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md b/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md index 1ea573d02..350c40ddb 100644 --- a/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md +++ b/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md @@ -48,10 +48,14 @@ All `list-items` and `get-value` calls during warm-up are issued under this iden 429 responses can occur when startup warm-up fan-out exhausts the per-access-ID limit window. The recommended implementation handles this automatically with a shared backoff gate: -* Applies a shared backoff delay across all workers on 429. +* Applies a shared backoff delay across proactive workers and RBAC refresh calls on 429. * Honors `Retry-After` or `will be released in ` headers when available. * Retries up to `PROACTIVE_CACHE_WORKERS × 10` attempts before giving up on a cycle. +### Leadership-Loss Handling + +In the recommended implementation, proactive workers are tied to the current leadership lease. When leadership is lost, active workers stop gracefully, the current cycle drains, and the next leadership cycle starts with a fresh jobs queue to avoid stale backlog carryover. + To further reduce rate-limit risk: * Reduce `PROACTIVE_CACHE_WORKERS` to lower burst concurrency. @@ -115,6 +119,9 @@ For the full key reference, see [Helm Values Reference](https://docs.akeyless.io * `CACHE_TTL`: Influences cache time-to-live and full-fetch cadence. Default: `60`. * `PROACTIVE_CACHE_DUMP_INTERVAL`: Sets the periodic secure cache backup interval in minutes for the legacy implementation. This variable has no effect when `NEW_PROACTIVE_CACHE_ENABLE=true`. For most tuning decisions on the legacy implementation, prefer `PROACTIVE_CACHE_MINIMUM_FETCHING_TIME`; adjust `PROACTIVE_CACHE_DUMP_INTERVAL` only when you need to change backup cadence specifically. +> ℹ️ **Note:** +> If Gateway starts without reachable SaaS configuration and initializes cache behavior from environment values, it assumes `NEW_PROACTIVE_CACHE_ENABLE=true` for startup continuity. + For Redis topology choices, see [Cluster Cache (Standalone)](https://docs.akeyless.io/docs/cluster-cache-standalone) and [Cluster Cache High Availability (HA)](https://docs.akeyless.io/docs/cluster-cache-ha). ## Migrating from Legacy Proactive Caching diff --git a/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md b/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md index a15d50e03..74616389c 100644 --- a/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md +++ b/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md @@ -17,6 +17,28 @@ You can create a Rotated Secret for a HashiCorp Vault target when you want Akeyl * An [Akeyless Gateway](https://docs.akeyless.io/docs/gateway-overview). * A [HashiCorp Vault Target](https://docs.akeyless.io/docs/hashicorp-vault-target) with permissions to create, delete, update, read, and list secrets. +## Create a HashiCorp Vault Rotated Secret in the Console + +1. Log in to the Akeyless Console, and go to **Items > New > Rotated Secret > HashiCorp Vault**. + +2. Define a **Name** of the Rotated Secret, and specify the **Location** as a path to the virtual folder where you want to create the new Rotated Secret, using slash `/` separators. If the folder does not exist, it will be created together with the Rotated Secret. + +3. Define the remaining settings as follows: + + * **Target:** Select an existing [HashiCorp Vault Target](https://docs.akeyless.io/docs/hashicorp-vault-target). + + * **Gateway:** Select the desired corresponding Gateway. + + * **Description:** Optional, enter a description of the Rotated Secret. + + * **Tags:** Optional. Select one or more tags for the Rotated Secret, or enter the name of a new tag to be added as part of the creation process. + + * **Protection Key:** Optional, select the key used to encrypt the secret value. + + * **Auto rotate:** Enable automatic rotation and define the rotation interval. + +4. Click **Finish**. + ## Create a HashiCorp Vault Rotated Secret with the CLI To create a HashiCorp Vault Rotated Secret using the Akeyless CLI, run the following command: @@ -44,28 +66,6 @@ Where: The HashiCorp Vault variant also supports the shared rotated-secret settings for protection keys, max versions, tags, and description. For the full parameter list, see the [CLI Reference - Rotated Secrets](https://docs.akeyless.io/docs/cli-reference-rotated-secrets#hashi-vault) section. -## Create a HashiCorp Vault Rotated Secret in the Console - -1. Log in to the Akeyless Console, and go to **Items > New > Rotated Secret > HashiCorp Vault**. - -2. Define a **Name** of the Rotated Secret, and specify the **Location** as a path to the virtual folder where you want to create the new Rotated Secret, using slash `/` separators. If the folder does not exist, it will be created together with the Rotated Secret. - -3. Define the remaining settings as follows: - - * **Target:** Select an existing [HashiCorp Vault Target](https://docs.akeyless.io/docs/hashicorp-vault-target). - - * **Gateway:** Select the desired corresponding Gateway. - - * **Description:** Optional, enter a description of the Rotated Secret. - - * **Tags:** Optional. Select one or more tags for the Rotated Secret, or enter the name of a new tag to be added as part of the creation process. - - * **Protection Key:** Optional, select the key used to encrypt the secret value. - - * **Auto rotate:** Enable automatic rotation and define the rotation interval. - -4. Click **Finish**. - ## Working With Version History If secret versioning is enabled for the account, you can review the available versions for the rotated secret from the item details view. diff --git a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md index d9d5193b3..e224356a2 100644 --- a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md +++ b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md @@ -163,6 +163,9 @@ Once connected to a Target, you can access a Universal Secrets Connector in your More information and secret value can be viewed by selecting a specific secret, additionally, you will have the option to perform actions on the secret. -When the account has secret versioning enabled, the console can also show version history for supported secrets. For larger HashiCorp Vault structures, you can sync the contents of an entire folder by using the folder sync commands. +Additional capabilities include: + +* When account-level secret versioning is enabled, the console can show version history for supported secrets. +* For larger HashiCorp Vault structures, you can sync the contents of an entire folder by using the folder sync commands. _Note:_ The **KV Secrets Engine v1** is not supported. Please use **KV Secrets Engine v2** when working with the Vault Universal Secrets Connector. From 7a9b54ed18cb0ba367cdcb6f84b75d3425d7f368 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:27:43 -0600 Subject: [PATCH 10/21] DOCS-892: add AI chat history search, agent dynamic secret, and MySQL connect flags docs --- docs/AI Security/akeyless-ai-insight.md | 4 +++ docs/Advanced Functionality/akeyless-agent.md | 14 ++++++++ .../cli-reference-connect.md | 35 +++++++++++++++++++ .../sra-admin-guides/sra-akeyless-connect.md | 14 ++++++++ 4 files changed, 67 insertions(+) diff --git a/docs/AI Security/akeyless-ai-insight.md b/docs/AI Security/akeyless-ai-insight.md index 4d6d8770e..df86290b6 100644 --- a/docs/AI Security/akeyless-ai-insight.md +++ b/docs/AI Security/akeyless-ai-insight.md @@ -188,9 +188,13 @@ To test AI Insights in the Akeyless Console, follow these steps: 2. Navigate to AI Insights. 