🔐
Security

HashiCorp Vault

Secrets management — passwords, API keys, certificates

🐧 Linux🍎 Mac🪟 Windows
Reviewed: Tested on: Kubernetes 1.29 · Vault 1.16 · Ubuntu 22.04

✓ Team golden path — Secrets management

Central secrets, audit, dynamic credentials

What is this?

Vault securely stores passwords, API keys, and certificates in one place.

📁

Config files for HashiCorp Vault

Where to create or edit the main configuration — paths below match the setup steps.

  • vault.hcl

    Location: Vault server config path

    Storage backend, listener, and seal config

📥

Step 01

Install Vault

(01)Install

Linux
1wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
2echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
3sudo apt-get update && sudo apt-get install -y vault
⚙️

Step 02

Configure Vault

(01)Dev server + store secret

Linux
1vault server -dev
2# New terminal:
3export VAULT_ADDR='http://127.0.0.1:8200'
4vault kv put secret/myapp password=supersecret
✅

Step 03

Verify

(01)Read secret

Linux
1vault kv get secret/myapp
🔧

Step 04

Common Problems

#1Vault is sealed

Vault starts sealed after restart — must unseal with key shards.

Linux
1vault status
2# Unseal (repeat for required key threshold):
3vault operator unseal
4# Or auto-unseal via cloud KMS if configured

#2Permission denied on secret read

Linux
1# Login first:
2vault login
3# Or token:
4export VAULT_TOKEN=...
5vault kv get secret/myapp

📋Config templates

1 YAML template for HashiCorp Vault. Copy and deploy after setup.

1 ready-to-copy template. Expand one, copy the YAML, then run the deploy commands.

secret-store.yml

yaml
1apiVersion: external-secrets.io/v1beta1
2kind: SecretStore
3metadata:
4  name: aws-secrets
5  namespace: default
6spec:
7  provider:
8    aws:
9      service: SecretsManager
10      region: us-east-1

external-secret.yml

yaml
1apiVersion: external-secrets.io/v1beta1
2kind: ExternalSecret
3metadata:
4  name: app-db-credentials
5  namespace: default
6spec:
7  refreshInterval: 1h
8  secretStoreRef:
9    name: aws-secrets
10    kind: SecretStore
11  target:
12    name: db-credentials
13    creationPolicy: Owner
14  data:
15    - secretKey: password
16      remoteRef:
17        key: prod/myapp/db
18        property: password
📄

Step 01

Apply ExternalSecret

(01)Deploy to cluster

Linux
1kubectl apply -f .
2kubectl get all
3kubectl get pods -w

(02)Remove

Linux
1kubectl delete -f .