diff --git a/go.mod b/go.mod
index 4bcb4de746db..059f4579535e 100644
--- a/go.mod
+++ b/go.mod
@@ -81,9 +81,9 @@ require (
 	github.com/hashicorp/vault-plugin-secrets-azure v0.5.2-0.20190509203638-8a60a8656fb0
 	github.com/hashicorp/vault-plugin-secrets-gcp v0.5.3-0.20190620162751-272efd334652
 	github.com/hashicorp/vault-plugin-secrets-gcpkms v0.5.2-0.20190516000311-88f9a4f11829
-	github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190416155133-fd495225dea0
+	github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190626201950-a6e92ff82578
 	github.com/hashicorp/vault/api v1.0.3-0.20190621032639-b2bd2690d46a
-	github.com/hashicorp/vault/sdk v0.1.12-0.20190624011739-68b40b814cc2
+	github.com/hashicorp/vault/sdk v0.1.12-0.20190626183508-cc3a81801f98
 	github.com/influxdata/influxdb v0.0.0-20190411212539-d24b7ba8c4c4
 	github.com/jackc/fake v0.0.0-20150926172116-812a484cc733 // indirect
 	github.com/jackc/pgx v3.3.0+incompatible // indirect
diff --git a/go.sum b/go.sum
index 0b6d680e7fd1..35d3531c4fcc 100644
--- a/go.sum
+++ b/go.sum
@@ -332,8 +332,8 @@ github.com/hashicorp/vault-plugin-secrets-gcp v0.5.3-0.20190620162751-272efd3346
 github.com/hashicorp/vault-plugin-secrets-gcp v0.5.3-0.20190620162751-272efd334652/go.mod h1:2VjVlKHTwqvcVCkZBhYks+HASDzQ4/bIsJoOpO2YJFY=
 github.com/hashicorp/vault-plugin-secrets-gcpkms v0.5.2-0.20190516000311-88f9a4f11829 h1:Ipz+e4xLEDlSg9VkqGeJV3HuNCqNF0kPFlk3jXBZ1dg=
 github.com/hashicorp/vault-plugin-secrets-gcpkms v0.5.2-0.20190516000311-88f9a4f11829/go.mod h1:HSCPRY1NbVn8Vfpn1qQD4fx+Y7hVo8kUlvoix5mmve8=
-github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190416155133-fd495225dea0 h1:pb5DaAqWgGsKWFMsGotmQJREcv/B1EZGHO1hqWOxDAI=
-github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190416155133-fd495225dea0/go.mod h1:PIjaafaRr2QlkGl2SNhIywxlejeW0iMUtmx8u9u/a6c=
+github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190626201950-a6e92ff82578 h1:wzRbe3eDq6fs5eMEi44IO7/1yb8vzoqRIOSLphSzgJk=
+github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190626201950-a6e92ff82578/go.mod h1:0UXCoeKxYD9fPISis75//2M3EtE6D/dpVU6OuyiC5UY=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/backend.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/backend.go
index fc9ba1db7790..7a6053acf82e 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/backend.go
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/backend.go
@@ -317,8 +317,9 @@ func (b *versionedKVBackend) config(ctx context.Context, s logical.Storage) (*Co
 	if b.globalConfig != nil {
 		defer b.globalConfigLock.RUnlock()
 		return &Configuration{
-			CasRequired: b.globalConfig.CasRequired,
-			MaxVersions: b.globalConfig.MaxVersions,
+			CasRequired:        b.globalConfig.CasRequired,
+			MaxVersions:        b.globalConfig.MaxVersions,
+			DeleteVersionAfter: b.globalConfig.DeleteVersionAfter,
 		}, nil
 	}
 
@@ -329,8 +330,9 @@ func (b *versionedKVBackend) config(ctx context.Context, s logical.Storage) (*Co
 	// Verify this hasn't already changed
 	if b.globalConfig != nil {
 		return &Configuration{
-			CasRequired: b.globalConfig.CasRequired,
-			MaxVersions: b.globalConfig.MaxVersions,
+			CasRequired:        b.globalConfig.CasRequired,
+			MaxVersions:        b.globalConfig.MaxVersions,
+			DeleteVersionAfter: b.globalConfig.DeleteVersionAfter,
 		}, nil
 	}
 
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/delete_version_after.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/delete_version_after.go
new file mode 100644
index 000000000000..aae4bc82ad98
--- /dev/null
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/delete_version_after.go
@@ -0,0 +1,64 @@
+package kv
+
+import (
+	"time"
+
+	"github.com/golang/protobuf/ptypes"
+	"github.com/golang/protobuf/ptypes/duration"
+)
+
+// deletionTime returns the time of creation plus the duration of the
+// minimum non-zero value of mount or meta. If mount and meta are zero,
+// false is returned.
+func deletionTime(creation time.Time, mount, meta time.Duration) (time.Time, bool) {
+	if mount == 0 && meta == 0 {
+		return time.Time{}, false
+	}
+	var min time.Duration
+	if meta != 0 {
+		min = meta
+	}
+	if (mount != 0 && mount < min) || min == 0 {
+		min = mount
+	}
+	return creation.Add(min), true
+}
+
+type deleteVersionAfterGetter interface {
+	GetDeleteVersionAfter() *duration.Duration
+}
+
+func deleteVersionAfter(v deleteVersionAfterGetter) time.Duration {
+	if v.GetDeleteVersionAfter() == nil {
+		return time.Duration(0)
+	}
+	dva, err := ptypes.Duration(v.GetDeleteVersionAfter())
+	if err != nil {
+		return time.Duration(0)
+	}
+	return dva
+}
+
+const (
+	disabled time.Duration = -1 * time.Second
+)
+
+// IsDeleteVersionAfterDisabled returns true if DeleteVersionAfter is
+// disabled.
+func (c *Configuration) IsDeleteVersionAfterDisabled() bool {
+	if deleteVersionAfter(c) == disabled {
+		return true
+	}
+	return false
+}
+
+// DisableDeleteVersionAfter disables DeleteVersionAfter.
+func (c *Configuration) DisableDeleteVersionAfter() {
+	c.DeleteVersionAfter = ptypes.DurationProto(disabled)
+}
+
+// ResetDeleteVersionAfter resets the DeleteVersionAfter to the default
+// value.
+func (c *Configuration) ResetDeleteVersionAfter() {
+	c.DeleteVersionAfter = nil
+}
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.mod b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.mod
index 226bd732b1ba..2a5285375dfd 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.mod
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.mod
@@ -4,9 +4,8 @@ go 1.12
 