3. Start a chat session 4. Ask a natural language question. +5. Open the chat list in the left panel to review previous chats. +6. Use **Search chats** to find a specific chat in your history. ![Illustration for: 2. Navigate to AI Insights. 3. Start a chat session 4. Ask a natural language question.](https://files.readme.io/9214bc7c65691ab90764917b7da86d69a6be792b3c494b6289b338aabf90f851-chatInteraction.png) +AI Insights stores chat sessions per gateway selection so you can return to prior conversations and search them by title. + ## Troubleshooting | Issue | Resolution | diff --git a/docs/Advanced Functionality/akeyless-agent.md b/docs/Advanced Functionality/akeyless-agent.md index c26b3c30d..c8d4f977d 100644 --- a/docs/Advanced Functionality/akeyless-agent.md +++ b/docs/Advanced Functionality/akeyless-agent.md @@ -18,6 +18,7 @@ The supported items that can be fetched using the Agent are: * [Static Secrets](https://docs.akeyless.io/docs/static-secrets#/) * [Rotated Secrets](https://docs.akeyless.io/docs/rotated-secrets#/) +* [Dynamic Secrets](https://docs.akeyless.io/docs/dynamic-secrets) * [SSH Certificates](https://docs.akeyless.io/docs/sra-ssh-certificates#/) * [PKI Certificates](https://docs.akeyless.io/docs/certificate-lifecycle-management#/) @@ -55,6 +56,10 @@ destination = "path_to/static.txt" source = "path_to/rotated.tmpl" destination = "path_to/rotated.txt" +[[template]] +source = "path_to/dynamic.tmpl" +destination = "path_to/dynamic.txt" + [[template]] source = "path_to/ssh_cert.tmpl" destination = "path_to/ssh_cert.txt" @@ -113,6 +118,15 @@ password={{ .Data.Password }} {{- end -}} ``` +### Dynamic Secret + +```shell +{{- with dynamicSecret "/my_dynamic_secret" -}} +username={{ .Data.user }} +password={{ .Data.password }} +{{- end -}} +``` + ### SSH Certificate ```shell ssh_cert.tmpl diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-connect.md b/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-connect.md index 83be70622..a8e038bef 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-connect.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-connect.md @@ -62,6 +62,21 @@ akeyless connect [flags] `-C, --command`: Command to execute on the target (non-interactive mode). Example: `-C='ls -al'` +For MySQL targets, `-C` also supports pre-connect MySQL client flags using the `pre:` prefix. + +Supported pre-connect MySQL flags: + +* `--disable-auto-rehash` +* `-A` (short alias of `--disable-auto-rehash`) + +You can combine pre-connect flags and post-connect payload in one command: + +* `-C "pre:-A; post:SELECT NOW();"` + +You can also pass only the pre-connect flag and continue in interactive mode: + +* `-C "pre:--disable-auto-rehash"` + `--k8s-tunnel`: Create an SSH tunnel with a Kubernetes proxy on a specific local port (`1024`–`65535`). Overrides `--tunnel` and `--command` when set `-V, --ssh-version`: Print the local SSH client version and exit @@ -101,6 +116,26 @@ akeyless connect \ -g http://my-gw.example.com:8000 ``` +MySQL with an interactive pre-connect flag: + +```shell +akeyless connect \ + -t my-mysql.example.com:3306 \ + -n /dynamic-secrets/my-mysql \ + -g http://my-gw.example.com:8000 \ + -C "pre:--disable-auto-rehash" +``` + +MySQL with pre-connect and post-connect payload in a single command: + +```shell +akeyless connect \ + -t my-mysql.example.com:3306 \ + -n /dynamic-secrets/my-mysql \ + -g http://my-gw.example.com:8000 \ + -C "pre:-A; post:SELECT NOW();" +``` + Open a Kubernetes tunnel on local port 8443: ```shell diff --git a/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md b/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md index 9adb8c3cc..3e40478b9 100644 --- a/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md +++ b/docs/Secure Remote Access/sra-admin-guides/sra-akeyless-connect.md @@ -219,6 +219,20 @@ akeyless connect -t :3306 -g -n " > The `connect` command supports MySQL interactive flags. For the current supported options, run `akeyless connect -h`. +MySQL interactive flags are passed through the `-C` argument using the `pre:` prefix. + +Example with the long-form MySQL flag: + +```shell +akeyless connect -t :3306 -g -n "" -C "pre:--disable-auto-rehash" +``` + +Example with the short alias (`-A`) plus a post-connect SQL statement: + +```shell +akeyless connect -t :3306 -g -n "" -C "pre:-A; post:SELECT NOW();" +``` + ### Amazon EKS ```shell From 4391e11c0ffeaabe2e2b3926c5bf137c8251c083 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:29:18 -0600 Subject: [PATCH 11/21] DOCS-892: clarify account-level secret versioning scope and USC provider variance --- docs/Advanced Functionality/account-settings/index.md | 2 +- .../hc-vault-universal-secrets-connector.md | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/Advanced Functionality/account-settings/index.md b/docs/Advanced Functionality/account-settings/index.md index d7a9b8644..9f2ea8caa 100644 --- a/docs/Advanced Functionality/account-settings/index.md +++ b/docs/Advanced Functionality/account-settings/index.md @@ -70,7 +70,7 @@ To update the address information on the account, click on the pencil icons, upd #### Secret Versions -When enabled, this feature allows the user to choose the maximum number of versions of Static Secrets, Rotated Secrets, and Targets to keep in the account for a given item and review version history from the item details view. To update it, click on the pencil icon, choose a number, and click the check mark to save. In addition, you can choose to **force** a new version on update when versions are enabled in the account. +When enabled, this account-level feature allows the user to choose the maximum number of versions of Static Secrets, Rotated Secrets, and Targets to keep in the account for a given item and review version history from the item details view. This capability is not limited to HashiCorp-related workflows. To update it, click on the pencil icon, choose a number, and click the check mark to save. In addition, you can choose to **force** a new version on update when versions are enabled in the account. #### Delete Protection diff --git a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md index e224356a2..ae2d4f78c 100644 --- a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md +++ b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md @@ -165,7 +165,8 @@ More information and secret value can be viewed by selecting a specific secret, Additional capabilities include: -* When account-level secret versioning is enabled, the console can show version history for supported secrets. +* Account-level secret versioning applies across Akeyless item types such as Static Secrets, Rotated Secrets, and Targets, and is not specific to HashiCorp integrations. +* For USC-backed external secrets, the version details shown in the console can vary by provider and by the metadata and history returned by that provider. * For larger HashiCorp Vault structures, you can sync the contents of an entire folder