The gap is not conceptual
Engineers understand what Vault does within an hour, then spend months learning what the error messages mean, which defaults will hurt, and what happens at three in the morning when a cluster comes back sealed and nobody can find the third unseal key.
The book follows a fictional logistics company from passwords-in-Git to a production-shaped installation. Every chapter ends with the real error messages, their causes and their fixes. Five chapters ask you to destroy your own setup, because nobody who has recovered a sealed cluster under pressure learned how from a reference manual.
- Length
- 598 pages · 24 chapters · 12 appendices
- Labs
- 24 hands-on labs, all runnable on a laptop in Docker
- Covers
- HashiCorp Vault and OpenBao, side by side
- Formats
- PDF and EPUB, from Leanpub
Free updates for every future edition.
Not a tour of the feature list. Eight of the twenty-four labs, so the shape of the rest is visible:
- Split an encryption key with Shamir, then lose it on purpose
- Write policies that fail, and find out why in one command
- Issue database credentials that did not exist until asked for
- Run a certificate authority with 24-hour certificates
- Encrypt data without the application ever holding a key
- Break a Raft cluster's quorum, and put it back together
- Deliver secrets into Kubernetes four different ways
- Deploy OpenBao, and answer the licence question honestly
Twenty-four chapters
- The Problem With Secrets
- Building Your Lab
- Initialise, Seal, Unseal
- The CLI, the API, and the UI
- Tokens
- Policies
- Authentication Methods
- Identity, Entities, and Groups
- Key/Value Secrets
- Dynamic Database Credentials
- Leases, Renewal, and Revocation
- Encryption as a Service
- Running Your Own CA
- Response Wrapping and Secret Zero
- Vault Agent
- Kubernetes Foundations
- Delivering Secrets into Pods
- OpenBao
- SSH, Cloud, and Other Engines
- Storage Backends
- High Availability and Raft
- Auto-Unseal
- Audit and Operations
- Production Checklist
Twelve appendices follow, among them a command reference, a troubleshooting guide, an exam objective map, a practice exam, a production readiness review and a chapter on migrating an existing estate.
Platform engineers, SREs and security engineers who will be responsible for a Vault installation — not for evaluating one. The book assumes you are comfortable on a Linux command line and with containers; it does not assume you have used Vault before.
It covers the Vault Associate exam objectives in full and ends with a practice exam, so it doubles as preparation without being written as a cram guide.
HashiCorp and Vault are trademarks of HashiCorp, Inc. This book is an independent publication and is not affiliated with, authorized by, sponsored by, or otherwise approved by HashiCorp, Inc.