82.3 Project 87: Secret management with HashiCorp Vault
Friends, passwords in git get leaked. Today we run Vault, store a database password, and read it with a policy-bound token.
मित्रांनो, git मधील passwords leak होतात. आज Vault चालवू, DB password ठेवू, आणि policy-bound token ने वाचू.
दोस्तों, git में passwords leak होते हैं. आज Vault चलाएंगे, DB password रखेंगे, और policy-bound token से पढ़ेंगे.
What you will build in this project
- Run Vault in dev mode for learning.
- Write a KV secret.
- Create a policy and token.
- Read the secret with that token only.
1. Start from a real company story
At Freshworks in Chennai, a database password committed in a Helm values file sat in git history for months.
Rough cost: about ₹22 lakh in forced password rotations and audit work.
Kavitha put secrets in Vault and short-lived tokens in CI.
Today we store and read one secret the right way.
Ravindra Bagale's Tip
Students leave Vault root tokens in shell history. Use short TTL tokens and never echo root. Keep that habit.
Students root tokens shell history मध्ये ठेवतात. Short TTL tokens; root echo करू नका. सवय ठेवा.
Students root tokens shell history में रखते हैं. Short TTL tokens; root echo न करें. आदत रखिए.
2. Start and prepare
Step 1: Why Vault
Why: Git is not a vault. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: a1
Type this:
echo 'Rotate, audit, and expire secrets in one place'
You will see:
Rotate, audit, and expire secrets in one place
What it means: Why.
Example 2: a2
Type this:
mkdir -p /tmp/vault87 && echo 'Today: vault, KV write, policy, token, revoke'
You will see:
Today: vault, KV write, policy, token, revoke
What it means: Scope.
Example 3: a3
Type this:
echo 'Dev mode is for learning only — never for prod data'
You will see:
Dev mode is for learning only — never for prod data
What it means: Dev mode.
Step 2: Start Vault
Why: Dev server. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: start. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: b1
Type this:
printf '%s\n' 'vault server -dev -dev-listen-address=127.0.0.1:8200' 'export VAULT_ADDR=http://127.0.0.1:8200' > /tmp/vault87/START.txt && cat /tmp/vault87/START.txt
You will see:
export VAULT_ADDR=http://127.0.0.1:8200
What it means: Start.
Example 5: b2
Type this:
echo 'vault status'
You will see:
vault status
What it means: Status.
Example 6: b3
Type this:
echo 'Copy the root token from the server log into VAULT_TOKEN for setup only'
You will see:
Copy the root token from the server log into VAULT_TOKEN for setup only
What it means: Root.
Step 3: Enable KV
Why: v2 secrets engine. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: enable. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: c1
Type this:
echo 'vault secrets enable -path=secret kv-v2'
You will see:
vault secrets enable -path=secret kv-v2
What it means: Enable.
Example 8: c2
Type this:
echo 'vault kv put secret/shop/db password=s3cret-demo'
You will see:
vault kv put secret/shop/db password=s3cret-demo
What it means: Write.
Example 9: c3
Type this:
echo 'vault kv get secret/shop/db'
You will see:
vault kv get secret/shop/db
What it means: Read root.
3. Build the main pieces
Step 4: Policy
Why: Least privilege. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: policy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: d1
Type this:
printf '%s\n' 'path "secret/data/shop/db" {' ' capabilities = ["read"]' '}' > /tmp/vault87/shop-read.hcl && cat /tmp/vault87/shop-read.hcl
You will see:
capabilities = ["read"]
What it means: HCL.
Example 11: d2
Type this:
echo 'vault policy write shop-read /tmp/vault87/shop-read.hcl'
You will see:
vault policy write shop-read /tmp/vault87/shop-read.hcl
What it means: Write policy.
Example 12: d3
Type this:
echo 'Policies are the ACL; tokens only carry policy names'
You will see:
Policies are the ACL; tokens only carry policy names
What it means: Model.
Step 5: Token
Why: Bound and short. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: token. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: e1
Type this:
echo 'vault token create -policy=shop-read -ttl=15m -display-name=ci-shop'
You will see:
vault token create -policy=shop-read -ttl=15m -display-name=ci-shop
What it means: Create.
Example 14: e2
Type this:
echo 'export VAULT_TOKEN=CHILD_TOKEN'
You will see:
export VAULT_TOKEN=CHILD_TOKEN
What it means: Use.
Example 15: e3
Type this:
printf '%s\n' 'Acceptance: child token reads secret/shop/db and cannot list other paths' > /tmp/vault87/ACCEPT.txt && cat /tmp/vault87/ACCEPT.txt
You will see:
Acceptance: child token reads secret/shop/db and cannot list other paths
What it means: Gate.
Step 6: App read
Why: Use the token. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: read. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: f1
Type this:
echo 'vault kv get -field=password secret/shop/db'
You will see:
vault kv get -field=password secret/shop/db
What it means: Field.
