DEV Community

Cover image for Day 26 - HashiCorp Vault & Secrets Management
Rahul Joshi
Rahul Joshi

Posted on

Day 26 - HashiCorp Vault & Secrets Management

#masterclassdevsecops #secrets #vault #devops

Modern applications depend on secrets.

Every application requires:

  • Database Passwords
  • API Keys
  • SSH Keys
  • TLS Certificates
  • Cloud Credentials
  • OAuth Tokens
  • Service Account Keys

The biggest question is:

Where should we store them securely?

Unfortunately many organizations still store secrets in:

Git Repository
Docker Image
Application Config Files
Environment Variables
Shared Documents
Excel Sheets
Enter fullscreen mode Exit fullscreen mode

This creates a massive security risk.

This is why Secret Management platforms like HashiCorp Vault became critical in modern cloud-native environments.

🔗 Resources

What is a Secret?

A secret is any sensitive piece of information used to authenticate or authorize access.

Examples:

Database Password
AWS Access Key
JWT Signing Key
API Token
TLS Certificate
Private Key
OAuth Secret
Enter fullscreen mode Exit fullscreen mode

If a secret gets exposed:

Attacker
      ↓
Application Access
      ↓
Database Access
      ↓
Infrastructure Compromise
Enter fullscreen mode Exit fullscreen mode

What is Secrets Management?

Secrets Management is the process of:

Store
Protect
Rotate
Control
Audit
Enter fullscreen mode Exit fullscreen mode

sensitive credentials securely.

A modern secrets management platform provides:

  • Centralized storage
  • Encryption
  • Access control
  • Secret rotation
  • Audit logs
  • Dynamic credentials

Why Secrets Management Matters

Imagine this scenario:

database:
  username: admin
  password: Password123
Enter fullscreen mode Exit fullscreen mode

committed into GitHub.

Result:

Developer Pushes Code
          ↓
GitHub Repository
          ↓
Credential Leak
          ↓
Database Breach
Enter fullscreen mode Exit fullscreen mode

This happens more often than people realize.

The Problem with Traditional Secret Storage

Many teams use:

.env Files
Kubernetes Secrets
Configuration Files
Hardcoded Passwords
Enter fullscreen mode Exit fullscreen mode

Problems:

  • Difficult rotation
  • No audit trail
  • Poor access control
  • Risk of accidental exposure
  • Compliance failures

What is HashiCorp Vault?

HashiCorp Vault is a centralized secrets management platform designed to securely store, access, and manage secrets.

Think of Vault as:

Central Secret Bank
Enter fullscreen mode Exit fullscreen mode

for your infrastructure and applications.

Instead of:

Application
     ↓
Database Password
Enter fullscreen mode Exit fullscreen mode

stored locally,

you use:

Application
      ↓
Vault
      ↓
Database Credentials
Enter fullscreen mode Exit fullscreen mode

Why HashiCorp Created Vault

Modern infrastructure became increasingly complex.

Organizations adopted:

  • Kubernetes
  • Multi-cloud
  • Microservices
  • Containers
  • CI/CD Pipelines

Suddenly there were thousands of secrets.

Example:

50 Microservices
     ↓
20 Secrets Each
     ↓
1000 Secrets
Enter fullscreen mode Exit fullscreen mode

Managing them manually became impossible.

Vault was created to solve this problem.

Core Features of HashiCorp Vault

1. Centralized Secret Storage

All secrets stored in one location.

Applications
       ↓
HashiCorp Vault
       ↓
Secrets
Enter fullscreen mode Exit fullscreen mode

2. Encryption as a Service

Vault encrypts sensitive data.

Plain Text
     ↓
Encryption
     ↓
Encrypted Secret
Enter fullscreen mode Exit fullscreen mode

3. Dynamic Secrets

One of Vault's most powerful features.

Instead of:

Static Password
Enter fullscreen mode Exit fullscreen mode

Vault generates temporary credentials.

Example:

Application
      ↓
Vault
      ↓
Temporary Database User
      ↓
Expires Automatically
Enter fullscreen mode Exit fullscreen mode

4. Secret Rotation

Vault automatically rotates secrets.

