Vault

Overview

Vault, created by HashiCorp in 2012 and headquartered in San Francisco, California, is the industry-leading secrets management and access control solution. Vault provides 30+ secrets engines covering KV storage, database credentials, cloud IAM roles, PKI certificates, and SSH keys — serving as the foundational security infrastructure layer for cloud-native environments.

Thousands of enterprises worldwide use Vault for secret distribution, dynamic credential management, and Encryption as a Service. Its core design philosophy replaces traditional practices like SSH keys, static passwords, and hardcoded configuration secrets with a unified control plane, fundamentally reducing the risk of credential exposure.

Key Strengths

• 30+ Secrets Engines: From simple KV storage to dynamic database credentials, cloud IAM roles, and PKI certificate issuance — Vault manages all secret types from a single platform.
• Dynamic Secrets & Auto-Rotation: Databases and cloud providers generate temporary credentials on each request (lease 1 per request) with automatic lease-based revocation. Even if credentials leak, the attack window is dramatically shortened.
• Encryption as a Service (EaaS): Applications use 1 API to call Vault for encryption/decryption without managing key rotation or cryptographic algorithms, reducing implementation complexity.
• 10+ Auth Methods: Supports Token, LDAP, Kubernetes Service Account, AWS IAM, Azure MSI, JWT/OIDC, and more, seamlessly integrating with existing identity systems.

Product Ecosystem

• Vault Open Source: Community edition with core secrets engines and auth methods, suitable for development and testing environments.
• Vault Enterprise: Adds Auto Unseal, Performance Replication, HSM integration, Namespaces, and other enterprise-grade capabilities.
• Vault Secrets Operator: Kubernetes Operator that syncs Vault secrets as Kubernetes Secrets for pod-level secret injection.
• HashiCorp Cloud Platform (HCP) Vault: Managed Vault service operated by HashiCorp, eliminating the operational burden of self-managed clusters.

Limitations

• High Deployment Complexity: Vault clusters require configuration of storage backends (Consul/Raft), unsealing mechanisms, TLS certificates, and audit logging — requiring a dedicated team with specialized knowledge.
• Paid Enterprise Features: Auto Unseal, Performance Replication, and HSM support are only available in Vault Enterprise, limiting disaster recovery capabilities in the open-source edition.
• Integration Overhead: Fully integrating Vault into existing CI/CD, monitoring, and alerting pipelines requires additional development and configuration effort.

Use Cases

• Dynamic Database Credentials (★★★★★): Applications obtain temporary database credentials from Vault on each request instead of using static passwords, with automatic lease-based revocation eliminating persistent credential risk.
• PKI Certificate Lifecycle Management (★★★★★): Use the Vault PKI engine for internal certificate issuance with automatic rotation and revocation, combined with ACME protocol for full certificate automation.
• Kubernetes Secret Injection (★★★★★): Inject secrets into Pod environment variables or volumes via Vault Secrets Operator without passing sensitive data through CI/CD pipelines in plaintext.
• Multi-Cloud Key Management (★★★★☆): Centrally manage AWS/Azure/GCP IAM role credentials through Vault for consistent secrets governance across multi-cloud environments.

Pricing

FAQ

• What is the difference between Vault and Kubernetes Secrets? Kubernetes Secrets are Base64-encoded values stored in etcd without access auditing or dynamic rotation. Vault provides audit logging, lease management, dynamic credentials, and rich auth integrations, making it suitable for production-grade secrets management. See security auditing for more.

• Can Vault Open Source be used in production? Yes, but it lacks Auto Unseal and Performance Replication. For production, it is recommended to deploy at least a 3-node Vault cluster with a 3-node Consul backend and configure an external unsealing mechanism—see the cloud server configuration guide.

• How does Vault ensure high availability? Vault uses an eventually consistent architecture where the active node handles requests and standby nodes sync in real-time. Vault Enterprise supports cross-datacenter deployment with Performance Replication for regional high availability—see the cloud monitoring services comparison.

• How does Vault integrate with Kubernetes? Use the Vault Secrets Operator or CSI plugin to inject secrets into Pods, avoiding plaintext credential passing in container security scenarios.