 require (
 	github.com/golang/protobuf v1.3.1
-	github.com/hashicorp/errwrap v1.0.0
 	github.com/hashicorp/go-hclog v0.8.0
 	github.com/hashicorp/vault/api v1.0.1
-	github.com/hashicorp/vault/sdk v0.1.8
+	github.com/hashicorp/vault/sdk v0.1.12-0.20190626183508-cc3a81801f98
 	github.com/mitchellh/mapstructure v1.1.2
 )
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.sum b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.sum
index b69ae318892e..c256be2aae80 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.sum
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/go.sum
@@ -14,6 +14,8 @@ github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga
 github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-test/deep v1.0.1 h1:UQhStjbkDClarlmv0am7OXXO4/GaPdCGiUiMTvi28sg=
 github.com/go-test/deep v1.0.1/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31 h1:28FVBuwkwowZMjbA7M0wXsI6t3PYulRTMio3SO+eKCM=
+github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/gogo/protobuf v1.2.1 h1:/s5zKNz0uPFCZ5hddgPdo2TK2TVrUNMn0OOX8/aZMTE=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
@@ -38,6 +40,8 @@ github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uP
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-plugin v1.0.0 h1:/gQ1sNR8/LHpoxKRQq4PmLBuacfZb4tC93e9B30o/7c=
 github.com/hashicorp/go-plugin v1.0.0/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
+github.com/hashicorp/go-plugin v1.0.1 h1:4OtAfUGbnKC6yS48p0CtMX2oFYtzFZVv6rok3cRWgnE=
+github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
 github.com/hashicorp/go-retryablehttp v0.5.3 h1:QlWt0KvWT0lq8MFppF9tsJGF+ynG7ztc2KIPhzRGk7s=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-rootcerts v1.0.0 h1:Rqb66Oo1X/eSV1x66xbDccZjhJigjg0+e82kpwzSwCI=
@@ -58,6 +62,8 @@ github.com/hashicorp/vault/api v1.0.1 h1:YQI4SgOlkmbEKZI8ZClo6fm9oXlBHJUlrbEtFiR
 github.com/hashicorp/vault/api v1.0.1/go.mod h1:AV/+M5VPDpB90arloVX0rVDUIHkONiwz5Uza9HRtpUE=
 github.com/hashicorp/vault/sdk v0.1.8 h1:pfF3KwA1yPlfpmcumNsFM4uo91WMasX5gTuIkItu9r0=
 github.com/hashicorp/vault/sdk v0.1.8/go.mod h1:tHZfc6St71twLizWNHvnnbiGFo1aq0eD2jGPLtP8kAU=
+github.com/hashicorp/vault/sdk v0.1.12-0.20190626183508-cc3a81801f98 h1:28ekb7e2slhQ3rP52v8FQkEi1VOde1D7Vf3OJZSn5XA=
+github.com/hashicorp/vault/sdk v0.1.12-0.20190626183508-cc3a81801f98/go.mod h1:w7Nxsfv9KNRjMc5J4WC7jDsJ2wzb/nNQa6UZWy0pyxI=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_config.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_config.go
index f1935387bad4..c71550979583 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_config.go
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_config.go
@@ -3,8 +3,10 @@ package kv
 import (
 	"context"
 	"path"
+	"time"
 
 	"github.com/golang/protobuf/proto"
+	"github.com/golang/protobuf/ptypes"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -23,6 +25,13 @@ func pathConfig(b *versionedKVBackend) *framework.Path {
 				Type:        framework.TypeBool,
 				Description: "If true, the backend will require the cas parameter to be set for each write",
 			},
+			"delete_version_after": {
+				Type: framework.TypeSignedDurationSecond,
+				Description: `
+If set, the length of time before a version is deleted. A negative duration
+disables the use of delete_version_after on all keys. A zero duration
+clears the current setting. Accepts a Go duration format string.`,
+			},
 		},
 		Operations: map[logical.Operation]framework.OperationHandler{
 			logical.UpdateOperation: &framework.PathOperation{
@@ -51,11 +60,22 @@ func (b *versionedKVBackend) pathConfigRead() framework.OperationFunc {
 			return nil, err
 		}
 
+		rdata := map[string]interface{}{
+			"max_versions": config.MaxVersions,
+			"cas_required": config.CasRequired,
+		}
+
+		var deleteVersionAfter time.Duration
+		if config.GetDeleteVersionAfter() != nil {
+			deleteVersionAfter, err = ptypes.Duration(config.GetDeleteVersionAfter())
+			if err != nil {
+				return nil, err
+			}
+			rdata["delete_version_after"] = deleteVersionAfter.String()
+		}
+
 		return &logical.Response{
-			Data: map[string]interface{}{
-				"max_versions": config.MaxVersions,
-				"cas_required": config.CasRequired,
-			},
+			Data: rdata,
 		}, nil
 	}
 }
@@ -65,9 +85,10 @@ func (b *versionedKVBackend) pathConfigWrite() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 		maxRaw, mOk := data.GetOk("max_versions")
 		casRaw, cOk := data.GetOk("cas_required")
+		dvaRaw, dvaOk := data.GetOk("delete_version_after")
 
 		// Fast path validation
-		if !mOk && !cOk {
+		if !mOk && !cOk && !dvaOk {
 			return nil, nil
 		}
 
@@ -83,6 +104,18 @@ func (b *versionedKVBackend) pathConfigWrite() framework.OperationFunc {
 			config.CasRequired = casRaw.(bool)
 		}
 
+		if dvaOk {
+			dva := dvaRaw.(int)
+			switch {
+			case dva < 0:
+				config.DisableDeleteVersionAfter()
+			case dva == 0:
+				config.ResetDeleteVersionAfter()
+			default:
+				config.DeleteVersionAfter = ptypes.DurationProto(time.Duration(dva) * time.Second)
+			}
+		}
+
 		bytes, err := proto.Marshal(config)
 		if err != nil {
 			return nil, err
@@ -112,7 +145,12 @@ key-value store. This parameter accetps:
 
 	* max_versions (int) - The number of versions to keep for each key. Defaults
 	  to 10
-    
+
 	* cas_required (bool) - If true, the backend will require the cas parameter
 	  to be set for each write
+
+	* delete_version_after (duration) - If set, the length of time before a
+	  version is deleted. A negative duration disables the use of
+	  delete_version_after on all keys. A zero duration clears the current
+	  setting. Accepts a Go duration format string.
 `
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_data.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_data.go
index 0b5c7fdc4cdb..1d41f41cc467 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_data.go
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_data.go
@@ -34,7 +34,7 @@ func pathData(b *versionedKVBackend) *framework.Path {
 			},
 			"options": {
 				Type: framework.TypeMap,
-				Description: `Options for writing a KV entry. 
+				Description: `Options for writing a KV entry.
 
 Set the "cas" value to use a Check-And-Set operation. If not set the write will
 be allowed. If set to 0 a write will only be allowed if the key doesn’t exist.
@@ -247,6 +247,21 @@ func (b *versionedKVBackend) pathDataWrite() framework.OperationFunc {
 			CreatedTime: ptypes.TimestampNow(),
 		}
 
+		ctime, err := ptypes.Timestamp(version.CreatedTime)
+		if err != nil {
+			return logical.ErrorResponse("unexpected error converting %T(%v) to time.Time: %v", version.CreatedTime, version.CreatedTime, err), logical.ErrInvalidRequest
+		}
+
+		if !config.IsDeleteVersionAfterDisabled() {
+			if dtime, ok := deletionTime(ctime, deleteVersionAfter(config), deleteVersionAfter(meta)); ok {
+				dt, err := ptypes.TimestampProto(dtime)
+				if err != nil {
+					return logical.ErrorResponse("error setting deletion_time: converting %v to protobuf: %v", dtime, err), logical.ErrInvalidRequest
+				}
+				version.DeletionTime = dt
+			}
+		}
+
 		buf, err := proto.Marshal(version)
 		if err != nil {
 			return nil, err
@@ -260,7 +275,7 @@ func (b *versionedKVBackend) pathDataWrite() framework.OperationFunc {
 			return nil, err
 		}
 
-		vm, versionToDelete := meta.AddVersion(version.CreatedTime, nil, config.MaxVersions)
+		vm, versionToDelete := meta.AddVersion(version.CreatedTime, version.DeletionTime, config.MaxVersions)
 		err = b.writeKeyMetadata(ctx, req.Storage, meta)
 		if err != nil {
 			return nil, err
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_delete.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_delete.go
index 3fc56ad0f157..1560effbdf1b 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_delete.go
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_delete.go
@@ -66,6 +66,11 @@ func (b *versionedKVBackend) pathUndeleteWrite() framework.OperationFunc {
 			return logical.ErrorResponse("No version number provided"), logical.ErrInvalidRequest
 		}
 
