Migrating from Vault to Infisical

• KV v1 and KV v2 secrets
• Kubernetes auth method configurations (translated to Machine Identities in Infisical)
• Kubernetes secrets engine roles (translated to Dynamic Secrets in Infisical)
• Vault policies (translated to Infisical project roles)

​

Set up your Vault connection

# System endpoints - for listing namespaces, policies, mounts, and auth methods
path "sys/namespaces" {
  capabilities = ["list"]
}

path "sys/policy" {
  capabilities = ["read", "list"]
}

path "sys/policy/*" {
  capabilities = ["read"]
}

path "sys/mounts" {
  capabilities = ["read"]
}

path "sys/auth" {
  capabilities = ["read"]
}

# KV v2 secrets - for listing and reading secrets
# Replace '+' with your actual KV v2 mount paths (e.g., "secret", "kv")
path "+/metadata/*" {
  capabilities = ["list", "read"]
}

path "+/data/*" {
  capabilities = ["read"]
}

# KV v1 secrets - for listing and reading secrets
# Replace '+' with your actual KV v1 mount paths (e.g., "secret", "kv-v1")
# WARNING: This is broad - ideally specify exact mount names
path "+/*" {
  capabilities = ["list", "read"]
}

# Kubernetes auth - for reading auth configuration and roles
path "auth/+/config" {
  capabilities = ["read"]
}

path "auth/+/role" {
  capabilities = ["list"]
}

path "auth/+/role/*" {
  capabilities = ["read"]
}

# Kubernetes secrets engine - for reading secrets engine configuration and roles
path "+/config" {
  capabilities = ["read"]
}

path "+/roles" {
  capabilities = ["list"]
}

path "+/roles/*" {
  capabilities = ["read"]
}

​

Migrate your resources

​

Migrating KV secrets

1. Navigate to your project and select a specific environment (e.g., Development, Production)
2. In the secrets view, select the dropdown icon (caret) next to the ”+ Add Secret” button
3. Select “Add from HashiCorp Vault”
4. Pick the App Connection, then the Namespace, then the Secrets Engine that holds the paths you want, and finally one or more entries under Vault Secret Path. Keys are copied using their names from Vault.
5. (Optional) Select Preserve folder structure to recreate each Vault path as a folder in Infisical. Leave it unchecked to copy every key from every selected path into the folder you’re currently viewing.
   Importing without preserving the structure aborts if the same key name exists in more than one selected path, and no secrets are saved. Preserving the structure resolves the conflict, because each Vault path gets its own folder.
6. Check the Preview to confirm where every secret will land, then select “Import Secrets”

​

Preserving your Vault folder structure

• Flattened
• Structure preserved

Every key lands directly in the folder you’re viewing. This import runs from the project root, so all six secrets collapse into / and the Vault path each one came from is shown only for reference.

Each Vault path becomes a folder. This import runs from /newww, so team-a/service-1, team-a/service-2, and team-b are recreated beneath it, each holding the secrets from its own Vault path.

​

Migrating Kubernetes auth method

1. First, create a Machine Identity in Infisical
2. Navigate to Access Control > Machine Identities and select the identity
3. Select “Add Authentication Method” and choose Kubernetes Auth
4. In the configuration modal, select “Load from Vault”
5. In the load modal, pick the App Connection, the Vault namespace, and the Kubernetes role
6. Select “Load”

​

Migrating Kubernetes secrets engine roles

1. Navigate to your project and select an environment
2. Select ”+ Add Secret” dropdown and choose “Dynamic Secret”
3. Select Kubernetes as the provider
4. Select “Load from Vault” at the top of the form
5. In the load modal, pick the App Connection, the Vault namespace, the Kubernetes secrets engine mount, and the role
6. Select “Load Configuration”

• Cluster URL and CA certificate
• Credential type (Static or Dynamic)
• Service account name or Kubernetes role settings
• Allowed namespaces
• Token TTL values
• Token audiences

​

Migrating Vault policies

1. Navigate to your project, then go to Access Control > Roles and create or edit a role
2. In the policy configuration, select “Add from HashiCorp Vault”
3. In the modal, pick the App Connection and the Vault namespace
4. Either choose an existing policy from the dropdown or paste your own HCL policy
5. Review the automatically translated Infisical permissions
6. Make any adjustments and save

# Vault policy
path "secret/data/app/*" {
  capabilities = ["read", "list"]
}

​

One-time bulk import from Vault

1. Navigate to Integrations and select the tab External Migrations
2. Select Import and choose HCP Vault
3. Fill in the import form:
   • Gateway (optional) — route the import through a gateway if your Vault instance is private
   • Vault URL — your Vault address (e.g. https://vault.example.com)
   • Vault Namespace (optional) — leave blank for the root namespace
   • Vault Access Token — a token with read access to the KV mounts you want to import
   • Project Mapping — how Vault resources map onto Infisical projects:
     • Key Vaults — each KV mount becomes an Infisical project. A default Production environment is created per project; secret paths become folders.
     • Namespaces — each Vault namespace becomes a project; each KV mount inside it becomes an environment; secret paths become folders.
     • Custom Migration — available on request; contact sales to discuss tailored mappings.
4. Submit the form. Infisical will run the import asynchronously and email you when it finishes (or if it fails). This may take up to 10 minutes.

​

Next steps after migration