HashiCorp Vault Secrets Management Guide

Move beyond static credentials with HashiCorp Vault. Configure dynamic database secrets, Kubernetes pod authentication, and automatic secret rotation — so your apps never store long-lived credentials.

Install Vault (Dev / Production)

# Install via package manager
brew tap hashicorp/tap && brew install hashicorp/tap/vault   # macOS
sudo apt install vault                                        # Ubuntu/Debian

# Start in dev mode (in-memory, auto-unsealed, root token = root)
vault server -dev -dev-root-token-id="root"

# Production: start with config file
vault server -config=/etc/vault/vault.hcl

# /etc/vault/vault.hcl (minimal production config)
# storage "raft" {
#   path    = "/opt/vault/data"
#   node_id = "vault-1"
# }
# listener "tcp" {
#   address     = "0.0.0.0:8200"
#   tls_cert_file = "/etc/vault/tls/vault.crt"
#   tls_key_file  = "/etc/vault/tls/vault.key"
# }
# api_addr = "https://vault.example.com:8200"
# cluster_addr = "https://vault.example.com:8201"
# ui = true

export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'
vault status

Dynamic Database Secrets

# Enable the database secrets engine
vault secrets enable database

# Configure PostgreSQL connection
vault write database/config/my-postgres \
  plugin_name=postgresql-database-plugin \
  allowed_roles="app-role" \
  connection_url="postgresql://{{username}}:{{password}}@postgres.example.com:5432/appdb" \
  username="vault-superuser" \
  password="superuser-password"

# Create a role with a creation SQL statement
vault write database/roles/app-role \
  db_name=my-postgres \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# Generate dynamic credentials (app calls this at startup)
vault read database/creds/app-role

# Response:
# Key                Value
# ---                -----
# lease_id           database/creds/app-role/AbCdEf123456
# lease_duration     1h
# lease_renewable    true
# password           A1a-xxxxxxxxxxxxxxxx
# username           v-root-app-role-yyyyyyyyyyy

Kubernetes Auth Integration

# Enable Kubernetes auth method
vault auth enable kubernetes

# Configure with the cluster's API server
vault write auth/kubernetes/config \
  kubernetes_host="https://kubernetes.default.svc" \
  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
  token_reviewer_jwt=@/var/run/secrets/kubernetes.io/serviceaccount/token

# Create a policy for the app
vault policy write app-policy - <<EOF
path "database/creds/app-role" {
  capabilities = ["read"]
}
path "secret/data/app/*" {
  capabilities = ["read"]
}
EOF

# Bind the policy to a Kubernetes service account
vault write auth/kubernetes/role/my-app \
  bound_service_account_names=my-app-sa \
  bound_service_account_namespaces=production \
  policies=app-policy \
  ttl=1h

# In Kubernetes: the app logs in using its mounted SAT
curl -s --request POST \
  --data "{\"jwt\": \"$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\", \"role\": \"my-app\"}" \
  $VAULT_ADDR/v1/auth/kubernetes/login | jq '.auth.client_token'

AppRole Authentication

# Enable AppRole auth
vault auth enable approle

# Create AppRole with bound policies
vault write auth/approle/role/ci-pipeline \
  secret_id_ttl=10m \
  token_num_uses=10 \
  token_ttl=20m \
  token_max_ttl=30m \
  secret_id_num_uses=1 \
  policies=deploy-policy

# Get the RoleID (not secret, can be in config)
vault read auth/approle/role/ci-pipeline/role-id
# role_id: 675a50e7-cfe0-be9a-7a5a-c1d19af7b7c9

# Get a SecretID (secret, single-use, short-lived)
vault write -f auth/approle/role/ci-pipeline/secret-id
# secret_id: ed0a642f-2acf-c2da-232f-1b21300d5f29

# Login with RoleID + SecretID
vault write auth/approle/login \
  role_id="675a50e7-cfe0-be9a-7a5a-c1d19af7b7c9" \
  secret_id="ed0a642f-2acf-c2da-232f-1b21300d5f29"

Vault Agent — Auto-Auth Sidecar

# vault-agent-config.hcl
vault {
  address = "https://vault.example.com:8200"
}

auto_auth {
  method "kubernetes" {
    mount_path = "auth/kubernetes"
    config {
      role = "my-app"
    }
  }

  sink "file" {
    config {
      path = "/vault-token"
    }
  }
}

template {
  source      = "/etc/vault-templates/db-config.ctmpl"
  destination = "/app/config/database.yml"
  command     = "kill -HUP $(cat /app/pids/app.pid)"  # reload app on change
}