+		config, err := b.config(ctx, req.Storage)
+		if err != nil {
+			return nil, err
+		}
+
 		lock := locksutil.LockForKey(b.locks, key)
 		lock.Lock()
 		defer lock.Unlock()
@@ -84,8 +89,17 @@ func (b *versionedKVBackend) pathUndeleteWrite() framework.OperationFunc {
 			if lv == nil || lv.Destroyed {
 				continue
 			}
-
 			lv.DeletionTime = nil
+
+			if !config.IsDeleteVersionAfterDisabled() {
+				if dtime, ok := deletionTime(time.Now(), deleteVersionAfter(config), deleteVersionAfter(meta)); ok {
+					dt, err := ptypes.TimestampProto(dtime)
+					if err != nil {
+						return logical.ErrorResponse("error setting deletion_time: converting %v to protobuf: %v", dtime, err), logical.ErrInvalidRequest
+					}
+					lv.DeletionTime = dt
+				}
+			}
 		}
 		err = b.writeKeyMetadata(ctx, req.Storage, meta)
 		if err != nil {
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_metadata.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_metadata.go
index cc45305a9b8c..87d6b71199dd 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_metadata.go
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/path_metadata.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/golang/protobuf/ptypes"
 	"github.com/hashicorp/vault/sdk/framework"
@@ -33,6 +34,15 @@ If false, the backend’s configuration will be used.`,
 The number of versions to keep. If not set, the backend’s configured max
 version is used.`,
 			},
+			"delete_version_after": {
+				Type: framework.TypeDurationSecond,
+				Description: `
+The length of time before a version is deleted. If not set, the backend's
+configured delete_version_after is used. Cannot be greater than the
+backend's delete_version_after. A zero duration clears the current setting.
+A negative duration will cause an error.
+`,
+			},
 		},
 		Callbacks: map[logical.Operation]framework.OperationFunc{
 			logical.UpdateOperation: b.upgradeCheck(b.pathMetadataWrite()),
@@ -108,15 +118,24 @@ func (b *versionedKVBackend) pathMetadataRead() framework.OperationFunc {
 			}
 		}
 
+		var deleteVersionAfter time.Duration
+		if meta.GetDeleteVersionAfter() != nil {
+			deleteVersionAfter, err = ptypes.Duration(meta.GetDeleteVersionAfter())
+			if err != nil {
+				return nil, err
+			}
+		}
+
 		return &logical.Response{
 			Data: map[string]interface{}{
-				"versions":        versions,
-				"current_version": meta.CurrentVersion,
-				"oldest_version":  meta.OldestVersion,
-				"created_time":    ptypesTimestampToString(meta.CreatedTime),
-				"updated_time":    ptypesTimestampToString(meta.UpdatedTime),
-				"max_versions":    meta.MaxVersions,
-				"cas_required":    meta.CasRequired,
+				"versions":             versions,
+				"current_version":      meta.CurrentVersion,
+				"oldest_version":       meta.OldestVersion,
+				"created_time":         ptypesTimestampToString(meta.CreatedTime),
+				"updated_time":         ptypesTimestampToString(meta.UpdatedTime),
+				"max_versions":         meta.MaxVersions,
+				"cas_required":         meta.CasRequired,
+				"delete_version_after": deleteVersionAfter.String(),
 			},
 		}, nil
 	}
@@ -131,9 +150,10 @@ func (b *versionedKVBackend) pathMetadataWrite() framework.OperationFunc {
 
 		maxRaw, mOk := data.GetOk("max_versions")
 		casRaw, cOk := data.GetOk("cas_required")
+		deleteVersionAfterRaw, dvaOk := data.GetOk("delete_version_after")
 
 		// Fast path validation
-		if !mOk && !cOk {
+		if !mOk && !cOk && !dvaOk {
 			return nil, nil
 		}
 
@@ -172,6 +192,9 @@ func (b *versionedKVBackend) pathMetadataWrite() framework.OperationFunc {
 		if cOk {
 			meta.CasRequired = casRaw.(bool)
 		}
+		if dvaOk {
+			meta.DeleteVersionAfter = ptypes.DurationProto(time.Duration(deleteVersionAfterRaw.(int)) * time.Second)
+		}
 
 		err = b.writeKeyMetadata(ctx, req.Storage, meta)
 		return resp, err
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.pb.go b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.pb.go
index 6acfb22ff25c..3eb8cd969380 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.pb.go
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.pb.go
@@ -1,25 +1,15 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: types.proto
 
-/*
-Package kv is a generated protocol buffer package.
-
-It is generated from these files:
-	types.proto
-
-It has these top-level messages:
-	Configuration
-	VersionMetadata
-	KeyMetadata
-	Version
-	UpgradeInfo
-*/
 package kv
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-import google_protobuf "github.com/golang/protobuf/ptypes/timestamp"
+import (
+	fmt "fmt"
+	proto "github.com/golang/protobuf/proto"
+	duration "github.com/golang/protobuf/ptypes/duration"
+	timestamp "github.com/golang/protobuf/ptypes/timestamp"
+	math "math"
+)
 
 // Reference imports to suppress errors if they are not otherwise used.
 var _ = proto.Marshal
@@ -30,17 +20,42 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 
+// If values are added to this, be sure to update the config() function
 type Configuration struct {
-	MaxVersions uint32 `protobuf:"varint,1,opt,name=max_versions,json=maxVersions" json:"max_versions,omitempty"`
-	CasRequired bool   `protobuf:"varint,2,opt,name=cas_required,json=casRequired" json:"cas_required,omitempty"`
+	MaxVersions          uint32             `protobuf:"varint,1,opt,name=max_versions,json=maxVersions,proto3" json:"max_versions,omitempty"`
+	CasRequired          bool               `protobuf:"varint,2,opt,name=cas_required,json=casRequired,proto3" json:"cas_required,omitempty"`
+	DeleteVersionAfter   *duration.Duration `protobuf:"bytes,3,opt,name=delete_version_after,json=deleteVersionAfter,proto3" json:"delete_version_after,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+	XXX_unrecognized     []byte             `json:"-"`
+	XXX_sizecache        int32              `json:"-"`
 }
 
-func (m *Configuration) Reset()                    { *m = Configuration{} }
-func (m *Configuration) String() string            { return proto.CompactTextString(m) }
-func (*Configuration) ProtoMessage()               {}
-func (*Configuration) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+func (m *Configuration) Reset()         { *m = Configuration{} }
+func (m *Configuration) String() string { return proto.CompactTextString(m) }
+func (*Configuration) ProtoMessage()    {}
+func (*Configuration) Descriptor() ([]byte, []int) {
+	return fileDescriptor_d938547f84707355, []int{0}
+}
+
+func (m *Configuration) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Configuration.Unmarshal(m, b)
+}
+func (m *Configuration) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Configuration.Marshal(b, m, deterministic)
+}
+func (m *Configuration) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Configuration.Merge(m, src)
+}
+func (m *Configuration) XXX_Size() int {
+	return xxx_messageInfo_Configuration.Size(m)
+}
+func (m *Configuration) XXX_DiscardUnknown() {
+	xxx_messageInfo_Configuration.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Configuration proto.InternalMessageInfo
 
 func (m *Configuration) GetMaxVersions() uint32 {
 	if m != nil {
@@ -56,31 +71,61 @@ func (m *Configuration) GetCasRequired() bool {
 	return false
 }
 
