vault
HashiCorp Vault: secret storage, dynamic credentials and unsealing.
-
External Secrets with Offline JWT Validation When Vault Cannot Reach the Cluster
Vault's default Kubernetes auth method needs to call back into the cluster's API server on every login, which cannot work once Vault and the cluster sit in deliberately isolated networks. Here is how to configure Vault's JWT auth method to validate service-account tokens offline, against a static public key, and wire External Secrets Operator to use it.
-
Auto-Unsealing Vault Without Cloud KMS or a TPM, Using Tang and Clevis
Manual unsealing does not scale once other services depend on Vault being available at boot, but Vault's built-in auto-unseal options assume a cloud KMS, a TPM, or an HSM, none of which fit every environment. This shows how to bind Shamir unseal key shares to a Tang server with Clevis instead, so a host can unseal itself automatically while it is on the expected network, verified end to end including what happens when the Tang server is unreachable.
-
Runtime Secret Injection with a Vault Agent Sidecar and a Wrapped AppRole
Rendering secrets into config files during a deploy leaves plaintext sitting on disk indefinitely and turns every rotation into a redeploy. This sets up a Vault Agent sidecar that authenticates with a single-use, response-wrapped AppRole secret and renders a live secret into a file an application container reads, verified end to end with a complete docker-compose stack.
-
Vault KV-v2: Why put Silently Wipes Every Sibling Field
vault kv put writes a full new version of a KV-v2 secret, so adding one field with put silently deletes every other field that secret held. This works through why put behaves that way, what patch actually does instead, and gives a verified, runnable sequence — including the one safe way to remove a single field without racing another writer.
-
Replacing Distributed SSH Keys with a Vault Certificate Authority
Copying a public key into every host's authorized_keys file does not scale and leaves no record of who was granted access or when. This walks through standing up Vault's SSH secrets engine as a certificate authority, signing short-lived user certificates on demand, and shows a complete, runnable demonstration against a disposable sshd container.