vishal-tinani // gui-mode // projects/6
Vishal Tinani
DevOps Specialist
← BACK TO PROJECTS
Zero-Trust Secrets Injector with HashiCorp Vault
Bootstrapped enterprise Vault cluster integrated with Kubernetes Service Accounts to inject db credentials and API tokens dynamically into running pod environments.
$ cat project-plan.md
- Bootstrap a highly available Vault cluster using Consul backend storage.
- Enable K8s authentication methods to allow pods to parse secrets.
- Incorporate Transit secrets engines to encrypt data at rest.
$ get --toolchain
HashiCorp VaultTransit EngineKubernetesSecrets Management
$ history --commands
vault auth enable kubernetesvault write auth/kubernetes/config kubernetes_host=https://kubernetes.default.svcvault write transit/keys/payment-key type=aes256-gcm96$ grep --errors --challenges
⚠️ CHALLENGE: Kubernetes pods failing to read secret keys because of permissions.
✔️ RESOLUTION: Created explicit Vault policy rules and bound them strictly to the target pod ServiceAccounts.
$ render --infrastructure --architecture
Zero-Trust Secret Injection Flow
🐳
K8s Pod
App Container
🔑
Vault Agent
Dynamic Sidecar
📦
Consul Store
HA Storage