What is Vault Client?

Vault Client is a client-only edition of Vault Enterprise for applications and systems that consume secrets from Vault. Vault Client includes Vault Agent, Vault Proxy, and a subset of the Vault CLI. It does not include the Vault server.

Enterprise

Appropriate Vault Enterprise license required

You need a Vault Enterprise license to download Vault Client, but Vault Client does not need a license key to run.

Vault Client is different from Vault clients

Vault Client is the name of a Vault Enterprise binary and container image. Vault also uses the word client for anything that connects and authenticates to Vault, such as a user or an application.

Why use Vault Client?

Use Vault Client on systems that authenticate to Vault and consume secrets, but do not run a Vault server:

Deploy a smaller binary. The vault-client binary is about one tenth the size of the full vault binary.
Reduce your attack surface. Vault Client leaves out the Vault server and has about half as many dependencies as the full vault binary, so there is less code to scan and patch on client systems.
Upgrade clients on their own schedule. You can upgrade Vault Client more often than your Vault servers. Refer to Server compatibility for details.

What Vault Client includes

Vault Client includes the following components:

Vault Agent. Start Vault Agent with vault-client agent.
Vault Proxy. Start Vault Proxy with vault-client proxy.
A subset of Vault CLI commands.
TPM authentication.

Vault Agent and Vault Proxy in Vault Client support the same features as the full vault binary and use the same configuration files. To move an existing Vault Agent or Vault Proxy deployment to Vault Client, replace vault with vault-client in the command that starts it. For example:

$ vault-client agent -config=/etc/vault/agent.hcl

CLI commands

Vault Client CLI commands behave identically to Vault CLI commands, but Vault Client only provides a subset of the full command set.

CLI command	Included
`agent`	YES
`audit`	NO
`auth`	YES
`debug`	NO
`delete`	YES
`events`	NO
`hcp`	YES
`kv`	YES
`lease`	YES
`license`	NO
`list`	YES
`login`	YES
`monitor`	NO
`namespace`	YES
`operator`	LIMITED: `key-status`, `rotate`,`unseal`
`patch`	YES
`path-help`	YES
`pki`	NO
`plugin`	NO
`policy`	NO
`print`	YES
`proxy`	YES
`read`	YES
`recover`	YES
`secrets`	YES
`server`	NO
`ssh`	YES
`status`	YES
`token`	YES
`tpm`	YES
`transform`	NO
`transit`	NO
`unwrap`	YES
`version`	YES
`version-history`	NO
`write`	YES

If you try to run a command that Vault Client does not include, vault-client prints an error that names the command with a link to the full Vault binary, and exits with status code 1. Vault Client also hides unsupported commands from -help output and autocomplete.

You can call any Vault API endpoint with the read, write, list, delete, and patch commands. For example, Vault Client does not include the transit command, but you can encrypt data with the Transit secrets engine by writing to its API path:

$ vault-client write transit/encrypt/my-key plaintext=$(base64 <<< "my secret data")

Refer to Calling API endpoints for more information.

Server compatibility

Vault Client 2.x works with Vault Enterprise deployments running 2.x or later and HCP Vault Dedicated. We recommend running the same major and minor version of Vault Client as your Vault servers, but you can upgrade Vault Client more often than your servers.

Platforms

Vault Client is available for the following platforms. All Vault Client artifacts are Tier 1, and we test them in IPv6 mode. Refer to the OS validation reference for test environments.

Operating system	Architectures	Binary	Container image
Linux	amd64, arm64, ppc64le, s390x	Yes	Yes
AIX	ppc64	Yes	No
Windows	386, amd64	Yes	No

Get Vault Client

Vault Client is only available from IBM Passport Advantage Online and the IBM Entitled Registry:

IBM Passport Advantage Online provides Vault Client binaries and container image archives.
IBM Entitled Registry (cp.icr.io) provides Vault Client container images.

Vault Client is not available from the HashiCorp releases site, Docker Hub, Amazon ECR, the Red Hat Ecosystem Catalog, or package managers.