Vault KV "version not found" reading a secret in CI

By Daniel Zoghalchali·Latchkey

A KV v2 read asked for a specific version that Vault cannot return. The version may have been deleted or destroyed, or the current version count is lower than the number you requested.

What this error means

A vault kv get -version=N or a ?version=N API read returns "version not found" or empty data for that version.

$ vault kv get -version=7 secret/ci/app
No value found at secret/data/ci/app version 7
* version not found

Common causes

The requested version was deleted or destroyed

Someone ran vault kv delete or vault kv destroy on that version, so it no longer returns data.

The version number exceeds what exists

The path has fewer versions than requested (asking for v7 when only v3 exists), so there is nothing to read.

How to fix it

Read the current version instead of a pin

1. Drop the explicit -version unless you truly need an old one.
2. Check available versions in metadata.
3. Undelete a soft-deleted version if it must be recovered.

vault kv metadata get secret/ci/app   # see versions
vault kv get secret/ci/app             # latest

Undelete a recoverable version

A soft-deleted (not destroyed) version can be restored.

vault kv undelete -versions=7 secret/ci/app

How to prevent it

• Read the latest version in CI unless a pinned version is required.
• Avoid destroying versions still referenced by pipelines.
• Check vault kv metadata get before pinning a version number.

Frequently asked questions

Related guides

References

• GitHub Actions documentation