by using the folder sync commands. _Note:_ The **KV Secrets Engine v1** is not supported. Please use **KV Secrets Engine v2** when working with the Vault Universal Secrets Connector. From a01202ed2ac16f1015c0d362eb729175d8075ff0 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:33:48 -0600 Subject: [PATCH 12/21] DOCS-892: integrate caching, audit UID params, and gateway scoped visibility updates --- .../index.md | 2 +- .../audit-logs/index.md | 35 ++++++++++--------- .../gateway-access-permissions-reference.md | 2 ++ .../gateway-caching/index.md | 2 ++ 4 files changed, 23 insertions(+), 18 deletions(-) diff --git a/docs/Accessing Akeyless/access-and-authentication-methods/index.md b/docs/Accessing Akeyless/access-and-authentication-methods/index.md index ead72cfe0..ddb20a709 100644 --- a/docs/Accessing Akeyless/access-and-authentication-methods/index.md +++ b/docs/Accessing Akeyless/access-and-authentication-methods/index.md @@ -62,7 +62,7 @@ The following optional features are available across Authentication Methods: * **Expiration Date:** Select an access expiration date. This parameter is optional. Leave it empty for access to continue without an expiration date. * **Allowed Client IPs:** Enter a comma-separated list of CIDR blocks from which the client can issue calls to the proxy. By "client," we mean cURL, SDKs, and so on. This parameter is optional. Leave it empty for unrestricted access. * **Allowed Trusted Gateway IPs:** Comma-separated CIDR blocks. If specified, the Gateway using this IP range will be trusted to forward the original client IP. If empty, the Gateway's IP address will be used. -* **Audit Log Sub-Claims:** Include the following sub-claims values in Audit Logs. +* **Audit Log Sub-Claims:** Include selected token sub-claims in Audit Logs (for example, `email`, `username`, or `uid_comment` for UID token flows). * **JWT TTL (in minutes):** The time span from authentication to JWT expiration. * **Allowed Client Type:** Select the allowed client types that will be authorized to use this authentication method. Multiple options can be selected. For example, `CLI`, `Web UI`, `Extension`, `Mobile`, `Gateway Admin`, or `SDK`. * **Delete Protection:** Enable this option to protect the authentication method from accidental deletion. diff --git a/docs/Advanced Functionality/audit-logs/index.md b/docs/Advanced Functionality/audit-logs/index.md index 4cae62643..48f68d48e 100644 --- a/docs/Advanced Functionality/audit-logs/index.md +++ b/docs/Advanced Functionality/audit-logs/index.md @@ -27,9 +27,7 @@ Akeyless log auditing is important for cybersecurity because it provides records When using the console, you can navigate to the **Audit Logs** tab to view logs in the following format: -![](https://files.readme.io/7ec054a7174c4de9426983fab4b975d5eeee76db3c232f68c249ee7beea90113-Screenshot_2026-06-11_at_12.21.37.png) - -
+![Audit Logs view in the Akeyless Console.](https://files.readme.io/7ec054a7174c4de9426983fab4b975d5eeee76db3c232f68c249ee7beea90113-Screenshot_2026-06-11_at_12.21.37.png) These logs show you the time of the described action, what it was, whether it was successful or unsuccessful (status codes in the four hundreds means error), the client performing it, what IP it was performed from, and additional parameter tags such as access type or product type. @@ -40,20 +38,23 @@ You can filter your logs based on any of these rubrics or tags inside the Akeyle Another way to view your logs is to forward them in their raw form to tools such as Splunk, Logz.io, and so on. The logs will show up as a line of text, from which you can read the following information: -| Log Line | Description | -| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `Timestamp` | The log will start with a timestamp string in the format of Date `T` Time Timezone. | -| `account_id` | Account ID. | -| `access_id` | Access ID. | -| `action` | The type of action performed, for example, list items, create item, get item, and so on. A list of common log items can be found [here](https://docs.akeyless.io/docs/log-actions) | -| `item_type` | If the action was item specific, like create item, the item type will be listed here. | -| `status` | Standard HTTP status code of the following types, Informational responses (100–199), Successful responses (200–299), Redirection messages (300–399), or Client error responses (400–499). | -| `remote_addr` | The IP address from which the action was performed. | -| `duration` | The duration of the action in milliseconds. | -| `request_parameters` | More details about the action, for example, the name and details of a dynamic secret if one was fetched. | -| `unique_id` | Identifier for the specific user ID under the account (mostly relevant for human-to-machine auth methods). | -| `access_type` | [Authentication Method](https://docs.akeyless.io/docs/access-and-authentication-methods) type from which the action was performed. | -| `product` | Which Akeyless product does this log concern. For example, this could be **Secrets Management**, **Secure Remote Access**, or **Password Management** etc. | +| Log Line | Description | +| --- | --- | +| `Timestamp` | The log starts with a timestamp string in Date `T` Time Timezone format. | +| `account_id` | Account ID. | +| `access_id` | Access ID. | +| `action` | Type of action performed, such as list items, create item, or get item. For common actions, see [Log Actions](https://docs.akeyless.io/docs/log-actions). | +| `item_type` | If the action is item-specific (for example, create item), the item type is listed. | +| `status` | Standard HTTP status code: informational (`100`-`199`), success (`200`-`299`), redirection (`300`-`399`), or client error (`400`-`499`). | +| `remote_addr` | IP address from which the action was performed. | +| `duration` | Duration of the action in milliseconds. | +| `request_parameters` | Additional action details, such as dynamic secret details when a value is fetched. | +| `unique_id` | Identifier for the specific user under the account (mostly relevant for human-to-machine auth methods). | +| `client_sub_claims` | Sub-claims captured for the authenticated client when configured on the authentication method (for example, `email`, `username`, and `uid_comment` for UID token flows). | +| `access_type` | [Authentication Method](https://docs.akeyless.io/docs/access-and-authentication-methods) type used for the action. | +| `product` | Akeyless product associated with the log, such as **Secrets Management**, **Secure Remote Access**, or **Password Management**. | + +To enrich Audit Logs with additional token parameters, configure **Audit Log Sub-Claims** on the relevant authentication method. For UID tokens, `uid_comment` is available as a sub-claim key. ## Tutorial diff --git a/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md b/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md index f25a8a117..12db18468 100644 --- a/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md +++ b/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md @@ -57,6 +57,8 @@ Console behavior note: in the current custom permission multi-select UI, `admin` Administrative operations for Gateway allowed access management require `admin` permission. +Gateway visibility in the Console is permission-scoped. Users