Example:

Old Password
      ↓
Vault Rotation
      ↓
New Password
Enter fullscreen mode Exit fullscreen mode

No manual work required.

5. Audit Logging

Every secret access is logged.

Example:

Who accessed?
When?
What secret?
From where?
Enter fullscreen mode Exit fullscreen mode

Critical for compliance.

6. Fine-Grained Access Control

Not everyone should access every secret.

Vault provides:

Policy-Based Access
Enter fullscreen mode Exit fullscreen mode

Example:

Developer
     ↓
Read Dev Secrets

Production Secrets
     ✗ Denied
Enter fullscreen mode Exit fullscreen mode

Image Full

Main Vault Components

Vault Server

Core service responsible for:

  • Authentication
  • Authorization
  • Secret storage
  • Encryption

Storage Backend

Stores encrypted secrets.

Examples:

Integrated Storage (Raft)
Consul
AWS DynamoDB
PostgreSQL
Enter fullscreen mode Exit fullscreen mode

Authentication Methods

Vault supports:

  • Userpass
  • LDAP
  • GitHub
  • Kubernetes
  • AWS IAM
  • Azure AD
  • OIDC

Example:

Developer
     ↓
GitHub Login
     ↓
Vault
Enter fullscreen mode Exit fullscreen mode

Policies

Vault policies define access permissions.

Example:

path "secret/data/dev/*" {
  capabilities = ["read"]
}
Enter fullscreen mode Exit fullscreen mode

Meaning:

Can read dev secrets only
Enter fullscreen mode Exit fullscreen mode

What are Secrets Engines?

Secrets Engines are plugins that generate or store secrets.

Vault ships with many.

KV Secrets Engine

Most common.

Stores:

Username
Password
API Keys
Tokens
Enter fullscreen mode Exit fullscreen mode

Example:

vault kv put secret/app \
username=admin \
password=secret123
Enter fullscreen mode Exit fullscreen mode

Database Secrets Engine

Creates temporary database users.

Example:

Application
      ↓
Vault
      ↓
Temporary PostgreSQL User
Enter fullscreen mode Exit fullscreen mode

Automatically expires later.

PKI Secrets Engine

Issues certificates dynamically.

Example:

Vault
      ↓
TLS Certificate
Enter fullscreen mode Exit fullscreen mode

instead of manually creating certificates.

AWS Secrets Engine

Generates temporary AWS credentials.

Example:

Application
      ↓
Vault
      ↓
AWS IAM Credentials
Enter fullscreen mode Exit fullscreen mode

Dynamic Secrets vs Static Secrets

Static Secret 

password123
Enter fullscreen mode Exit fullscreen mode

Exists forever.

Dynamic Secret 

Generated
     ↓
Used
     ↓
Automatically Expired
Enter fullscreen mode Exit fullscreen mode

Much safer.

Why Dynamic Secrets Are Important

Static credentials are often stolen.

Dynamic credentials reduce risk because:

Credential Expires
       ↓
Attack Window Reduced
Enter fullscreen mode Exit fullscreen mode

Second Image

Installing Vault in Development Environment

Development mode is useful for learning.

Run Vault Using Docker 

docker run \
--cap-add=IPC_LOCK \
-e VAULT_DEV_ROOT_TOKEN_ID=root \
-p 8200:8200 \
hashicorp/vault
Enter fullscreen mode Exit fullscreen mode

Access:

http://localhost:8200
Enter fullscreen mode Exit fullscreen mode

Login:

Token: root
Enter fullscreen mode Exit fullscreen mode

Verify Vault 

vault status
Enter fullscreen mode Exit fullscreen mode

Expected output:

Initialized: true
Sealed: false
Enter fullscreen mode Exit fullscreen mode

Store First Secret 

vault kv put secret/app \
username=admin \
password=password123
Enter fullscreen mode Exit fullscreen mode

Retrieve:

vault kv get secret/app
Enter fullscreen mode Exit fullscreen mode

Installing Vault in Kubernetes

Most production environments run Vault inside Kubernetes.

