Configure KV v2 metadata settings including max_versions and cas_required (check-and-set), and attach custom metadata for compliance tagging, ownership tracking, and secret classification purposes.
Prerequisites checklist
Confirm these before running steps:
1Set metadata configuration for a secret path
bao kv metadata put -max-versions=10 -cas-required=true secret/myapp/config2Read metadata for the secret
bao kv metadata get secret/myapp/config======= Metadata Path =======
secret/metadata/myapp/config
============ Metadata ============
Key Value
--- -----
cas_required true
created_time 2026-07-14T15:52:01.907838454Z
current_metadata_version 1
current_version 2
custom_metadata <nil>
delete_version_after 0s
max_versions 10
metadata_cas_required false
oldest_version 0
updated_time 2026-07-15T10:10:23.297747286Z→ max_versions: 10, cas_required: true, current_version: 2
3Write a secret with CAS (check-and-set) enforcement
bao kv put -cas=2 secret/myapp/config db_host=pghost.example.com======= Metadata =======
Key Value
--- -----
created_time 2026-07-15T10:16:18.255311888Z
custom_metadata <nil>
deletion_time n/a
destroyed false
version 3→ Version change to: current_version: 3
4Attempt to overwrite without correct CAS value (should fail)
bao kv put -cas=0 secret/myapp/config db_host=new-host.example.com→ Expected error: check-and-set parameter did not match the current version
5Write with correct CAS value
bao kv put -cas=3 secret/myapp/config db_host=new-host.example.comUse the current version
6Add custom metadata for compliance tagging
bao kv metadata put -custom-metadata=owner=syseng-team -custom-metadata=classification=confidential -custom-metadata=compliance=pci-dss secret/myapp/config7Verify custom metadata is attached
bao kv metadata get secret/myapp/config# snippet of metadata
============ Metadata ============
Key Value
--- -----
...
current_version 4
custom_metadata map[classification:confidential compliance:pci-dss owner:syseng-team]
...8Verify in UI (optional)
