How does HashiCorp Vault work?

Question

Accepted Answer

**HashiCorp Vault** — A centralized secret store with audit, rotation, and dynamic secrets. **Architecture:** - **Secret Engine** — secret stores (KV, PKI, AWS, Database). - **Auth Method** — authentication (token, OIDC, K8s, LDAP). - **Policy** — access rules. - **Audit Device** — logging. **Startup and initialization:** ```bash vault server -dev # Initialization (5 keys, 3 of 5 for unseal) vault operator init -key-shares=5 -key-threshold=3 # Unseal vault operator unseal vault operator unseal vault operator unseal ``` **KV Secrets Engine:** ```bash vault secrets enable -path=secret kv-v2 vault kv put secret/myapp/db password=supersecret vault kv get -field=password secret/myapp/db ``` **Vault Agent Injector for K8s:** ```yaml apiVersion: v1 kind: Pod metadata: annotations: vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/role: "myapp" vault.hashicorp.com/agent-inject-secret-db: "secret/data/myapp/db" spec: containers: - name: app image: myapp:latest ``` **Dynamic secrets (Database):** ```bash vault secrets enable database vault write database/config/mydb \ plugin_name=postgresql-database-plugin \ connection_url="postgresql://{{username}}:{{password}}@db:5432" \ allowed_roles="myapp" \ username="vault_admin" \ password="admin_password" # Vault generates unique passwords for each request! ```

DevOps: How does HashiCorp Vault work?