+func (m *Configuration) GetDeleteVersionAfter() *duration.Duration {
+	if m != nil {
+		return m.DeleteVersionAfter
+	}
+	return nil
+}
+
 type VersionMetadata struct {
 	// CreatedTime is when the version was created.
-	CreatedTime *google_protobuf.Timestamp `protobuf:"bytes,1,opt,name=created_time,json=createdTime" json:"created_time,omitempty"`
+	CreatedTime *timestamp.Timestamp `protobuf:"bytes,1,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
 	// DeletionTime is the time this version becomes invalid.
 	// Set to Now() to delete the version before the configured
 	// delete time.
-	DeletionTime *google_protobuf.Timestamp `protobuf:"bytes,2,opt,name=deletion_time,json=deletionTime" json:"deletion_time,omitempty"`
+	DeletionTime *timestamp.Timestamp `protobuf:"bytes,2,opt,name=deletion_time,json=deletionTime,proto3" json:"deletion_time,omitempty"`
 	// Destroyed is used to specify this version is
 	// a has been removed and the underlying data deleted.
-	Destroyed bool `protobuf:"varint,3,opt,name=destroyed" json:"destroyed,omitempty"`
+	Destroyed            bool     `protobuf:"varint,3,opt,name=destroyed,proto3" json:"destroyed,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *VersionMetadata) Reset()                    { *m = VersionMetadata{} }
-func (m *VersionMetadata) String() string            { return proto.CompactTextString(m) }
-func (*VersionMetadata) ProtoMessage()               {}
-func (*VersionMetadata) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+func (m *VersionMetadata) Reset()         { *m = VersionMetadata{} }
+func (m *VersionMetadata) String() string { return proto.CompactTextString(m) }
+func (*VersionMetadata) ProtoMessage()    {}
+func (*VersionMetadata) Descriptor() ([]byte, []int) {
+	return fileDescriptor_d938547f84707355, []int{1}
+}
+
+func (m *VersionMetadata) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_VersionMetadata.Unmarshal(m, b)
+}
+func (m *VersionMetadata) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_VersionMetadata.Marshal(b, m, deterministic)
+}
+func (m *VersionMetadata) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_VersionMetadata.Merge(m, src)
+}
+func (m *VersionMetadata) XXX_Size() int {
+	return xxx_messageInfo_VersionMetadata.Size(m)
+}
+func (m *VersionMetadata) XXX_DiscardUnknown() {
+	xxx_messageInfo_VersionMetadata.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_VersionMetadata proto.InternalMessageInfo
 
-func (m *VersionMetadata) GetCreatedTime() *google_protobuf.Timestamp {
+func (m *VersionMetadata) GetCreatedTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.CreatedTime
 	}
 	return nil
 }
 
-func (m *VersionMetadata) GetDeletionTime() *google_protobuf.Timestamp {
+func (m *VersionMetadata) GetDeletionTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.DeletionTime
 	}
@@ -96,32 +141,59 @@ func (m *VersionMetadata) GetDestroyed() bool {
 
 type KeyMetadata struct {
 	// Key is the key for this entry
-	Key string `protobuf:"bytes,1,opt,name=key" json:"key,omitempty"`
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
 	// Versions is the map of versionID -> VersionMetadata.
 	// Useful when listing all versions.
-	Versions map[uint64]*VersionMetadata `protobuf:"bytes,2,rep,name=versions" json:"versions,omitempty" protobuf_key:"varint,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	Versions map[uint64]*VersionMetadata `protobuf:"bytes,2,rep,name=versions,proto3" json:"versions,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// CurrentVersion is the latest version of the value
-	CurrentVersion uint64 `protobuf:"varint,3,opt,name=current_version,json=currentVersion" json:"current_version,omitempty"`
+	CurrentVersion uint64 `protobuf:"varint,3,opt,name=current_version,json=currentVersion,proto3" json:"current_version,omitempty"`
 	// OldestVersion is the oldest version of the value.
-	OldestVersion uint64 `protobuf:"varint,4,opt,name=oldest_version,json=oldestVersion" json:"oldest_version,omitempty"`
+	OldestVersion uint64 `protobuf:"varint,4,opt,name=oldest_version,json=oldestVersion,proto3" json:"oldest_version,omitempty"`
 	// Created time is when the metadata was created.
-	CreatedTime *google_protobuf.Timestamp `protobuf:"bytes,5,opt,name=created_time,json=createdTime" json:"created_time,omitempty"`
+	CreatedTime *timestamp.Timestamp `protobuf:"bytes,5,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
 	// Updated time was the last time the metadata version
 	// was updated.
-	UpdatedTime *google_protobuf.Timestamp `protobuf:"bytes,6,opt,name=updated_time,json=updatedTime" json:"updated_time,omitempty"`
+	UpdatedTime *timestamp.Timestamp `protobuf:"bytes,6,opt,name=updated_time,json=updatedTime,proto3" json:"updated_time,omitempty"`
 	// MaxVersions specifies how many versions to keep around.
 	// If empty value, defaults to the configured Max
 	// for the mount.
-	MaxVersions uint32 `protobuf:"varint,7,opt,name=max_versions,json=maxVersions" json:"max_versions,omitempty"`
+	MaxVersions uint32 `protobuf:"varint,7,opt,name=max_versions,json=maxVersions,proto3" json:"max_versions,omitempty"`
 	// CasRequired specifies if the cas parameter is
 	// required for this key
-	CasRequired bool `protobuf:"varint,8,opt,name=cas_required,json=casRequired" json:"cas_required,omitempty"`
+	CasRequired bool `protobuf:"varint,8,opt,name=cas_required,json=casRequired,proto3" json:"cas_required,omitempty"`
+	// DeleteVersionAfter specifies how long to keep versions around. If
+	// empty value, defaults to the configured delete_version_after for the
+	// mount.
+	DeleteVersionAfter   *duration.Duration `protobuf:"bytes,9,opt,name=delete_version_after,json=deleteVersionAfter,proto3" json:"delete_version_after,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+	XXX_unrecognized     []byte             `json:"-"`
+	XXX_sizecache        int32              `json:"-"`
+}
+
+func (m *KeyMetadata) Reset()         { *m = KeyMetadata{} }
+func (m *KeyMetadata) String() string { return proto.CompactTextString(m) }
+func (*KeyMetadata) ProtoMessage()    {}
+func (*KeyMetadata) Descriptor() ([]byte, []int) {
+	return fileDescriptor_d938547f84707355, []int{2}
+}
+
+func (m *KeyMetadata) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_KeyMetadata.Unmarshal(m, b)
+}
+func (m *KeyMetadata) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_KeyMetadata.Marshal(b, m, deterministic)
+}
+func (m *KeyMetadata) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_KeyMetadata.Merge(m, src)
+}
+func (m *KeyMetadata) XXX_Size() int {
+	return xxx_messageInfo_KeyMetadata.Size(m)
+}
+func (m *KeyMetadata) XXX_DiscardUnknown() {
+	xxx_messageInfo_KeyMetadata.DiscardUnknown(m)
 }
 
-func (m *KeyMetadata) Reset()                    { *m = KeyMetadata{} }
-func (m *KeyMetadata) String() string            { return proto.CompactTextString(m) }
-func (*KeyMetadata) ProtoMessage()               {}
-func (*KeyMetadata) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+var xxx_messageInfo_KeyMetadata proto.InternalMessageInfo
 
 func (m *KeyMetadata) GetKey() string {
 	if m != nil {
@@ -151,14 +223,14 @@ func (m *KeyMetadata) GetOldestVersion() uint64 {
 	return 0
 }
 
-func (m *KeyMetadata) GetCreatedTime() *google_protobuf.Timestamp {
+func (m *KeyMetadata) GetCreatedTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.CreatedTime
 	}
 	return nil
 }
 
-func (m *KeyMetadata) GetUpdatedTime() *google_protobuf.Timestamp {
+func (m *KeyMetadata) GetUpdatedTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.UpdatedTime
 	}
@@ -179,22 +251,52 @@ func (m *KeyMetadata) GetCasRequired() bool {
 	return false
 }
 