with Gateway access permissions can view the Gateway in the Console only when their role includes Gateway administrative scope (`scope` or `all`). + For item-related operations (`targets`, `classic_keys`, `dynamic_secret`, `rotated_secret`, and `rotate_secret_value`), access is evaluated in two scopes: 1. Gateway allowed access permission for the relevant component. diff --git a/docs/Akeyless Gateway/configure-gateway/gateway-caching/index.md b/docs/Akeyless Gateway/configure-gateway/gateway-caching/index.md index 888e3609e..5c7458815 100644 --- a/docs/Akeyless Gateway/configure-gateway/gateway-caching/index.md +++ b/docs/Akeyless Gateway/configure-gateway/gateway-caching/index.md @@ -37,6 +37,8 @@ Use this starting decision flow: For planning guidance and tradeoffs, see [Gateway Best Practices: Caching strategy considerations](https://docs.akeyless.io/docs/gateway-best-practices#caching-strategy-considerations). +For proactive deployments, use the recommended implementation (`NEW_PROACTIVE_CACHE_ENABLE=true`) to get shared 429 backoff handling and leadership-cycle worker restart behavior. For details, see [Proactive Caching](https://docs.akeyless.io/docs/proactive-caching). + For Kubernetes proactive cache sizing guidance, see [Gateway Best Practices: Resource planning for Kubernetes proactive cache](https://docs.akeyless.io/docs/gateway-best-practices#resource-planning-for-kubernetes-proactive-cache). ## Configure in Gateway UI From 47d93d45a55dfc3dc915e616048929095c9b5a9e Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:38:49 -0600 Subject: [PATCH 13/21] DOCS-892: add reverse-rbac SRA/ARA scope and SFTP/list-only updates --- docs/Accessing Akeyless/rbac/index.md | 9 +++++++++ .../cli-reference/cli-reference-access-roles.md | 8 +++++--- .../cli-reference/cli-reference-rotated-secrets.md | 5 +++++ .../rotated-secrets/create-a-database-rotated-secret.md | 4 ++++ .../sra-user-guides/sra-akeyless-scp.md | 2 ++ 5 files changed, 25 insertions(+), 3 deletions(-) diff --git a/docs/Accessing Akeyless/rbac/index.md b/docs/Accessing Akeyless/rbac/index.md index 09a7d9a12..39cb17249 100644 --- a/docs/Accessing Akeyless/rbac/index.md +++ b/docs/Accessing Akeyless/rbac/index.md @@ -140,6 +140,15 @@ The following **Administrative Rules** can be set: * `Usage Reports` +## Reverse RBAC Review Coverage + +Reverse RBAC can be used to review who has access to object types beyond Items and Targets, including Secure Remote Access and Agentic Runtime Authority paths. + +Use the CLI `reverse-rbac` command with: + +* `--type sra` for Secure Remote Access rules +* `--type ara` for Agentic Runtime Authority rules + ## Event Center Rules You can define which events users are allowed to view based on their account permissions. diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-access-roles.md b/docs/Integrations & Plugins/cli-reference/cli-reference-access-roles.md index 141f57ff6..e5e0eaf43 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-access-roles.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-access-roles.md @@ -70,7 +70,7 @@ akeyless create-role --name `--isi-access`: Allow this role to access **Identity & Secrets Intelligence**. Currently only `none`, `scoped`, and `all` values are supported. For details, see [Identity and Secrets Intelligence](https://docs.akeyless.io/docs/identity-and-secrets-intelligence). -`--reverse-rbac-access`: Allow this role to view Reverse RBAC. Supported values: '`own`', '`all`'. +`--reverse-rbac-access`: Allow this role to view Reverse RBAC. Supported values: '`scoped`', '`all`'. `description`: Description of the object @@ -212,7 +212,9 @@ akeyless reverse-rbac \ `-p, --path`: **Required**, Path to an object -`-t, --type`: **Required**, Type of object (`item`, `am`, `role`, `target`) +`-t, --type`: **Required**, Type of object (`item`, `am`, `role`, `target`, `sra`, `ara`) + +Use `--type sra` to review Secure Remote Access rule access, and `--type ara` to review Agentic Runtime Authority rule access. ## `set-role-rule` @@ -295,7 +297,7 @@ akeyless update-role -n \ `--isi-access`: Allow this role to access **Identity & Secrets Intelligence**. Currently only `none`, `scoped`, and `all` values are supported. For details, see [Identity and Secrets Intelligence](https://docs.akeyless.io/docs/identity-and-secrets-intelligence). -`--reverse-rbac-access`: Allow this role to view Reverse RBAC. Supported values: '`own`', '`all`'. +`--reverse-rbac-access`: Allow this role to view Reverse RBAC. Supported values: '`scoped`', '`all`'. `--description`: Description of the object diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-rotated-secrets.md b/docs/Integrations & Plugins/cli-reference/cli-reference-rotated-secrets.md index 5a89a7fc1..b962dddf3 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-rotated-secrets.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-rotated-secrets.md @@ -66,6 +66,11 @@ Commands to create a Rotated Secret These flags are used by multiple `rotated-secret create` and `rotated-secret update` subcommands. +Permission behavior: + +* For credentials-based rotators (for example, `password` rotator flows using `use-user-creds` or `use-target-creds`), creating the rotated secret supports list-only permissions on the associated target. +* For `target` rotator flows, read and update permissions on the target are still required. + `--grace-rotation-timing[=after]`: Controls whether graceful rotation creates the replacement credential before or after the old credential is removed. Supported values are `before` and `after`. `--lock-during-sra-session`: Lock this rotated secret for read and update while a Secure Remote Access (SRA) session is active. diff --git a/docs/Secrets Management/rotated-secrets/create-a-database-rotated-secret.md b/docs/Secrets Management/rotated-secrets/create-a-database-rotated-secret.md index c57c5b890..16977e3e6 100644 --- a/docs/Secrets Management/rotated-secrets/create-a-database-rotated-secret.md +++ b/docs/Secrets Management/rotated-secrets/create-a-database-rotated-secret.md @@ -109,6 +109,10 @@ You can find the complete list of parameters for this command in the [CLI Refere * **Rotator type:** Determines the rotator type: * **Password**: Rotates the password defined inside the Rotated Secret item. * **Target**: Rotates the password defined inside the [Database Target](https://docs.akeyless.io/docs/database-targets) item. + + > 👍 Note + > + > For credentials-based rotation flows (for example, **Password** rotator with either **User credentials** or **Target credentials**), creating the Rotated Secret supports list-only permissions on the associated target. * **Username:** Defines the DB username which password should be rotated. * **Password:** Defines the password to rotate. diff --git a/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md b/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md index 226b5516b..efc0667e1 100644 --- a/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md +++ b/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md @@ -14,6 +14,8 @@ Use this page to transfer files securely through Akeyless Secure Remote Access ( For current deployments, use `akeyless file upload` and `akeyless file download`, which are built into the Akeyless CLI. +These commands use