SRE Thailand Bootcamp

Week 15: Secrets Management — HashiCorp Vault

Theme: Securely manage secrets with Vault: dynamic secrets, encryption, rotation.

Learning Objectives

1. Install and initialize HashiCorp Vault (dev mode, then HA)
2. Configure secret engines: KV v2, database dynamic secrets
3. Authenticate applications via Kubernetes auth method
4. Implement secret rotation and auditing

Reading Materials

• Vault Introduction
• Vault Getting Started
• Vault Secret Engines
• Vault Kubernetes Auth
• Vault Database Dynamic Secrets
• Vault Agent Sidecar Injector
• Bank Vault (open-source Vault operator)

Finger Exercises (choose 2)

1. Install Vault dev mode. Enable KV v2 secrets engine. Write/read secrets using CLI and HTTP API.
2. Enable database dynamic secrets for PostgreSQL. Configure a role that creates 1-hour credentials.
3. Enable Kubernetes auth. Configure a role that maps a K8s ServiceAccount to a Vault policy.

Project

• Deploy Vault to the K8s cluster (HA mode with Raft storage backend)
• Configure:
  • KV v2: static secrets (API keys, certificates)
  • Database dynamic secrets: PostgreSQL and Redis credentials, TTL 24h, auto-rotation
• Integrate with the Go app:
  • Use Vault Agent sidecar to inject secrets
  • The Go app reads secrets from a shared volume (not environment variables)
  • Demonstrate credential rotation: revoke a database secret, the app gets new credentials on next request
• Set up audit logging: all Vault API calls logged to a file + Loki
• Create a Vault policy for each app:
  • go-app-policy: read kv/go-app/*, database/creds/go-app
  • python-worker-policy: read kv/python-worker/*, database/creds/python-worker
  • admin-policy: full access

Time Budget