+func (m *KeyMetadata) GetDeleteVersionAfter() *duration.Duration {
+	if m != nil {
+		return m.DeleteVersionAfter
+	}
+	return nil
+}
+
 type Version struct {
 	// Data is a JSON object with string keys that
 	// represents the user supplied data.
 	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
 	// CreatedTime is when the version was created.
-	CreatedTime *google_protobuf.Timestamp `protobuf:"bytes,2,opt,name=created_time,json=createdTime" json:"created_time,omitempty"`
+	CreatedTime *timestamp.Timestamp `protobuf:"bytes,2,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
 	// DeletionTime is the time this version becomes invalid.
 	// Set to Now() to delete the version before the configured
 	// deletion time.
-	DeletionTime *google_protobuf.Timestamp `protobuf:"bytes,3,opt,name=deletion_time,json=deletionTime" json:"deletion_time,omitempty"`
+	DeletionTime         *timestamp.Timestamp `protobuf:"bytes,3,opt,name=deletion_time,json=deletionTime,proto3" json:"deletion_time,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}             `json:"-"`
+	XXX_unrecognized     []byte               `json:"-"`
+	XXX_sizecache        int32                `json:"-"`
 }
 
-func (m *Version) Reset()                    { *m = Version{} }
-func (m *Version) String() string            { return proto.CompactTextString(m) }
-func (*Version) ProtoMessage()               {}
-func (*Version) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
+func (m *Version) Reset()         { *m = Version{} }
+func (m *Version) String() string { return proto.CompactTextString(m) }
+func (*Version) ProtoMessage()    {}
+func (*Version) Descriptor() ([]byte, []int) {
+	return fileDescriptor_d938547f84707355, []int{3}
+}
+
+func (m *Version) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Version.Unmarshal(m, b)
+}
+func (m *Version) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Version.Marshal(b, m, deterministic)
+}
+func (m *Version) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Version.Merge(m, src)
+}
+func (m *Version) XXX_Size() int {
+	return xxx_messageInfo_Version.Size(m)
+}
+func (m *Version) XXX_DiscardUnknown() {
+	xxx_messageInfo_Version.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Version proto.InternalMessageInfo
 
 func (m *Version) GetData() []byte {
 	if m != nil {
@@ -203,14 +305,14 @@ func (m *Version) GetData() []byte {
 	return nil
 }
 
-func (m *Version) GetCreatedTime() *google_protobuf.Timestamp {
+func (m *Version) GetCreatedTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.CreatedTime
 	}
 	return nil
 }
 
-func (m *Version) GetDeletionTime() *google_protobuf.Timestamp {
+func (m *Version) GetDeletionTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.DeletionTime
 	}
@@ -219,18 +321,41 @@ func (m *Version) GetDeletionTime() *google_protobuf.Timestamp {
 
 type UpgradeInfo struct {
 	// Started time is when the upgrade was started.
-	StartedTime *google_protobuf.Timestamp `protobuf:"bytes,1,opt,name=started_time,json=startedTime" json:"started_time,omitempty"`
+	StartedTime *timestamp.Timestamp `protobuf:"bytes,1,opt,name=started_time,json=startedTime,proto3" json:"started_time,omitempty"`
 	// done is set to true once the backend has been successfully
 	// upgraded.
-	Done bool `protobuf:"varint,2,opt,name=done" json:"done,omitempty"`
+	Done                 bool     `protobuf:"varint,2,opt,name=done,proto3" json:"done,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *UpgradeInfo) Reset()         { *m = UpgradeInfo{} }
+func (m *UpgradeInfo) String() string { return proto.CompactTextString(m) }
+func (*UpgradeInfo) ProtoMessage()    {}
+func (*UpgradeInfo) Descriptor() ([]byte, []int) {
+	return fileDescriptor_d938547f84707355, []int{4}
+}
+
+func (m *UpgradeInfo) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_UpgradeInfo.Unmarshal(m, b)
+}
+func (m *UpgradeInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_UpgradeInfo.Marshal(b, m, deterministic)
+}
+func (m *UpgradeInfo) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_UpgradeInfo.Merge(m, src)
+}
+func (m *UpgradeInfo) XXX_Size() int {
+	return xxx_messageInfo_UpgradeInfo.Size(m)
+}
+func (m *UpgradeInfo) XXX_DiscardUnknown() {
+	xxx_messageInfo_UpgradeInfo.DiscardUnknown(m)
 }
 
-func (m *UpgradeInfo) Reset()                    { *m = UpgradeInfo{} }
-func (m *UpgradeInfo) String() string            { return proto.CompactTextString(m) }
-func (*UpgradeInfo) ProtoMessage()               {}
-func (*UpgradeInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
+var xxx_messageInfo_UpgradeInfo proto.InternalMessageInfo
 
-func (m *UpgradeInfo) GetStartedTime() *google_protobuf.Timestamp {
+func (m *UpgradeInfo) GetStartedTime() *timestamp.Timestamp {
 	if m != nil {
 		return m.StartedTime
 	}
@@ -248,40 +373,44 @@ func init() {
 	proto.RegisterType((*Configuration)(nil), "kv.Configuration")
 	proto.RegisterType((*VersionMetadata)(nil), "kv.VersionMetadata")
 	proto.RegisterType((*KeyMetadata)(nil), "kv.KeyMetadata")
+	proto.RegisterMapType((map[uint64]*VersionMetadata)(nil), "kv.KeyMetadata.VersionsEntry")
 	proto.RegisterType((*Version)(nil), "kv.Version")
 	proto.RegisterType((*UpgradeInfo)(nil), "kv.UpgradeInfo")
 }
 