SFTP as the transfer protocol, replacing legacy SCP-style transfer flows for improved reliability and transfer performance. + This page also includes legacy `akeyless-scp` guidance for existing automation that still depends on the script. ## Akeyless File Transfer From 6432057895adc360d46915e0dfcfe4f05375e8b8 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:40:43 -0600 Subject: [PATCH 14/21] DOCS-892: align account settings, audit fields, and gateway caching guidance --- docs/Advanced Functionality/account-settings/index.md | 2 +- docs/Advanced Functionality/audit-logs/index.md | 3 +++ docs/Akeyless Gateway/gateway-best-practices.md | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/Advanced Functionality/account-settings/index.md b/docs/Advanced Functionality/account-settings/index.md index 9f2ea8caa..64c5db089 100644 --- a/docs/Advanced Functionality/account-settings/index.md +++ b/docs/Advanced Functionality/account-settings/index.md @@ -70,7 +70,7 @@ To update the address information on the account, click on the pencil icons, upd #### Secret Versions -When enabled, this account-level feature allows the user to choose the maximum number of versions of Static Secrets, Rotated Secrets, and Targets to keep in the account for a given item and review version history from the item details view. This capability is not limited to HashiCorp-related workflows. To update it, click on the pencil icon, choose a number, and click the check mark to save. In addition, you can choose to **force** a new version on update when versions are enabled in the account. +When enabled, this account-level feature allows the user to choose the maximum number of versions of Static Secrets, Rotated Secrets, and Targets to keep in the account for a given item and review version history from the item details view. To update it, click on the pencil icon, choose a number, and click the check mark to save. In addition, you can choose to **force** a new version on update when versions are enabled in the account. #### Delete Protection diff --git a/docs/Advanced Functionality/audit-logs/index.md b/docs/Advanced Functionality/audit-logs/index.md index 48f68d48e..fd19671d1 100644 --- a/docs/Advanced Functionality/audit-logs/index.md +++ b/docs/Advanced Functionality/audit-logs/index.md @@ -41,14 +41,17 @@ The logs will show up as a line of text, from which you can read the following i | Log Line | Description | | --- | --- | | `Timestamp` | The log starts with a timestamp string in Date `T` Time Timezone format. | +| `seq_num` | Per-account sequence number used to preserve event ordering in audit logs. | | `account_id` | Account ID. | | `access_id` | Access ID. | +| `component` | Service component that emitted the audit event (for example, `microservices/uam`). | | `action` | Type of action performed, such as list items, create item, or get item. For common actions, see [Log Actions](https://docs.akeyless.io/docs/log-actions). | | `item_type` | If the action is item-specific (for example, create item), the item type is listed. | | `status` | Standard HTTP status code: informational (`100`-`199`), success (`200`-`299`), redirection (`300`-`399`), or client error (`400`-`499`). | | `remote_addr` | IP address from which the action was performed. | | `duration` | Duration of the action in milliseconds. | | `request_parameters` | Additional action details, such as dynamic secret details when a value is fetched. | +| `scope_params` | Optional scoped-access suffix appended to some logs for exact scope matching (for example, item, role, auth method, target, event forwarder, and client auth scopes). | | `unique_id` | Identifier for the specific user under the account (mostly relevant for human-to-machine auth methods). | | `client_sub_claims` | Sub-claims captured for the authenticated client when configured on the authentication method (for example, `email`, `username`, and `uid_comment` for UID token flows). | | `access_type` | [Authentication Method](https://docs.akeyless.io/docs/access-and-authentication-methods) type used for the action. | diff --git a/docs/Akeyless Gateway/gateway-best-practices.md b/docs/Akeyless Gateway/gateway-best-practices.md index 8ae147b62..e6fdbe66d 100644 --- a/docs/Akeyless Gateway/gateway-best-practices.md +++ b/docs/Akeyless Gateway/gateway-best-practices.md @@ -141,6 +141,7 @@ Caching is optional and should be enabled based on business continuity, performa * Consider enabling Gateway caching to improve resilience during temporary SaaS connectivity interruptions and to reduce latency for repeated reads. * Consider enabling proactive cache when read performance and reduced first-read latency are priorities. +* For proactive cache, prefer the recommended implementation (`NEW_PROACTIVE_CACHE_ENABLE=true`) to get shared `429` backoff handling and leadership-cycle worker restart behavior. * Consider cluster cache when running multiple Gateway instances that should share cache state. * Evaluate security and operational tradeoffs before enabling caching: * Operational benefits: improved continuity, lower read latency, and reduced repeated upstream calls. From 5d4bb02340b1fc67c18877a66726ce221a719895 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:44:00 -0600 Subject: [PATCH 15/21] DOCS-892: document MVG folder sync commands and RBAC CLI cross-link --- docs/Accessing Akeyless/rbac/index.md | 2 + ...i-reference-universal-secrets-connector.md | 68 +++++++++++++++++++ .../sync-secret/index.md | 22 ++++++ .../hc-vault-universal-secrets-connector.md | 22 ++++++ 4 files changed, 114 insertions(+) diff --git a/docs/Accessing Akeyless/rbac/index.md b/docs/Accessing Akeyless/rbac/index.md index 39cb17249..df4fd7503 100644 --- a/docs/Accessing Akeyless/rbac/index.md +++ b/docs/Accessing Akeyless/rbac/index.md @@ -144,6 +144,8 @@ The following **Administrative Rules** can be set: Reverse RBAC can be used to review who has access to object types beyond Items and Targets, including Secure Remote Access and Agentic Runtime Authority paths. +For command syntax and full parameter details, see the [CLI Reference - Access Roles reverse-rbac command](https://docs.akeyless.io/docs/cli-reference-access-roles#reverse-rbac). + Use the CLI `reverse-rbac` command with: * `--type sra` for Secure Remote Access rules diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md b/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md index 97b12ed10..d9d847005 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md @@ -130,6 +130,74 @@ akeyless usc create \ `--selected-repositories`: Explicit list of GitHub repositories selected for this operation +## Folder Sync Commands (MVG) + +Use these commands to sync entire folder contents through Universal Secrets Connector (for example, HashiCorp Vault USC in MVG workflows). + +### `folder-sync` + +Sync folder secrets by creating or updating sync associations for items in a folder. + +#### Usage + +```shell +akeyless folder-sync \ +--name \ +--usc-name +``` + +#### Flags + +`-n, --name`: **Required**, folder name + +`--usc-name`: Universal Secrets Connector name. If omitted, all attached USCs for the folder are processed. + +`--namespace`: Vault namespace (HashiCorp Vault targets) + +`--engine-name`: HashiCorp Vault engine name prefix (must end with `/`) + +`--delete-remote`: Delete the remote secret as part of sync handling when relevant + +`-u, --gateway-url[=http://localhost:8000]`: API Gateway URL (Configuration Management port) + +### `folder-sync-all` + +Trigger sync for all USC associations under a folder. + +#### Usage + +```shell +akeyless folder-sync-all --name +``` + +#### Flags + +`-n, --name`: **Required**, folder name + +### `folder-delete-sync` + +Delete folder sync associations. + +#### Usage + +```shell +akeyless folder-delete-sync \ +--name \ +--usc-name +``` + +#### Flags + +`-n, --name`: **Required**, folder name + +`--usc-name`: **Required**, Universal Secrets Connector name + +`--remote-secret-name`: Optional remote secret name filter when multiple syncs exist under the same USC + +`--delete-from-usc[=false]`: Delete secrets from the remote USC target as well + +`-u, --gateway-url[=http://localhost:8000]`: API Gateway URL (Configuration Management port) + `--region`: Optional, create the secret in a specific region (GCP only). If omitted, the secret is created as a global secret. ### `delete` diff --git a/docs/Universal Secret Connector/sync-secret/index.md b/docs/Universal Secret Connector/sync-secret/index.md index 8c57fa77c..cb89ade27 100644 --- a/docs/Universal Secret Connector/sync-secret/index.md +++ b/docs/Universal Secret Connector/sync-secret/index.md @@ -26,3 +26,25 @@ Sync workflows are available for both [Static Secrets](https://docs.akeyless.io/ ![Illustration for: An Authentication Method with Read and Update permission on the Rotated Secret item, and Read permission on the associated USC.](https://files.readme.io/84d68fd1c6e90bb12b48f538b74db51f35ad9c15a90235524268f07b20572d61-Synced_Secret-2.png) This solution makes managing secrets in remote endpoints more efficient and consistent, enabling a secure, centralized approach to secret lifecycle management. + +## Sync Entire Folder Contents (MVG) + +For HashiCorp Vault USC integrations in Multi-Vault Governance (MVG), you can sync all supported secrets under a folder in one operation. + +Use `folder-sync` to create sync associations for folder contents, and `folder-sync-all` to trigger sync for all folder associations: + +```shell +akeyless folder-sync --name --usc-name +``` + +```shell +akeyless folder-sync-all --name +``` + +Use `folder-delete-sync` to remove folder-level associations: + +```shell +akeyless folder-delete-sync --name --usc-name +``` + +For complete flags and behavior details, see [CLI Reference - Universal Secrets Connector](https://docs.akeyless.io/docs/cli-reference-universal-secrets-connector#folder-sync-commands-mvg). diff --git a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md index ae2d4f78c..d25349d42 100644 --- a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md +++ b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md @@ -169,4 +169,26 @@ Additional capabilities include: * For USC-backed external secrets, the version details shown in the console can vary by provider and by the metadata and history returned by that provider. * For larger HashiCorp Vault structures, you can sync the contents of an entire folder by using the folder sync commands. +### Sync Entire Folder Contents + +For HashiCorp Vault USC flows in Multi-Vault Governance (MVG), use folder-level sync commands to apply sync associations across all supported secrets in a folder path. + +Common commands: + +```shell +akeyless folder-sync --name --usc-name +``` + +```shell +akeyless folder-sync-all --name +``` + +```shell +akeyless folder-delete-sync --name --usc-name +``` + +For Vault-specific mapping, `folder-sync` also supports `--namespace` and `--engine-name` (engine prefix must end with `/`). + +For full command flags and examples, see [CLI Reference - Universal Secrets Connector](https://docs.akeyless.io/docs/cli-reference-universal-secrets-connector#folder-sync-commands-mvg). + _Note:_ The **KV Secrets Engine v1** is not supported. Please use **KV Secrets Engine v2** when working with the Vault Universal Secrets Connector. From 6a6614de862c73059f4c54ca1bbecdb85d0e8b78 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:49:01 -0600 Subject: [PATCH 16/21] DOCS-892: document configurable K8s TokenReview rate limits --- .../dedicated-k8s-auth-service-accounts.md | 9 ++++++++- .../cli-ref-auth/cli-reference-k8s-auth-method.md | 13 +++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md index bdf72c870..a5a4212c9 100644 --- a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md +++ b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md @@ -218,7 +218,14 @@ Where: > ℹ️ **Note (Gateway 4.53.0+):** > -> You can configure TokenReview rate limiting for Kubernetes authentication flows through Gateway-side Kubernetes auth configuration. For the current K8s auth config flags, see [CLI Reference - K8S Auth Method](https://docs.akeyless.io/docs/cli-reference-k8s-auth-method#gateway-create-k8s-auth-config). +> You can configure TokenReview rate limiting for Gateway Kubernetes authentication by setting Gateway runtime environment variables: +> +> * `K8S_TOKEN_REVIEW_QPS` +> * `K8S_TOKEN_REVIEW_BURST` +> +> If these variables are not set, Gateway uses the Kubernetes client-go defaults. +> +> Scope: This setting applies to `native_k8s` TokenReview flows. * `k8s-ca-cert`: The certificate to use to validate the Kubernetes cluster. diff --git a/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md b/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md index de17b3c54..712d98d19 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md +++ b/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md @@ -240,6 +240,19 @@ akeyless gateway-update-k8s-auth-config \ `--delete-protection`: Protection from accidental deletion of this object, [true/false] +### TokenReview Rate Limit Configuration (Gateway 4.53.0+) + +TokenReview rate limiting is configured on the Gateway runtime (not as `gateway-create-k8s-auth-config` or `gateway-update-k8s-auth-config` flags). + +Set these environment variables on the Gateway deployment: + +* `K8S_TOKEN_REVIEW_QPS`: TokenReview client QPS value +* `K8S_TOKEN_REVIEW_BURST`: TokenReview client burst value + +If not set, Gateway uses the Kubernetes client-go default values. + +Scope: applies to `native_k8s` TokenReview calls. + ## `update` Update a new Authentication Method that can authenticate using Kubernetes From 3a2015a1525ed95948642d8ef7f2f2a36922fffa Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:50:42 -0600 Subject: [PATCH 17/21] DOCS-892: clarify default TokenReview rate limit values --- .../auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md index a5a4212c9..0a05d6af6 100644 --- a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md +++ b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md @@ -223,7 +223,7 @@ Where: > * `K8S_TOKEN_REVIEW_QPS` > * `K8S_TOKEN_REVIEW_BURST` > -> If these variables are not set, Gateway uses the Kubernetes client-go defaults. +> If these variables are not set, Gateway uses the Kubernetes client-go defaults: `QPS=5` and `Burst=10`. > > Scope: This setting applies to `native_k8s` TokenReview flows. From f29fbd081c6c76ca7cf2626625f19c316522273f Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:52:25 -0600 Subject: [PATCH 18/21] DOCS-892: remove MVG from USC sync section headers --- .../cli-reference/cli-reference-universal-secrets-connector.md | 2 +- docs/Universal Secret Connector/sync-secret/index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md b/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md index d9d847005..2d557c950 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md @@ -130,7 +130,7 @@ akeyless usc create \ `--selected-repositories`: Explicit list of GitHub repositories selected for this operation -## Folder Sync Commands (MVG) +## Folder Sync Commands Use these commands to sync entire folder contents through Universal Secrets Connector (for example, HashiCorp Vault USC in MVG workflows). diff --git a/docs/Universal Secret Connector/sync-secret/index.md b/docs/Universal Secret Connector/sync-secret/index.md index cb89ade27..fac91686b 100644 --- a/docs/Universal Secret Connector/sync-secret/index.md +++ b/docs/Universal Secret Connector/sync-secret/index.md @@ -27,7 +27,7 @@ Sync workflows are available for both [Static Secrets](https://docs.akeyless.io/ This solution makes managing secrets in remote endpoints more efficient and consistent, enabling a secure, centralized approach to secret lifecycle management. -## Sync Entire Folder Contents (MVG) +## Sync Entire Folder Contents For HashiCorp Vault USC integrations in Multi-Vault Governance (MVG), you can sync all supported secrets under a folder in one operation. From 8a7e6532d68a74e2992f32bd9f0bfb6be9f68952 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:52:49 -0600 Subject: [PATCH 19/21] DOCS-892: clarify TokenReview defaults and scope --- .../cli-ref-auth/cli-reference-k8s-auth-method.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md b/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md index 712d98d19..640d114dd 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md +++ b/docs/Integrations & Plugins/cli-reference/cli-ref-auth/cli-reference-k8s-auth-method.md @@ -249,9 +249,9 @@ Set these environment variables on the Gateway deployment: * `K8S_TOKEN_REVIEW_QPS`: TokenReview client QPS value * `K8S_TOKEN_REVIEW_BURST`: TokenReview client burst value -If not set, Gateway uses the Kubernetes client-go default values. +If not set, Gateway uses the Kubernetes client-go defaults: `QPS=5` and `Burst=10`. -Scope: applies to `native_k8s` TokenReview calls. +Scope: applies only to `native_k8s` TokenReview calls. Rancher TokenReview flows are not controlled by these variables. ## `update` From 1e9120611c7f13565f8fa13ba2634edce08178ac Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 08:54:09 -0600 Subject: [PATCH 20/21] DOCS-892: clarify native_k8s TokenReview scope in dedicated k8s auth doc --- .../auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md index 0a05d6af6..57bc81e97 100644 --- a/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md +++ b/docs/Accessing Akeyless/access-and-authentication-methods/auth-with-kubernetes/dedicated-k8s-auth-service-accounts.md @@ -225,7 +225,7 @@ Where: > > If these variables are not set, Gateway uses the Kubernetes client-go defaults: `QPS=5` and `Burst=10`. > -> Scope: This setting applies to `native_k8s` TokenReview flows. +> Scope: This setting applies only to `native_k8s` TokenReview flows. Rancher TokenReview flows are not controlled by these variables. * `k8s-ca-cert`: The certificate to use to validate the Kubernetes cluster. From aa5d555123c7cd46ef55062e34d18e71d6b54b11 Mon Sep 17 00:00:00 2001 From: Harrison Sherwin - Akeyless Date: Mon, 15 Jun 2026 09:11:11 -0600 Subject: [PATCH 21/21] DOCS-892: fix 8 documentation issues - Audit logs: add missing 5xx server error range documentation - Gateway access permissions: change 'scope' to 'scoped' for API term - Proactive caching: clarify temporary startup behavior of NEW_PROACTIVE_CACHE_ENABLE flag - SRA file transfer: replace stale binary requirement with SFTP client capability description - USC: remove non-existent --engine-name flag from two locations - Vault rotated secrets: fix broken anchor link to correct synchronization section - Folder sync: update old (MVG) anchor references to current heading names - Akeyless agent: add missing frontmatter fields (excerpt, metadata.title, metadata.description) --- docs/Advanced Functionality/akeyless-agent.md | 3 +++ docs/Advanced Functionality/audit-logs/index.md | 2 +- .../configure-gateway/gateway-access-permissions-reference.md | 2 +- .../configure-gateway/gateway-caching/proactive-caching.md | 2 +- .../cli-reference/cli-reference-gateway/cli-reference-sra.md | 2 +- .../cli-reference-universal-secrets-connector.md | 2 -- .../create-a-hashicorp-vault-rotated-secret.md | 2 +- docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md | 2 +- docs/Universal Secret Connector/sync-secret/index.md | 2 +- .../hc-vault-universal-secrets-connector.md | 4 ++-- 10 files changed, 12 insertions(+), 11 deletions(-) diff --git a/docs/Advanced Functionality/akeyless-agent.md b/docs/Advanced Functionality/akeyless-agent.md index c8d4f977d..fc02f105b 100644 --- a/docs/Advanced Functionality/akeyless-agent.md +++ b/docs/Advanced Functionality/akeyless-agent.md @@ -1,8 +1,11 @@ --- title: Akeyless Agent +excerpt: '' deprecated: false hidden: false metadata: + title: '' + description: '' robots: index --- The Akeyless [CLI](https://docs.akeyless.io/docs/cli#/) lets you set up an Agent that automatically delivers secrets from your Akeyless account and places them in specific locations on your system (**Linux** or **Windows** operating systems are supported). diff --git a/docs/Advanced Functionality/audit-logs/index.md b/docs/Advanced Functionality/audit-logs/index.md index fd19671d1..e9155d7c3 100644 --- a/docs/Advanced Functionality/audit-logs/index.md +++ b/docs/Advanced Functionality/audit-logs/index.md @@ -47,7 +47,7 @@ The logs will show up as a line of text, from which you can read the following i | `component` | Service component that emitted the audit event (for example, `microservices/uam`). | | `action` | Type of action performed, such as list items, create item, or get item. For common actions, see [Log Actions](https://docs.akeyless.io/docs/log-actions). | | `item_type` | If the action is item-specific (for example, create item), the item type is listed. | -| `status` | Standard HTTP status code: informational (`100`-`199`), success (`200`-`299`), redirection (`300`-`399`), or client error (`400`-`499`). | +| `status` | Standard HTTP status code: informational (`100`-`199`), success (`200`-`299`), redirection (`300`-`399`), client error (`400`-`499`), or server error (`500`-`599`). | | `remote_addr` | IP address from which the action was performed. | | `duration` | Duration of the action in milliseconds. | | `request_parameters` | Additional action details, such as dynamic secret details when a value is fetched. | diff --git a/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md b/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md index 12db18468..aaf3dcbae 100644 --- a/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md +++ b/docs/Akeyless Gateway/configure-gateway/gateway-access-permissions-reference.md @@ -57,7 +57,7 @@ Console behavior note: in the current custom permission multi-select UI, `admin` Administrative operations for Gateway allowed access management require `admin` permission. -Gateway visibility