Add Helm Repository 

helm repo add hashicorp \
https://helm.releases.hashicorp.com
Enter fullscreen mode Exit fullscreen mode

Update Repository 

helm repo update
Enter fullscreen mode Exit fullscreen mode

Install Vault 

helm install vault hashicorp/vault
Enter fullscreen mode Exit fullscreen mode

Verify:

kubectl get pods
Enter fullscreen mode Exit fullscreen mode

Enable UI 

server:
  ui:
    enabled: true
Enter fullscreen mode Exit fullscreen mode

Production Vault Architecture

Recommended architecture:

Load Balancer
       ↓
Vault Cluster
       ↓
Raft Storage
Enter fullscreen mode Exit fullscreen mode

Multiple replicas:

Vault-1
Vault-2
Vault-3
Enter fullscreen mode Exit fullscreen mode

for high availability.

Vault Auto-Unseal

Without Auto-Unseal:

Vault Restart
      ↓
Manual Unseal Required
Enter fullscreen mode Exit fullscreen mode

Production clusters use:

  • AWS KMS
  • Azure Key Vault
  • GCP KMS

for automatic unsealing.

Vault + Kubernetes Integration

Vault can inject secrets directly into Pods.

Traditional:

env:
  DB_PASSWORD: password123
Enter fullscreen mode Exit fullscreen mode

Vault:

Pod
     ↓
Vault Agent
     ↓
Secret Injection
Enter fullscreen mode Exit fullscreen mode

No hardcoded secrets.

Vault Agent Injector

Automatically injects secrets into Pods.

Application Pod
      ↓
Vault Sidecar
      ↓
Secret Available
Enter fullscreen mode Exit fullscreen mode

without storing secrets in Git.

Vault in CI/CD Pipelines

Modern CI/CD:

GitHub Actions
      ↓
Vault Authentication
      ↓
Temporary Secrets
      ↓
Deployment
Enter fullscreen mode Exit fullscreen mode

Benefits:

  • No hardcoded credentials
  • Automatic rotation
  • Auditability

Vault Security Best Practices

Enable TLS

Never expose Vault without HTTPS.

Use Auto-Unseal

Avoid manual operations.

Use Least Privilege Policies

Grant minimum access.

Enable Audit Logs

Track every access.

Use Dynamic Secrets

Avoid static passwords.

Integrate with Identity Provider

Examples:

Azure AD
Okta
GitHub
LDAP
Enter fullscreen mode Exit fullscreen mode

Common Use Cases

Kubernetes Secrets Management 

Pods
 ↓
Vault
 ↓
Secrets
Enter fullscreen mode Exit fullscreen mode

Database Credentials 

Application
 ↓
Vault
 ↓
Temporary PostgreSQL User
Enter fullscreen mode Exit fullscreen mode

Cloud Credentials 

Application
 ↓
Vault
 ↓
AWS IAM Credentials
Enter fullscreen mode Exit fullscreen mode

PKI Certificates 

Vault
 ↓
Generate TLS Certificates
Enter fullscreen mode Exit fullscreen mode

Enterprise Vault Architecture 

Developers
       ↓
Applications
       ↓
Vault Cluster
       ↓
Policies
       ↓
Secrets Engines
       ↓
Database / Cloud / Certificates
Enter fullscreen mode Exit fullscreen mode

Final Thoughts

Modern infrastructure depends on secrets.

As organizations adopt:

  • Kubernetes
  • Multi-cloud
  • GitOps
  • Platform Engineering
  • DevSecOps

traditional secret management approaches are no longer sufficient.

HashiCorp Vault solves this problem by providing:

Centralized Storage
Dynamic Secrets
Secret Rotation
Audit Logging
Encryption
Fine-Grained Access Control
Enter fullscreen mode Exit fullscreen mode

For small AWS-only workloads, AWS Secrets Manager may be enough.

For Azure-only environments, Azure Key Vault works well.

But for organizations needing:

Multi-Cloud
Kubernetes
Hybrid Cloud
Advanced Security
Enter fullscreen mode Exit fullscreen mode

HashiCorp Vault remains one of the most powerful and widely adopted secrets management platforms available today.

Top comments (0)