-func init() { proto.RegisterFile("types.proto", fileDescriptor0) }
-
-var fileDescriptor0 = []byte{
-	// 436 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x93, 0xdf, 0x8a, 0x13, 0x31,
-	0x18, 0xc5, 0x99, 0x3f, 0xbb, 0xdb, 0xfd, 0x32, 0xb3, 0x2b, 0xf1, 0xa6, 0x14, 0xc5, 0x3a, 0x20,
-	0xd6, 0x9b, 0x59, 0x58, 0x6f, 0x54, 0x58, 0xbc, 0x10, 0x2f, 0x44, 0x04, 0x09, 0xae, 0xb7, 0x35,
-	0xdb, 0x7c, 0x2d, 0x43, 0xdb, 0xc9, 0x98, 0x64, 0xca, 0xce, 0xc3, 0xf8, 0x0c, 0xbe, 0x82, 0x8f,
-	0x26, 0xc9, 0x24, 0xdd, 0xb5, 0x0a, 0xa5, 0x78, 0x17, 0x4e, 0xcf, 0x09, 0xbf, 0x9e, 0x39, 0x01,
-	0x62, 0xba, 0x06, 0x75, 0xd9, 0x28, 0x69, 0x24, 0x8d, 0x97, 0x9b, 0xd1, 0x93, 0x85, 0x94, 0x8b,
-	0x15, 0x5e, 0x38, 0xe5, 0xa6, 0x9d, 0x5f, 0x98, 0x6a, 0x8d, 0xda, 0xf0, 0x75, 0xd3, 0x9b, 0x8a,
-	0x6b, 0xc8, 0xdf, 0xc9, 0x7a, 0x5e, 0x2d, 0x5a, 0xc5, 0x4d, 0x25, 0x6b, 0xfa, 0x14, 0xb2, 0x35,
-	0xbf, 0x9d, 0x6e, 0x50, 0xe9, 0x4a, 0xd6, 0x7a, 0x18, 0x8d, 0xa3, 0x49, 0xce, 0xc8, 0x9a, 0xdf,
-	0x7e, 0xf5, 0x92, 0xb5, 0xcc, 0xb8, 0x9e, 0x2a, 0xfc, 0xde, 0x56, 0x0a, 0xc5, 0x30, 0x1e, 0x47,
-	0x93, 0x01, 0x23, 0x33, 0xae, 0x99, 0x97, 0x8a, 0x9f, 0x11, 0x9c, 0x7b, 0xff, 0x27, 0x34, 0x5c,
-	0x70, 0xc3, 0xe9, 0x15, 0x64, 0x33, 0x85, 0xdc, 0xa0, 0x98, 0x5a, 0x0a, 0x77, 0x33, 0xb9, 0x1c,
-	0x95, 0x3d, 0x62, 0x19, 0x10, 0xcb, 0x2f, 0x01, 0x91, 0x11, 0xef, 0xb7, 0x0a, 0x7d, 0x0b, 0xb9,
-	0xc0, 0x15, 0x5a, 0xc8, 0x3e, 0x1f, 0xef, 0xcd, 0x67, 0x21, 0xe0, 0x2e, 0x78, 0x04, 0xa7, 0x02,
-	0xb5, 0x51, 0xb2, 0x43, 0x31, 0x4c, 0x1c, 0xf3, 0x9d, 0x50, 0xfc, 0x4a, 0x80, 0x7c, 0xc4, 0x6e,
-	0x4b, 0xfb, 0x00, 0x92, 0x25, 0x76, 0x0e, 0xf2, 0x94, 0xd9, 0x23, 0x7d, 0x0d, 0x83, 0x6d, 0x2b,
-	0xf1, 0x38, 0x99, 0x90, 0xcb, 0xc7, 0xe5, 0x72, 0x53, 0xde, 0x0b, 0x95, 0xa1, 0xa2, 0xf7, 0xb5,
-	0x51, 0x1d, 0xdb, 0xda, 0xe9, 0x73, 0x38, 0x9f, 0xb5, 0x4a, 0x61, 0x6d, 0x42, 0xb1, 0x0e, 0x20,
-	0x65, 0x67, 0x5e, 0xf6, 0x41, 0xfa, 0x0c, 0xce, 0xe4, 0xca, 0x42, 0x6d, 0x7d, 0xa9, 0xf3, 0xe5,
-	0xbd, 0x1a, 0x6c, 0xbb, 0x55, 0x1e, 0x1d, 0x56, 0xe5, 0x15, 0x64, 0x6d, 0x23, 0xee, 0xe2, 0xc7,
-	0xfb, 0xe3, 0xde, 0xef, 0xe2, 0xbb, 0x13, 0x39, 0xd9, 0x3f, 0x91, 0xc1, 0x5f, 0x13, 0x19, 0x7d,
-	0x86, 0xfc, 0x8f, 0xba, 0xee, 0x37, 0x9e, 0xf6, 0x8d, 0xbf, 0x80, 0xa3, 0x0d, 0x5f, 0xb5, 0xe1,
-	0x53, 0x3f, 0xb4, 0x75, 0xef, 0xac, 0x8a, 0xf5, 0x8e, 0x37, 0xf1, 0xab, 0xa8, 0xf8, 0x11, 0xc1,
-	0x49, 0x68, 0x88, 0x42, 0x6a, 0x7f, 0x76, 0xb7, 0x65, 0x2c, 0xfd, 0xe7, 0x00, 0xe3, 0xff, 0x1c,
-	0x60, 0x72, 0xd8, 0x00, 0x8b, 0x6f, 0x40, 0xae, 0x9b, 0x85, 0xe2, 0x02, 0x3f, 0xd4, 0x73, 0x69,
-	0x71, 0xb4, 0xe1, 0xea, 0x90, 0xf7, 0xe0, 0xfd, 0x0e, 0xc7, 0xfe, 0x43, 0x59, 0xa3, 0x7f, 0x7d,
-	0xee, 0x7c, 0x73, 0xec, 0x42, 0x2f, 0x7f, 0x07, 0x00, 0x00, 0xff, 0xff, 0xa2, 0xd2, 0xb5, 0x3c,
-	0x08, 0x04, 0x00, 0x00,
+func init() { proto.RegisterFile("types.proto", fileDescriptor_d938547f84707355) }
+
+var fileDescriptor_d938547f84707355 = []byte{
+	// 484 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x54, 0xcd, 0x8e, 0xd3, 0x30,
+	0x18, 0x54, 0xd2, 0xec, 0x6e, 0xfb, 0x39, 0xd9, 0x45, 0x86, 0x43, 0xa9, 0xf8, 0x29, 0x91, 0x10,
+	0xe5, 0x92, 0x95, 0xca, 0x05, 0x90, 0x56, 0x08, 0x01, 0x07, 0xb4, 0x42, 0x42, 0x16, 0x70, 0x2d,
+	0xde, 0xfa, 0x6b, 0x15, 0xb5, 0x8d, 0x83, 0xe3, 0x54, 0x9b, 0x87, 0xe0, 0x11, 0xb8, 0xf0, 0x02,
+	0xbc, 0x22, 0xb2, 0x63, 0x77, 0x97, 0x82, 0x54, 0x0a, 0x37, 0x6b, 0x3c, 0xf3, 0x79, 0x3c, 0x9e,
+	0x04, 0x88, 0x6e, 0x4a, 0xac, 0xb2, 0x52, 0x49, 0x2d, 0x69, 0xb8, 0x58, 0x0f, 0xee, 0xcf, 0xa5,
+	0x9c, 0x2f, 0xf1, 0xd4, 0x22, 0x17, 0xf5, 0xec, 0x54, 0xe7, 0x2b, 0xac, 0x34, 0x5f, 0x95, 0x2d,
+	0x69, 0x70, 0x6f, 0x9b, 0x20, 0x6a, 0xc5, 0x75, 0x2e, 0x8b, 0x76, 0x3f, 0xfd, 0x1e, 0x40, 0xf2,
+	0x4a, 0x16, 0xb3, 0x7c, 0xee, 0x70, 0xfa, 0x00, 0xe2, 0x15, 0xbf, 0x9c, 0xac, 0x51, 0x55, 0xb9,
+	0x2c, 0xaa, 0x7e, 0x30, 0x0c, 0x46, 0x09, 0x23, 0x2b, 0x7e, 0xf9, 0xc9, 0x41, 0x86, 0x32, 0xe5,
+	0xd5, 0x44, 0xe1, 0x97, 0x3a, 0x57, 0x28, 0xfa, 0xe1, 0x30, 0x18, 0x75, 0x19, 0x99, 0xf2, 0x8a,
+	0x39, 0x88, 0x9e, 0xc3, 0x2d, 0x81, 0x4b, 0xd4, 0xe8, 0x07, 0x4d, 0xf8, 0x4c, 0xa3, 0xea, 0x77,
+	0x86, 0xc1, 0x88, 0x8c, 0x6f, 0x67, 0xad, 0xad, 0xcc, 0xdb, 0xca, 0x5e, 0xbb, 0xe3, 0x19, 0x6d,
+	0x65, 0xee, 0xac, 0x97, 0x46, 0x94, 0xfe, 0x08, 0xe0, 0xc4, 0x01, 0xef, 0x50, 0x73, 0xc1, 0x35,
+	0xa7, 0x67, 0x10, 0x4f, 0x15, 0x72, 0x8d, 0x62, 0x62, 0xee, 0x6c, 0x6d, 0x92, 0xf1, 0xe0, 0xb7,
+	0xc1, 0x1f, 0x7c, 0x20, 0x8c, 0x38, 0xbe, 0x41, 0xe8, 0x0b, 0x48, 0xec, 0x41, 0xc6, 0x99, 0xd5,
+	0x87, 0x3b, 0xf5, 0xb1, 0x17, 0xd8, 0x01, 0x77, 0xa0, 0x27, 0xb0, 0xd2, 0x4a, 0x36, 0x28, 0xec,
+	0xad, 0xba, 0xec, 0x0a, 0x48, 0xbf, 0x46, 0x40, 0xce, 0xb1, 0xd9, 0xb8, 0xbd, 0x01, 0x9d, 0x05,
+	0x36, 0xd6, 0x64, 0x8f, 0x99, 0x25, 0x7d, 0x06, 0xdd, 0x4d, 0xc4, 0xe1, 0xb0, 0x33, 0x22, 0xe3,
+	0xbb, 0xd9, 0x62, 0x9d, 0x5d, 0x13, 0x65, 0x3e, 0xef, 0x37, 0x85, 0x56, 0x0d, 0xdb, 0xd0, 0xe9,
+	0x23, 0x38, 0x99, 0xd6, 0x4a, 0x61, 0xa1, 0x7d, 0xb8, 0xd6, 0x40, 0xc4, 0x8e, 0x1d, 0xec, 0x84,
+	0xf4, 0x21, 0x1c, 0xcb, 0xa5, 0x31, 0xb5, 0xe1, 0x45, 0x96, 0x97, 0xb4, 0xa8, 0xa7, 0x6d, 0x47,
+	0x79, 0xb0, 0x5f, 0x94, 0x67, 0x10, 0xd7, 0xa5, 0xb8, 0x92, 0x1f, 0xee, 0x96, 0x3b, 0xbe, 0x95,
+	0x6f, 0xf7, 0xed, 0x68, 0x77, 0xdf, 0xba, 0x7f, 0xdf, 0xb7, 0xde, 0x3f, 0xf4, 0x6d, 0xf0, 0x1e,
+	0x92, 0x5f, 0xb2, 0xbf, 0xfe, 0x7c, 0x51, 0xfb, 0x7c, 0x8f, 0xe1, 0x60, 0xcd, 0x97, 0xb5, 0xef,
+	0xcd, 0x4d, 0xf3, 0x76, 0x5b, 0x15, 0x65, 0x2d, 0xe3, 0x79, 0xf8, 0x34, 0x48, 0xbf, 0x05, 0x70,
+	0xe4, 0xe3, 0xa6, 0x10, 0x99, 0x6d, 0x3b, 0x2d, 0x66, 0xd1, 0x1f, 0xdb, 0x1c, 0xfe, 0x67, 0x9b,
+	0x3b, 0xfb, 0xb5, 0x39, 0xfd, 0x0c, 0xe4, 0x63, 0x39, 0x57, 0x5c, 0xe0, 0xdb, 0x62, 0x26, 0x8d,
+	0x9d, 0x4a, 0x73, 0xb5, 0xcf, 0xc7, 0xe5, 0xf8, 0xd6, 0x8e, 0xb9, 0xa1, 0x2c, 0xd0, 0xfd, 0x17,
+	0xec, 0xfa, 0xe2, 0xd0, 0x8a, 0x9e, 0xfc, 0x0c, 0x00, 0x00, 0xff, 0xff, 0x81, 0xe5, 0xbe, 0x7d,
+	0xc3, 0x04, 0x00, 0x00,
 }
diff --git a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.proto b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.proto
index aaa3a821e14b..f45095f63845 100644
--- a/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.proto
+++ b/vendor/github.com/hashicorp/vault-plugin-secrets-kv/types.proto
@@ -2,11 +2,13 @@ syntax = "proto3";
 package kv;
 
