Never display secrets
Verify metadata, modes, TTLs, versions, fingerprints, status, and expected denial.
Course outcome
Design and verify how an application, CI job, EC2 workload, or EKS pod authenticates to Vault and consumes KV data, dynamic PostgreSQL credentials, and short-lived certificates.
Safety contract
One ignored runtime area
Generated tokens, leases, credentials, certificates, and renders stay under learn-vault/.runtime.
Disposable by design
One cleanup command removes containers, volumes, and runtime material. No cloud resource is applied.
Before you start
- Full local lab: Docker with Compose, Vault CLI, Python 3, jq, curl, and OpenSSL.
- Kubernetes chapters use offline validation and optional client-side dry-run only.
- AWS IAM and GitLab CI use offline contract labs; they do not change external systems.
cd learn-vault/labs/bootstrap
./preflight.sh
./setup.sh
source ../../.runtime/learner.envChapters
Chapter 1 Supporting context · all Lockbox consumers
Vault from the Consumer Perspective
Build the consumer mental model: authenticate, receive narrow capability, obtain secret material, renew or replace it, then revoke it.
Chapter 2 Human user · PriyaSafe Local Lab and First Login
Operate a disposable Vault lab without committing bootstrap tokens, generated credentials, certificates, or runtime configuration.
Chapter 3 Human user · PriyaCLI, API, UI, Paths, and Mounts
Translate one operation across CLI and HTTP API, and distinguish a mount path from the engine-specific API path.
Chapter 4 Human user · PriyaTokens, Leases, TTLs, and Revocation
Reason about the independent lifetimes of the Vault token and the material obtained with it.
Chapter 5 Human user · PriyaPolicies and 403 Troubleshooting
Turn permission denied into a precise capability diagnosis without broadening access blindly.
Chapter 6 Human user · PriyaKV v2 Without Secret Sprawl
Use versioned static secrets while keeping values out of source, logs, history, arguments, and durable application storage.
Chapter 7 Application/workload user · orders-apiChoose Workload Auth and Use AppRole
Prefer identity-native authentication and use AppRole only for constrained machines without a stronger runtime identity.
Chapter 8 Application/workload user · orders-apiDynamic PostgreSQL Credentials
Replace a shared database password with leased PostgreSQL users, least privilege, pool rotation, and revocation.
Chapter 9 Application/workload user · orders-apiShort-Lived PKI Certificates
Issue a short-lived service certificate, validate its identity and chain, install it atomically, and replace it before expiry.
Chapter 10 Application/workload user · orders-apiVault Agent for Applications
Use Vault Agent auto-auth and templates to separate token lifecycle from application code while preserving a clear reload contract.
Chapter 11 CI user · GitLab pipelineGitLab CI with ID Tokens
Exchange a job-scoped GitLab OIDC ID token for narrow Vault access without storing a reusable CI credential.
Chapter 12 Application/workload user · orders-apiAWS IAM Authentication
Authenticate an AWS workload by proving IAM identity through a signed request instead of distributing a Vault login secret.
Chapter 13 Application/workload user · orders-apiKubernetes Authentication on EKS
Authenticate a pod with a projected service-account token bound to namespace, service account, audience, and lifetime.
Chapter 14 Application/workload user · orders-apiInjector, CSI, or Direct API
Choose Kubernetes delivery by lifecycle ownership, update semantics, coupling, and failure behavior.
Chapter 15 Application/workload user · orders-apiRotation, Reload, Caching, and Outages
Design a bounded state machine for fresh, renewing, stale-but-valid, terminal, and recovered secret states.
Chapter 16 Application/workload user · orders-apiProject Lockbox Readiness Drills
Assemble the design and prove it through rotation, revocation, outage, denial, cleanup, and recovery evidence.
Project Lockbox target
orders-api ends with identity-native login, least-privilege paths, timed credentials, protected delivery, atomic reload, safe telemetry, and tested outage behavior.