HashiCorp Vault

Centralize secrets management across cloud and on-premises. Store static secrets, generate dynamic credentials that expire automatically, and control access with fine-grained policies and full audit logging.

Dev Server Quickstart

# Install Vault CLI
brew install vault    # macOS
# Linux: download from releases.hashicorp.com/vault/

# Start a dev server (in-memory, do NOT use in production)
vault server -dev -dev-root-token-id="root"

# In a new terminal, set env vars
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'

# Verify connectivity
vault status

KV v2 Secrets Engine

# Enable KV v2 at a path
vault secrets enable -path=secret -version=2 kv

# Write a secret
vault kv put secret/my-app/config \
  db_url="postgres://user:pass@db:5432/myapp" \
  api_key="sk-abc123"

# Read the latest version
vault kv get secret/my-app/config

# Read a specific version
vault kv get -version=1 secret/my-app/config

# Update (creates new version)
vault kv put secret/my-app/config \
  db_url="postgres://user:newpass@db:5432/myapp" \
  api_key="sk-abc123"

# List all versions (metadata)
vault kv metadata get secret/my-app/config

# Delete (soft delete — still recoverable)
vault kv delete secret/my-app/config

# Permanently destroy version 1
vault kv destroy -versions=1 secret/my-app/config

Dynamic Database Credentials

# Enable the database secrets engine
vault secrets enable database

# Configure PostgreSQL connection (Vault connects with a superuser to create creds)
vault write database/config/my-postgres \
  plugin_name=postgresql-database-plugin \
  allowed_roles="app-role" \
  connection_url="postgresql://{{username}}:{{password}}@postgres:5432/myapp?sslmode=disable" \
  username="vault_superuser" \
  password="superpassword"

# Create a role with a SQL template for credential creation
vault write database/roles/app-role \
  db_name=my-postgres \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# Request dynamic credentials (each call returns unique creds)
vault read database/creds/app-role
# Key                Value
# lease_duration     1h
# username           v-app-role-xK3mQ9pZ2r-1234567890
# password           A1b2C3d4E5f6G7h8I9j0

Kubernetes Auth and Vault Agent Sidecar

# 1. Enable Kubernetes auth method in Vault
vault auth enable kubernetes

# 2. Configure with cluster details (run inside the cluster)
vault write auth/kubernetes/config \
  kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
  token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

# 3. Create a Vault policy for the app
vault policy write my-app - <<EOF
path "secret/data/my-app/*" {
  capabilities = ["read"]
}
path "database/creds/app-role" {
  capabilities = ["read"]
}
EOF

# 4. Create a Vault role binding Kubernetes SA to policy
vault write auth/kubernetes/role/my-app \
  bound_service_account_names=my-app-sa \
  bound_service_account_namespaces=production \
  policies=my-app \
  ttl=24h

# Pod with Vault Agent sidecar annotations
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "my-app"
        # Inject KV secret to /vault/secrets/config.txt
        vault.hashicorp.com/agent-inject-secret-config.txt: "secret/data/my-app/config"
        # Custom template for the secret file format
        vault.hashicorp.com/agent-inject-template-config.txt: |
          {{- with secret "secret/data/my-app/config" -}}
          DB_URL={{ .Data.data.db_url }}
          API_KEY={{ .Data.data.api_key }}
          {{- end -}}
    spec:
      serviceAccountName: my-app-sa
      containers:
        - name: my-app
          image: my-app:latest
          # App reads secrets from /vault/secrets/config.txt

AppRole Authentication (for CI/CD)

# Enable AppRole auth
vault auth enable approle

# Create AppRole for a CI/CD pipeline
vault write auth/approle/role/ci-pipeline \
  secret_id_ttl=10m \
  token_num_uses=10 \
  token_ttl=20m \
  token_max_ttl=30m \
  policies=my-app

# Get the Role ID (static, safe to store)
vault read auth/approle/role/ci-pipeline/role-id
# role_id: 675a50e7-cfe0-be28-...

# Generate a Secret ID (rotate frequently)
vault write -f auth/approle/role/ci-pipeline/secret-id
# secret_id: ed0a642f-2acf-...

# In CI/CD: login with role_id + secret_id to get a Vault token
vault write auth/approle/login \
  role_id="675a50e7-cfe0-be28-..." \
  secret_id="ed0a642f-2acf-..."
# Returns: token, lease_duration, etc.

Vault vs AWS Secrets Manager vs Doppler