---
layout: docs
page_title: Upgrading to Vault 1.9.0 - Guides
description: |-
  This page contains the list of deprecations and important or breaking changes
  for Vault 1.9.0. Please read it carefully.
---

~> Note: these are **draft** notes for a future version of Vault. They should not be considered
official guidance until the release has been completed.

# Overview

This page contains the list of deprecations and important or breaking changes
for Vault 1.9.0 compared to 1.8. Please read it carefully.

## Identity Tokens

The Identity secrets engine has changed the procedure for creating Identity
token roles. When creating a role, the key parameter is required and the key
must exist. Previously, it was possible to create a role and assign it a named
key that did not yet exist despite the documentation stating otherwise.

All calls to [create or update a role](https://www.vaultproject.io/api/secret/identity/tokens#create-or-update-a-role)
must be checked to ensure that roles are not being created or updated with
non-existent keys.

## SSH Role Parameter `allowed_extensions` Behavior Change

Prior versions of Vault allowed clients to specify any extension when requesting
SSH certificate [signing requests](https://www.vaultproject.io/api/secret/ssh#sign-ssh-key)
if their role had an `allowed_extensions` set to `""` or was missing.

Now, Vault will reject a client request that specifies extensions if the role
parameter `allowed_extensions` is empty or missing from the role they are
associated with.

To re-enable the old behavior, update the roles with a value
of `"*"` to the `allowed_extensions` parameter allowing any/all extensions to be
specified by clients.

## Deprecations

### HTTP Request Counter Deprecation

In Vault 1.9, the internal HTTP Request count
[API](https://www.vaultproject.io/api-docs/system/internal-counters#http-requests)
will be removed from the product. Calls to the endpoint will result in a 404
error with a message stating that `functionality on this path has been removed`.

Vault does not make backwards compatible guarantees on internal APIs (those
prefaced with `sys/internal`). They are subject to change and may disappear
without notice.

### Etcd v2

Support for Etcd v2 will be removed from Vault in Vault 1.10 (not this Vault
release, but the next one). The Etcd v2 API
was deprecated with the release of [Etcd
v3.5](https://etcd.io/blog/2021/announcing-etcd-3.5/), and will be
decommissioned in the Etcd v3.6 release.

Users upgrading to Vault 1.9 and planning to eventually upgrade to Vault 1.10
should prepare to [migrate](/docs/commands/operator/migrate) Vault storage to
an Etcd v3 cluster prior to upgrading to Vault 1.10. All storage migrations
should have [backups](/docs/concepts/storage#backing-up-vault-s-persisted-data)
taken prior to migration.

## TLS Cipher Suites Changes

In Vault 1.9, due to changes in Go 1.17, the `tls_prefer_server_cipher_suites`
TCP configuration parameter has been deprecated and its value will be ignored.

Additionally, Go has begun doing automated cipher suite ordering and no longer
respects the order of suites given in `tls_cipher_suites`.

See [this blog post](https://go.dev/blog/tls-cipher-suites) for more information.