 import "google/protobuf/timestamp.proto";
+import "google/protobuf/duration.proto";
 
 // If values are added to this, be sure to update the config() function
 message Configuration {
 	uint32 max_versions = 1;
 	bool cas_required = 2;
+	google.protobuf.Duration delete_version_after = 3;
 }
 
 message VersionMetadata {
@@ -52,6 +54,11 @@ message KeyMetadata {
 	// CasRequired specifies if the cas parameter is 
 	// required for this key
 	bool cas_required = 8;
+
+	// DeleteVersionAfter specifies how long to keep versions around. If
+	// empty value, defaults to the configured delete_version_after for the
+	// mount.
+	google.protobuf.Duration delete_version_after = 9;
 }
 
 
diff --git a/vendor/github.com/hashicorp/vault/api/response.go b/vendor/github.com/hashicorp/vault/api/response.go
index f224972d5878..aed2a52e0869 100644
--- a/vendor/github.com/hashicorp/vault/api/response.go
+++ b/vendor/github.com/hashicorp/vault/api/response.go
@@ -42,32 +42,27 @@ func (r *Response) Error() error {
 	r.Body.Close()
 	r.Body = ioutil.NopCloser(bodyBuf)
 
+	// Build up the error object
+	respErr := &ResponseError{
+		HTTPMethod: r.Request.Method,
+		URL:        r.Request.URL.String(),
+		StatusCode: r.StatusCode,
+	}
+
 	// Decode the error response if we can. Note that we wrap the bodyBuf
 	// in a bytes.Reader here so that the JSON decoder doesn't move the
 	// read pointer for the original buffer.
 	var resp ErrorResponse
 	if err := jsonutil.DecodeJSON(bodyBuf.Bytes(), &resp); err != nil {
-		// Ignore the decoding error and just drop the raw response
-		return fmt.Errorf(
-			"Error making API request.\n\n"+
-				"URL: %s %s\n"+
-				"Code: %d. Raw Message:\n\n%s",
-			r.Request.Method, r.Request.URL.String(),
-			r.StatusCode, bodyBuf.String())
+		// Store the fact that we couldn't decode the errors
+		respErr.RawError = true
+		respErr.Errors = []string{bodyBuf.String()}
+	} else {
+		// Store the decoded errors
+		respErr.Errors = resp.Errors
 	}
 
-	var errBody bytes.Buffer
-	errBody.WriteString(fmt.Sprintf(
-		"Error making API request.\n\n"+
-			"URL: %s %s\n"+
-			"Code: %d. Errors:\n\n",
-		r.Request.Method, r.Request.URL.String(),
-		r.StatusCode))
-	for _, err := range resp.Errors {
-		errBody.WriteString(fmt.Sprintf("* %s", err))
-	}
-
-	return fmt.Errorf(errBody.String())
+	return respErr
 }
 
