0 views
Read
#0
Learn Vault - Prerequisites: Skills & Environment Setup
Before diving deeper into HashiCorp Vault, there are a few foundational skills and tools you need to prepare first, starting from the Linux CLI, basic cryptography concepts, to installing the Vault CLI and setting up the environment for running a Vault server.
August 2, 2026
00
Read
#1
Learn Vault - Problem Statement, Secret Sprawl & Why You Need Vault
Before using Vault, we must first understand the problem it solves: secret sprawl — API keys hard-coded in source code, .env files leaking into Git, static credentials that are rarely rotated — and why a centralized solution is a must.
August 2, 2026
00
Read
#2
Learn Vault - The Secret Management Ecosystem & Tool Comparison
Vault is not the only tool in the secret management ecosystem. This article maps the tools landscape — cloud-native secret managers, open-source tools like SOPS and OpenBao — so you can choose the right one, including when Vault is the clear winner.
August 2, 2026
00
Read
#3
Learn Vault - Core Architecture & Security Concepts
After understanding Vault's position in the ecosystem, it's time to dissect Vault's internals: how the storage backend and Vault Core work, the request flow, the initialization and unsealing process with Shamir's Secret Sharing, and the root token risk.
August 2, 2026
00
Read
#4
Learn Vault - KV Secrets Engine (Key-Value v1 vs KV v2 with Versioning)
In this episode we'll cover the first and most commonly used secrets engine: the KV Secrets Engine. We'll compare KV v1 and KV v2 with versioning, and practice the put, get, list, metadata, rollback, destroy, and undelete operations.
August 2, 2026
00
Read
#5
Learn Vault - Dynamic Database Secrets Engine (Short-Lived Credentials)
In this episode we'll cover Dynamic Secrets — the paradigm where database credentials are no longer permanent, but generated on-demand with short TTLs and automatic destruction. We'll integrate Vault with PostgreSQL, write roles, and read dynamic credentials.
August 2, 2026
00
Read
#6
Learn Vault - Transit Secrets Engine (Encryption-as-a-Service / EaaS)
In this episode we'll cover the Transit Secrets Engine — encryption as an API service. Vault encrypts and decrypts sensitive data (credit cards, national IDs, health data) without ever storing the data. We'll practice key creation, encryption, decryption, and key rotation.
August 2, 2026
00
Read
#7
Learn Vault - PKI Secrets Engine (Automated X.509 Certificate Authority)
In this episode we'll cover the PKI Secrets Engine — making Vault a Certificate Authority that issues short-lived TLS certificates automatically. We'll set up a Root CA and Intermediate CA, issue certificates on-demand, and understand CRL, OCSP, and revocation.
August 2, 2026
00
Read
#8
Learn Vault - Additional Secrets Engines (TOTP, SSH & AWS)
In this episode we'll round out our understanding of secrets engines with three engines commonly used in the field: TOTP for centralized 2FA, SSH for OTP login and CA signing, and AWS for short-lived dynamic IAM credentials. We'll see when to use which engine.
August 2, 2026
00
Read
#9
Learn Vault - Vault Policies (HCL & Fine-Grained Access Control)
In this episode we'll cover the heart of Vault's security: policies in HCL format that govern who can do what against any path. You'll learn path matching, capabilities, and how to write, apply, and test policies to a production level.
August 2, 2026
00