如何通过HTTP API删除Hashicorp Vault KV v2所有记录及列表查询问题

需求：优先通过HTTP API删除HashiCorp Vault中版本化KV的所有记录，CLI仅作为备选方案。经调研需先执行LIST操作获取所有KV条目，再循环删除，但多次LIST请求均失败。

挂载路径查询结果 #

通过以下命令查询挂载路径：

C:\Users\meuser>curl -H "X-Vault-Token: s.XTEZVwE5WOill0as1HXV6w2Z" -H "X-Vault-Namespace: devops-vault-poc/"  https://dal-vault.mybank.com/v1/sys/mounts

返回结果显示KV引擎版本为2：

{"request_id":"93fdc050-d5d1-fbe2-df58-2a2bba04f19c","lease_id":"","renewable":false,"lease_duration":0,"data":{"cubbyhole/":{"accessor":"ns_cubbyhole_12e4f0fa","config":{"default_lease_ttl":0,"force_no_cache":false,"max_lease_ttl":0},"description":"per-token private secret storage","external_entropy_access":false,"local":true,"options":null,"seal_wrap":false,"type":"ns_cubbyhole","uuid":"b9276a30-73c0-5d2f-34c0-238b5830c572"},"identity/":{"accessor":"ns_identity_50d4ced6","config":{"default_lease_ttl":0,"force_no_cache":false,"max_lease_ttl":0},"description":"identity store","external_entropy_access":false,"local":false,"options":null,"seal_wrap":false,"type":"ns_identity","uuid":"8b5b546f-33d6-1234-6f38-9ddcde05c55d"},"kv/":{"accessor":"kv_b93d663b","config":{"default_lease_ttl":0,"force_no_cache":false,"max_lease_ttl":0},"description":"","external_entropy_access":false,"local":false,"options":{"version":"2"},"seal_wrap":false,"type":"kv","uuid":"42834004-f858-a734-e52d-6405d0e5ab73"},"sys/":{"accessor":"ns_system_573b63e0","config":{"default_lease_ttl":0,"force_no_cache":false,"max_lease_ttl":0},"description":"system endpoints used for control, policy and debugging","external_entropy_access":false,"local":false,"options":null,"seal_wrap":false,"type":"ns_system","uuid":"bfce2504-fff5-b74f-70a0-0b2fe3fb500d"}},"wrap_info":null,"warnings":null,"auth":null}

失败的LIST请求尝试 #

尝试1：直接请求KV根路径 #

C:\Users\meuser>curl -H "X-Vault-Token: s.XTEZVwE5WOill0as1HXV6w2Z" -H "X-Vault-Namespace: devops-vault-poc/" -X LIST https://dal-vault.mybank.com/v1/kv

报错：

{"request_id":"884ad3f2-80c3-fb99-d5c9-83f059f41319","lease_id":"","renewable":false,"lease_duration":0,"data":null,"wrap_info":null,"warnings":["Invalid path for a versioned K/V secrets engine. See the API docs for the appropriate API endpoints to use. If using the Vault CLI, use 'vault kv list' for this operation."],"auth":null}

尝试2：请求带斜杠的KV根路径 #

C:\Users\meuser>curl -H "X-Vault-Token: s.XTEZVwE5WOill0as1HXV6w2Z" -H "X-Vault-Namespace: devops-vault-poc/" -X LIST https://dal-vault.mybank.com/v1/kv/

报错：

{"request_id":"c898ffc6-7ac8-faa6-87aa-e8f57045c6d3","lease_id":"","renewable":false,"lease_duration":0,"data":null,"wrap_info":null,"warnings":["Invalid path for a versioned K/V secrets engine. See the API docs for the appropriate API endpoints to use. If using the Vault CLI, use 'vault kv list' for this operation."],"auth":null}

尝试3：请求kv/data/路径 #

C:\Users\meuser>curl -H "X-Vault-Token: s.XTEZVwE5WOill0as1HXV6w2Z" -H "X-Vault-Namespace: devops-vault-poc/" -X LIST https://dal-vault.mybank.com/v1/kv/data/

报错：

{"errors":["1 error occurred:\n\t* unsupported operation\n\n"]}

解决方案 #

KV v2版本的API与v1不同，列出密钥需使用/metadata端点，而非根路径或/data端点。

1. 正确的LIST请求命令 #

curl -H "X-Vault-Token: s.XTEZVwE5WOill0as1HXV6w2Z" -H "X-Vault-Namespace: devops-vault-poc/" -X LIST https://dal-vault.mybank.com/v1/kv/metadata

该命令会返回所有KV密钥的路径列表。

2. 循环删除所有密钥 #

对于LIST返回的每个密钥路径（例如my-secret），使用以下命令彻底删除该密钥的所有版本：

curl -H "X-Vault-Token: s.XTEZVwE5WOill0as1HXV6w2Z" -H "X-Vault-Namespace: devops-vault-poc/" -X DELETE https://dal-vault.mybank.com/v1/kv/metadata/my-secret

如果存在嵌套路径（如app/db），则路径为/v1/kv/metadata/app/db。

备选CLI方案 #

如果HTTP API执行有困难，可使用Vault CLI完成批量删除：

# 列出所有密钥
vault kv list -namespace=devops-vault-poc kv/ | grep -v "Keys" | while read key; do
  # 删除每个密钥的所有版本
  vault kv delete -namespace=devops-vault-poc kv/"$key"
done

内容的提问来源于stack exchange，提问作者Ashar