 // ErrorResponse is the raw structure of errors when they're returned by the
@@ -75,3 +70,51 @@ func (r *Response) Error() error {
 type ErrorResponse struct {
 	Errors []string
 }
+
+// ResponseError is the error returned when Vault responds with an error or
+// non-success HTTP status code. If a request to Vault fails because of a
+// network error a different error message will be returned. ResponseError gives
+// access to the underlying errors and status code.
+type ResponseError struct {
+	// HTTPMethod is the HTTP method for the request (PUT, GET, etc).
+	HTTPMethod string
+
+	// URL is the URL of the request.
+	URL string
+
+	// StatusCode is the HTTP status code.
+	StatusCode int
+
+	// RawError marks that the underlying error messages returned by Vault were
+	// not parsable. The Errors slice will contain the raw response body as the
+	// first and only error string if this value is set to true.
+	RawError bool
+
+	// Errors are the underlying errors returned by Vault.
+	Errors []string
+}
+
+// Error returns a human-readable error string for the response error.
+func (r *ResponseError) Error() string {
+	errString := "Errors"
+	if r.RawError {
+		errString = "Raw Message"
+	}
+
+	var errBody bytes.Buffer
+	errBody.WriteString(fmt.Sprintf(
+		"Error making API request.\n\n"+
+			"URL: %s %s\n"+
+			"Code: %d. %s:\n\n",
+		r.HTTPMethod, r.URL, r.StatusCode, errString))
+
+	if r.RawError && len(r.Errors) == 1 {
+		errBody.WriteString(r.Errors[0])
+	} else {
+		for _, err := range r.Errors {
+			errBody.WriteString(fmt.Sprintf("* %s", err))
+		}
+	}
+
+	return errBody.String()
+}
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/backend.go b/vendor/github.com/hashicorp/vault/sdk/framework/backend.go
index edf2a407600a..721d23f3e776 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/backend.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/backend.go
@@ -539,7 +539,7 @@ type FieldSchema struct {
 func (s *FieldSchema) DefaultOrZero() interface{} {
 	if s.Default != nil {
 		switch s.Type {
-		case TypeDurationSecond:
+		case TypeDurationSecond, TypeSignedDurationSecond:
 			resultDur, err := parseutil.ParseDurationSecond(s.Default)
 			if err != nil {
 				return s.Type.Zero()
@@ -567,7 +567,7 @@ func (t FieldType) Zero() interface{} {
 		return map[string]interface{}{}
 	case TypeKVPairs:
 		return map[string]string{}
-	case TypeDurationSecond:
+	case TypeDurationSecond, TypeSignedDurationSecond:
 		return 0
 	case TypeSlice:
 		return []interface{}{}
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/field_data.go b/vendor/github.com/hashicorp/vault/sdk/framework/field_data.go
index e66d0772fe07..46b120c43251 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/field_data.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/field_data.go
@@ -38,8 +38,8 @@ func (d *FieldData) Validate() error {
 		}
 
 		switch schema.Type {
-		case TypeBool, TypeInt, TypeMap, TypeDurationSecond, TypeString, TypeLowerCaseString,
-			TypeNameString, TypeSlice, TypeStringSlice, TypeCommaStringSlice,
+		case TypeBool, TypeInt, TypeMap, TypeDurationSecond, TypeSignedDurationSecond, TypeString,
+			TypeLowerCaseString, TypeNameString, TypeSlice, TypeStringSlice, TypeCommaStringSlice,
 			TypeKVPairs, TypeCommaIntSlice, TypeHeader:
 			_, _, err := d.getPrimitive(field, schema)
 			if err != nil {
@@ -131,8 +131,8 @@ func (d *FieldData) GetOkErr(k string) (interface{}, bool, error) {
 	}
 
 	switch schema.Type {
-	case TypeBool, TypeInt, TypeMap, TypeDurationSecond, TypeString, TypeLowerCaseString,
-		TypeNameString, TypeSlice, TypeStringSlice, TypeCommaStringSlice,
+	case TypeBool, TypeInt, TypeMap, TypeDurationSecond, TypeSignedDurationSecond, TypeString,
+		TypeLowerCaseString, TypeNameString, TypeSlice, TypeStringSlice, TypeCommaStringSlice,
 		TypeKVPairs, TypeCommaIntSlice, TypeHeader:
 		return d.getPrimitive(k, schema)
 	default:
@@ -147,7 +147,7 @@ func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bo
 		return nil, false, nil
 	}
 
-	switch schema.Type {
+	switch t := schema.Type; t {
 	case TypeBool:
 		var result bool
 		if err := mapstructure.WeakDecode(raw, &result); err != nil {
@@ -197,7 +197,7 @@ func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bo
 		}
 		return result, true, nil
 
-	case TypeDurationSecond:
+	case TypeDurationSecond, TypeSignedDurationSecond:
 		var result int
 		switch inp := raw.(type) {
 		case nil:
@@ -209,7 +209,7 @@ func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bo
 			}
 			result = int(dur.Seconds())
 		}
-		if result < 0 {
+		if t == TypeDurationSecond && result < 0 {
 			return nil, false, fmt.Errorf("cannot provide negative value '%d'", result)
 		}
 		return result, true, nil
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/field_type.go b/vendor/github.com/hashicorp/vault/sdk/framework/field_type.go
index 64a6a56dc08c..2e1121ca6d29 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/field_type.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/field_type.go
@@ -14,6 +14,11 @@ const (
 	// integer or go duration format string (e.g. 24h)
 	TypeDurationSecond
 
+	// TypeSignedDurationSecond represents a positive or negative duration
+	// as seconds, this can be either an integer or go duration format
+	// string (e.g. 24h).
+	TypeSignedDurationSecond
+
 	// TypeSlice represents a slice of any type
 	TypeSlice
 
@@ -66,7 +71,7 @@ func (t FieldType) String() string {
 		return "map"
 	case TypeKVPairs:
 		return "keypair"
-	case TypeDurationSecond:
+	case TypeDurationSecond, TypeSignedDurationSecond:
 		return "duration (sec)"
 	case TypeSlice, TypeStringSlice, TypeCommaStringSlice, TypeCommaIntSlice:
 		return "slice"
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/openapi.go b/vendor/github.com/hashicorp/vault/sdk/framework/openapi.go
index 1696b20aaf70..1fa238999a63 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/openapi.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/openapi.go
@@ -552,7 +552,7 @@ func convertType(t FieldType) schemaType {
 		ret.format = "lowercase"
 	case TypeInt:
 		ret.baseType = "integer"
-	case TypeDurationSecond:
+	case TypeDurationSecond, TypeSignedDurationSecond:
 		ret.baseType = "integer"
 		ret.format = "seconds"
 	case TypeBool:
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/path_map.go b/vendor/github.com/hashicorp/vault/sdk/framework/path_map.go
index bb675cee0108..8e1b91864b77 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/path_map.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/path_map.go
@@ -10,6 +10,9 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
+// DEPRECATED: Don't use this. It's too inflexible, nearly impossible to use
+// with some modern Vault features, and imposes specific API designs.
+//
 // PathMap can be used to generate a path that stores mappings in the
 // storage. It is a structure that also exports functions for querying the
 // mappings.
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/policy_map.go b/vendor/github.com/hashicorp/vault/sdk/framework/policy_map.go
index a20405561e86..7657b4b0a92d 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/policy_map.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/policy_map.go
@@ -8,6 +8,9 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
+// DEPRECATED: Don't use this. It's too inflexible, nearly impossible to use
+// with some modern Vault features, and imposes specific API designs.
+//
 // PolicyMap is a specialization of PathMap that expects the values to
 // be lists of policies. This assists in querying and loading policies
 // from the PathMap.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 35c5b1041d0c..946b2be0fdb7 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -360,11 +360,11 @@ github.com/hashicorp/vault-plugin-secrets-gcp/plugin/iamutil
 github.com/hashicorp/vault-plugin-secrets-gcp/plugin/util
 # github.com/hashicorp/vault-plugin-secrets-gcpkms v0.5.2-0.20190516000311-88f9a4f11829
 github.com/hashicorp/vault-plugin-secrets-gcpkms
-# github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190416155133-fd495225dea0
+# github.com/hashicorp/vault-plugin-secrets-kv v0.5.2-0.20190626201950-a6e92ff82578
 github.com/hashicorp/vault-plugin-secrets-kv
 # github.com/hashicorp/vault/api v1.0.3-0.20190621032639-b2bd2690d46a => ./api
 github.com/hashicorp/vault/api
-# github.com/hashicorp/vault/sdk v0.1.12-0.20190624011739-68b40b814cc2 => ./sdk
+# github.com/hashicorp/vault/sdk v0.1.12-0.20190626183508-cc3a81801f98 => ./sdk
 github.com/hashicorp/vault/sdk/helper/salt
 github.com/hashicorp/vault/sdk/helper/strutil
 github.com/hashicorp/vault/sdk/helper/wrapping