in the Console is permission-scoped. Users with Gateway access permissions can view the Gateway in the Console only when their role includes Gateway administrative scope (`scope` or `all`). +Gateway visibility in the Console is permission-scoped. Users with Gateway access permissions can view the Gateway in the Console only when their role includes Gateway administrative scope (`scoped` or `all`). For item-related operations (`targets`, `classic_keys`, `dynamic_secret`, `rotated_secret`, and `rotate_secret_value`), access is evaluated in two scopes: diff --git a/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md b/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md index 350c40ddb..87c70dd50 100644 --- a/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md +++ b/docs/Akeyless Gateway/configure-gateway/gateway-caching/proactive-caching.md @@ -120,7 +120,7 @@ For the full key reference, see [Helm Values Reference](https://docs.akeyless.io * `PROACTIVE_CACHE_DUMP_INTERVAL`: Sets the periodic secure cache backup interval in minutes for the legacy implementation. This variable has no effect when `NEW_PROACTIVE_CACHE_ENABLE=true`. For most tuning decisions on the legacy implementation, prefer `PROACTIVE_CACHE_MINIMUM_FETCHING_TIME`; adjust `PROACTIVE_CACHE_DUMP_INTERVAL` only when you need to change backup cadence specifically. > ℹ️ **Note:** -> If Gateway starts without reachable SaaS configuration and initializes cache behavior from environment values, it assumes `NEW_PROACTIVE_CACHE_ENABLE=true` for startup continuity. +> If Gateway starts without reachable SaaS configuration and initializes cache behavior from environment values, it temporarily enables `NEW_PROACTIVE_CACHE_ENABLE=true` for startup continuity until SaaS configuration becomes reachable. For Redis topology choices, see [Cluster Cache (Standalone)](https://docs.akeyless.io/docs/cluster-cache-standalone) and [Cluster Cache High Availability (HA)](https://docs.akeyless.io/docs/cluster-cache-ha). diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md b/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md index 2bf5d8d02..5245a0dc6 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-gateway/cli-reference-sra.md @@ -425,7 +425,7 @@ These commands run on the client machine and use SFTP over an SRA tunnel. At runtime, the CLI resolves target and bastion connection parameters (from command flags or profile), requests short-lived access by way of the configured SSH certificate issuer, and then establishes the tunnel used by SFTP for upload and download. -If local `scp`/`ssh` binaries are missing or not available in `PATH`, file transfer commands fail on the client before transfer starts. +The client must support SFTP; file transfer commands fail if SFTP capability is not available. ```shell Command group akeyless file upload diff --git a/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md b/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md index 2d557c950..198b6047f 100644 --- a/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md +++ b/docs/Integrations & Plugins/cli-reference/cli-reference-universal-secrets-connector.md @@ -154,8 +154,6 @@ akeyless folder-sync \ `--namespace`: Vault namespace (HashiCorp Vault targets) -`--engine-name`: HashiCorp Vault engine name prefix (must end with `/`) - `--delete-remote`: Delete the remote secret as part of sync handling when relevant `-u, --gateway-url[=http://localhost:8000]`: API Gateway URL (Configuration Management port) diff --git a/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md b/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md index 74616389c..92e3c66a5 100644 --- a/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md +++ b/docs/Secrets Management/rotated-secrets/create-a-hashicorp-vault-rotated-secret.md @@ -64,7 +64,7 @@ Where: * `rotation-interval`: The number of days to wait between every automatic rotation (1-365). -The HashiCorp Vault variant also supports the shared rotated-secret settings for protection keys, max versions, tags, and description. For the full parameter list, see the [CLI Reference - Rotated Secrets](https://docs.akeyless.io/docs/cli-reference-rotated-secrets#hashi-vault) section. +The HashiCorp Vault variant also supports the shared rotated-secret settings for protection keys, max versions, tags, and description. For the full parameter list, see the [CLI Reference - Rotated Secrets](https://docs.akeyless.io/docs/cli-reference-rotated-secrets#synchronization) section. ## Working With Version History diff --git a/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md b/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md index efc0667e1..32fad8813 100644 --- a/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md +++ b/docs/Secure Remote Access/sra-user-guides/sra-akeyless-scp.md @@ -26,7 +26,7 @@ These commands run on the client machine and use SFTP over an SRA tunnel. At runtime, the CLI resolves target and bastion connection parameters (from command flags or profile), requests short-lived access by way of the configured SSH certificate issuer, and then establishes the tunnel used by SFTP for upload and download. -If local `scp`/`ssh` binaries are missing or not available in `PATH`, file transfer commands fail on the client before transfer starts. +The client must support SFTP; file transfer commands fail if SFTP capability is not available. > ℹ️ **Note:** > diff --git a/docs/Universal Secret Connector/sync-secret/index.md b/docs/Universal Secret Connector/sync-secret/index.md index fac91686b..3d7f52e4e 100644 --- a/docs/Universal Secret Connector/sync-secret/index.md +++ b/docs/Universal Secret Connector/sync-secret/index.md @@ -47,4 +47,4 @@ Use `folder-delete-sync` to remove folder-level associations: akeyless folder-delete-sync --name --usc-name ``` -For complete flags and behavior details, see [CLI Reference - Universal Secrets Connector](https://docs.akeyless.io/docs/cli-reference-universal-secrets-connector#folder-sync-commands-mvg). +For complete flags and behavior details, see [CLI Reference - Universal Secrets Connector](https://docs.akeyless.io/docs/cli-reference-universal-secrets-connector#folder-sync-commands). diff --git a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md index d25349d42..d1fa1f819 100644 --- a/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md +++ b/docs/Universal Secret Connector/universal-secrets-connector/hc-vault-universal-secrets-connector.md @@ -187,8 +187,8 @@ akeyless folder-sync-all --name akeyless folder-delete-sync --name --usc-name ``` -For Vault-specific mapping, `folder-sync` also supports `--namespace` and `--engine-name` (engine prefix must end with `/`). +For Vault-specific mapping, `folder-sync` also supports `--namespace`. -For full command flags and examples, see [CLI Reference - Universal Secrets Connector](https://docs.akeyless.io/docs/cli-reference-universal-secrets-connector#folder-sync-commands-mvg). +For full command flags and examples, see [CLI Reference - Universal Secrets Connector](https://docs.akeyless.io/docs/cli-reference-universal-secrets-connector#folder-sync-commands). _Note:_ The **KV Secrets Engine v1** is not supported. Please use **KV Secrets Engine v2** when working with the Vault Universal Secrets Connector.