Secrets with Vault
Dynamic secrets and short-lived credentials for a service.
0 of 6 steps
What you will end up with
A running Vault server
Dynamic database credentials
Automatic secret rotation
Build steps
0/6Run Vault in server mode, then use vault operator init and vault operator unseal with the generated keys. Unsealing needs several separate keys turned together, like a bank vault that requires more than one person.
Run vault secrets enable database, pointed at your Postgres connection. This engine’s whole job is minting brand-new, temporary database logins on demand.
Define a role with a creation SQL statement and a short time-to-live. It is a template for a guest badge that self-destructs a few hours after it is printed.
Call vault read database/creds/my-role and Vault hands back a fresh username and password that expire on their own. No more permanent keys taped under the doormat.
Have your app fetch credentials from Vault’s API at startup instead of reading them from a config file. The app asks the front desk for a fresh key every time it checks in.
Set the role’s TTL and max TTL, and use a sidecar or init container to refetch credentials before they expire. It works like a subscription that renews itself before the old one lapses.
Before you start