Vault in Practice

You can read about Vault in an afternoon. You will still not be able to run it.

The gap is not conceptual. Almost every engineer who adopts Vault understands what it does within an hour — and then spends months learning the things documentation does not teach: what the error messages mean, which defaults will hurt, and what actually happens at three in the morning when a cluster comes back sealed and nobody can find the third unseal key.

This book closes that gap the only way it can be closed. You type.

Twenty-four chapters, each ending in a working lab that runs on your laptop in Docker. No cloud account. No spare server. No credit card. Follow a fictional logistics company from passwords-in-Git to a production-shaped Vault installation, and build every piece yourself: initialise a real cluster and split the key with Shamir's Secret Sharing; write policies that fail, find out why, and fix them; issue database credentials that did not exist until the moment they were requested; run your own certificate authority with 24-hour certificates; encrypt application data without the application ever holding a key; deliver secrets into Kubernetes four different ways, and understand which one your auditor will object to; build a three-node Raft cluster, break its quorum on purpose, and recover it; configure auto-unseal with no cloud provider involved.

Five chapters ask you to destroy your own setup. You will lose unseal keys and discover there is no way back. You will break the only audit device and watch a healthy Vault refuse every request. You will revoke the last token that can administer your installation, and get back in with the unseal keys.

Those chapters are the reason this book exists. Nobody who has recovered a sealed cluster under pressure learned it from a reference manual.

Every chapter includes a What Went Wrong section: the real error text, the cause, and the fix. By the end, the errors are familiar rather than frightening.

Who this is for: platform engineers, SREs, DevOps engineers and security engineers who will be responsible for a Vault installation — whether they chose it or inherited it. You need to be comfortable in a terminal. You do not need prior Vault experience.

Studying for the certification? The book does not teach to an exam, but Appendix F maps every published HashiCorp Certified: Vault Associate objective to the chapter and lab that covers it.

Includes ten appendices: installation for macOS, Linux and Windows, a complete command reference, every default and number worth knowing, all environment variables, HTTP status codes decoded, the objective map, a troubleshooting index by error message, a one-command lab reset, a migration plan for an estate that already has secrets in it, and a 57-question practice exam under real timing.

HashiCorp and Vault are trademarks of HashiCorp, Inc. This book is an independent publication and is not affiliated with, authorized by, or endorsed by HashiCorp, Inc.