HashiCorp Vault

The industry-standard secrets management platform for securing API keys, passwords, certificates, and database credentials. Vault's most powerful feature: dynamic secrets — on-demand, short-lived credentials for databases, AWS, and PKI that are automatically revoked, eliminating long-lived credential leaks.

What is HashiCorp Vault?

Vault is more than a secret store — it is a secret lifecycle management platform. Where environment variables or AWS Secrets Manager store static credentials, Vault generates ephemeral credentials on demand. When your app requests a Postgres credential, Vault creates a real database user with a 1-hour TTL, returns the username and password, and revokes both when the lease expires. The database never has long-lived app credentials.

Vault's policy system (HCL) controls exactly which paths each token can access and with which operations (read, write, list, delete). Every request is logged in the immutable audit log. Integration with Kubernetes via the Agent Injector or Secrets Operator makes it the standard choice for secret management in cloud-native environments.

Quick Start (Docker)

# Development server (in-memory, no persistence)
docker run --cap-add=IPC_LOCK -p 8200:8200 hashicorp/vault server -dev

# Production (file storage)
docker run --cap-add=IPC_LOCK   -p 8200:8200   -v vault-config:/vault/config   -v vault-data:/vault/data   hashicorp/vault server

# Access UI at http://localhost:8200
# Dev mode root token: printed in container logs

Policies and Dynamic Secrets

# Vault policy (HCL)
# web-app-policy.hcl
path "secret/data/web-app/*" {
  capabilities = ["read", "list"]
}

path "database/creds/web-app-role" {
  capabilities = ["read"]
}

path "pki/issue/web-app-cert" {
  capabilities = ["create", "update"]
}

# Apply policy
vault policy write web-app web-app-policy.hcl

# Write a secret
vault kv put secret/web-app/database   username=appuser   password=s3cr3t

# Read a secret
vault kv get secret/web-app/database

# Enable dynamic database secrets
vault secrets enable database
vault write database/config/postgres   plugin_name=postgresql-database-plugin   connection_url="postgresql://{{username}}:{{password}}@postgres:5432/app"   allowed_roles="web-app-role"   username=vaultadmin   password=vaultpass

Node.js Integration

// Node.js — fetch secrets from Vault
import vault from 'node-vault';

const client = vault({
  apiVersion: 'v1',
  endpoint: process.env.VAULT_ADDR,
  token: process.env.VAULT_TOKEN,
});

// KV v2 — read secret
const { data } = await client.read('secret/data/web-app/database');
const { username, password } = data.data;

// AppRole auth (recommended for apps)
const { auth } = await client.approleLogin({
  role_id: process.env.VAULT_ROLE_ID,
  secret_id: process.env.VAULT_SECRET_ID,
});
client.token = auth.client_token;

// Dynamic database credentials (short-lived, rotated)
const dbCreds = await client.read('database/creds/web-app-role');
// dbCreds.data.username and dbCreds.data.password are ephemeral

Kubernetes Agent Injector

# Vault Agent Injector — auto-inject secrets into Pods
# Install via Helm
helm repo add hashicorp https://helm.releases.hashicorp.com
helm install vault hashicorp/vault   --set "injector.enabled=true"   --namespace vault --create-namespace

# Annotate deployment to inject secrets
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "web-app"
        vault.hashicorp.com/agent-inject-secret-db: "secret/data/web-app/database"
        vault.hashicorp.com/agent-inject-template-db: |
          {{- with secret "secret/data/web-app/database" -}}
          export DB_USER="{{ .Data.data.username }}"
          export DB_PASS="{{ .Data.data.password }}"
          {{- end }}