Example 17: f2
Type this:
echo 'CI exports the field into the job env for one stage only'
You will see:
CI exports the field into the job env for one stage only
What it means: CI.
Example 18: f3
Type this:
echo 'Never print the secret into build logs'
You will see:
Never print the secret into build logs
What it means: Logs.
4. Automate and verify
Step 7: Revoke
Why: Prove deny. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: revoke. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: g1
Type this:
echo 'vault token revoke -self'
You will see:
vault token revoke -self
What it means: Revoke.
Example 20: g2
Type this:
echo 'Next kv get must fail with permission denied'
You will see:
Next kv get must fail with permission denied
What it means: Fail.
Example 21: g3
Type this:
echo 'Orphan tokens die when parent is revoked if not set otherwise'
You will see:
Orphan tokens die when parent is revoked if not set otherwise
What it means: Orphan.
Step 8: Prod tip
Why: HA and seal. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: prod. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: h1
Type this:
printf '%s\n' 'Prod: Vault HA with integrated storage or Consul' 'Auto-unseal with cloud KMS' 'Auth: Kubernetes or JWT/OIDC for CI' > /tmp/vault87/PROD.txt && cat /tmp/vault87/PROD.txt
You will see:
Auto-unseal with cloud KMS
What it means: Prod.
Example 23: h2
Type this:
echo 'Dynamic DB credentials beat static passwords when the engine supports them'
You will see:
Dynamic DB credentials beat static passwords when the engine supports them
What it means: Dynamic.
Example 24: h3
Type this:
echo 'Audit device on; ship logs to your SIEM'
You will see:
Audit device on; ship logs to your SIEM
What it means: Audit.
Step 9: Rotate
Why: Change the value. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: rotate. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: i1
Type this:
echo 'vault kv put secret/shop/db password=new-demo-value'
You will see:
vault kv put secret/shop/db password=new-demo-value
What it means: Put new.
Example 26: i2
Type this:
echo 'Apps that refresh on interval pick up the new version'
You will see:
Apps that refresh on interval pick up the new version
What it means: Refresh.
Example 27: i3
Type this:
echo 'Record the rotation in the change ticket'
You will see:
Record the rotation in the change ticket
What it means: Ticket.
5. Harden and accept
Step 10: Story Freshworks
Why: Helm values leak. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: j1
Type this:
printf '%s\n' 'At Freshworks in Chennai, a DB password lived in Helm values in git for months.' 'Kavitha moved secrets to Vault with short-lived CI tokens.' > /tmp/vault87/STORY.txt && wc -l /tmp/vault87/STORY.txt
You will see:
2 /tmp/vault87/STORY.txt
What it means: Story.
Example 29: j2
Type this:
echo 'Rough cost: about ₹22 lakh in rotations and audit work'
You will see:
Rough cost: about ₹22 lakh in rotations and audit work
What it means: Cost.
Example 30: j3
Type this:
echo 'Kavitha: PASS'
You will see:
Kavitha: PASS
What it means: Sign-off.
Step 11: Proof
Why: Files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: k1
Type this:
ls /tmp/vault87
You will see:
ACCEPT.txt\nPROD.txt\nSTART.txt\nSTORY.txt\nshop-read.hcl
What it means: Tree.
Example 32: k2
Type this:
grep read /tmp/vault87/shop-read.hcl
You will see:
capabilities = ["read"]
What it means: Policy.
Example 33: k3
Type this:
echo 'Next: External Secrets in Kubernetes project 88'
You will see:
Next: External Secrets in Kubernetes project 88
What it means: Bridge.
Step 12: Acceptance
Why: Policy-bound read works. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: z1
Type this:
echo 'KV secret written'
You will see:
KV secret written
What it means: Write.
Example 35: z2
Type this:
echo 'Child token reads only its path'
You will see:
Child token reads only its path
What it means: Token.
Example 36: z3
Type this:
echo 'Revoke denies the next read'
You will see:
Revoke denies the next read
What it means: Revoke.
Check yourself
Q1. Who fixed Freshworks leak?
Kavitha
Q2. Tool?
Vault
Q3. Store?
KV
Q4. Token life?
short TTL
Q5. Root in CI?
no
Q6. After revoke?
deny
Friends, you stored and read a secret through Vault. Did you understand? Let us try it once more. Revoke the token and prove the next read fails.
मित्रांनो, तुम्ही Vault मार्फत secret store आणि read केले. Token revoke करा आणि पुढचे read fail होते हे सिद्ध करा.
दोस्तों, आपने Vault से secret store और read किया. Token revoke करें और अगला read fail हो, यह साबित करें.
Lab: try at home
- Vault up.
- KV write.
- Policy+token.
- Revoke proves deny.
Recap
- Secrets leave git.
- Policies bound tokens.
- Short TTL.
- Revoke works.
- Root stays offline.