DevOps PeachWhat Vault solves
HashiCorp Vault is a cloud-independent secret manager. It stores secrets encrypted, returns them only to those a policy allows, writes an audit log of every read, and can generate dynamic secrets: create a database user valid for one hour, then remove it. Vault moved to the BSL licence in 2023; OpenBao is an open-source fork with a similar API.
Key concepts
| Concept | Meaning |
|---|---|
| Seal / unseal | Vault starts sealed; unseal keys (or auto-unseal with a KMS) are needed to decrypt data |
| Auth method | How identity is proven: token, userpass, OIDC, AppRole, Kubernetes, AWS IAM |
| Token | The result of logging in, with a TTL and attached policies |
| Policy | An HCL file saying which paths allow read, create, update, list… |
| Secrets engine | Where secrets are generated or stored: kv, database, aws, pki, transit |
| Lease | The lifetime of a dynamic secret, which can be renewed or revoked |
flowchart LR A["App"] -- "log in (Kubernetes / AppRole)" --> V["Vault"] V -- "token + policy" --> A A -- "read secret/data/myapp" --> V V -- "database engine" --> DB["Create DB user<br/>TTL 1h"]
Using the KV secrets engine
Dev mode (vault server -dev) runs in memory, already unsealed, for learning only. With KV version 2:
export VAULT_ADDR=http://127.0.0.1:8200
vault kv put secret/myapp db_user=app db_password=changeme-example
vault kv get secret/myapp
vault kv get -field=db_password secret/myapp
vault kv metadata get secret/myapp # stored versions
vault kv rollback -version=1 secret/myapp
KV v2 keeps multiple versions, so an accidental overwrite can be recovered. Note that KV v2 policy paths include data/:
path "secret/data/myapp" {
capabilities = ["read"]
}
Good practice
- Apps log in with the platform's identity (Kubernetes service account, AWS IAM role) rather than a stored long-lived token.
- Prefer dynamic secrets for databases and clouds: each request gets its own credential that expires on its own.
- Do not use the root token day to day; revoke it once setup is done.
- Enable an audit device and ship its logs to a central system.
- Avoid passing secrets as command-line arguments on shared machines, since they land in shell history;
vault kv put secret/x password=-reads from stdin.