HashiCorp Vault — the secrets management we were missing

I’ll admit it: we had database passwords in Kubernetes Secrets (base64 encoded, not encrypted), API keys in environment variables. HashiCorp Vault changes this — a central, encrypted, audited secrets storage.

The problem: secrets sprawl¶

Kubernetes Secrets are base64 encoded, not encrypted. Anyone with access to etcd can read them. That’s not secure.

Vault architecture¶

• Seal/Unseal — you need N of M keys to unseal
• Auth backends — LDAP, Kubernetes, AWS IAM, GitHub
• Secret engines — KV store, dynamic credentials, PKI
• Policies — HCL rules for who can do what
• Audit log — every request logged

Kubernetes integration¶

vault login -method=kubernetes \
    role=api-server \
    jwt=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
vault kv get secret/production/database

Dynamic secrets — game changer¶

Vault can generate temporary database passwords. Applications request credentials, Vault creates a user in PostgreSQL with TTL, deletes it after expiration. No shared passwords, no permanent credentials.

Secrets management is the foundation of secure infrastructure¶

Vault isn’t trivial to deploy, but centralized, audited secrets management is essential for production environments.