This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| Vault (HashiCorp) | |
|---|---|
| Name | Vault |
| Developer | HashiCorp |
| Initial release | 2015 |
| Programming language | Go |
| License | MPL 2.0 / Business Source License (enterprise) |
| Website | HashiCorp |
Vault (HashiCorp) Vault is a secrets management and data protection tool developed by HashiCorp that centralizes the storage, access, and lifecycle of credentials, encryption keys, and certificates. It integrates with cloud providers, orchestration systems, identity platforms, and hardware security modules to provide dynamic secrets, encryption-as-a-service, and robust auditability. Vault is used by organizations across industries to reduce secret sprawl, enforce least-privilege access, and automate secret rotation.
Vault was announced by HashiCorp as part of a suite including Vagrant (software), Terraform, Consul (software), and Nomad (software). It competes with offerings from Amazon Web Services, Google Cloud Platform, Microsoft Azure, and specialist vendors like CyberArk and Thycotic. Vault is implemented in Go (programming language) and supports multiple backends, allowing integration with services such as etcd, Consul (software), Amazon S3, and Google Cloud Storage. The project has both open-source and commercial editions, and is developed in the context of infrastructure automation and cloud-native adoption trends driven by projects like Kubernetes and Docker (software).
Vault follows a client-server model with pluggable storage backends and secret engines. The server core handles encryption, tokenization, and audit logging while storage backends such as Consul (software), etcd, Amazon S3, and PostgreSQL persist state. Vault supports high availability using techniques similar to RAFT (computer science) and integrates with clustering approaches used by Kubernetes and Nomad (software). Authentication is provided through methods that map to external identity systems like LDAP, Active Directory, Okta, Auth0, and cloud IAM services from Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Certificate management uses PKI concepts compatible with Let's Encrypt and enterprise PKI systems.
Vault provides secrets engines, authentication methods, and audit devices. Secrets engines include dynamic database credentials for systems such as PostgreSQL, MySQL, and MongoDB (database), cloud credential issuance for Amazon Web Services, Google Cloud Platform, and Microsoft Azure, and a PKI engine for issuing TLS certificates recognized by browsers and load balancers from vendors like F5 Networks and Nginx. Authentication methods include token auth, LDAP integration with Active Directory, OIDC flows with providers like Okta and Auth0, and Kubernetes service account integration with Kubernetes. Encryption features include transit encryption for application-level encryption modeled on AES primitives and HSM integration via PKCS#11 and services like AWS CloudHSM and Venafi. Audit devices record events to sinks such as Syslog, Splunk, and ELK Stack components like Elasticsearch and Logstash.
Common use cases include secret injection for Kubernetes workloads, dynamic credential generation for CI/CD pipelines using tools like Jenkins (software), GitLab CI/CD, and CircleCI, and certificate lifecycle automation for edge services run on NGINX and HAProxy. Vault is integrated into infrastructure-as-code workflows with Terraform providers, service mesh deployments with HashiCorp Consul and Istio, and platform engineering systems such as Cloud Foundry and OpenShift. Enterprises employ Vault in conjunction with identity providers like Okta, governance platforms like SailPoint Technologies, and monitoring stacks including Prometheus and Grafana.
Vault's threat model emphasizes least-privilege, auditability, and encryption of data-at-rest and data-in-transit. It supports cryptographic primitives consistent with standards from NIST and interoperates with FIPS 140-2 validated modules through HSM integrations from Thales Group and Gemalto. Audit logging and policy-driven access use techniques compatible with compliance frameworks such as PCI DSS, HIPAA, SOC 2, and ISO 27001. Secrets engines and rotation policies help meet controls for credential management mandated by regulations enforced or advised by bodies like SEC and GDPR (EU). Role-based access and identity federation simplify attestations required for audits conducted by firms like Deloitte and PwC.
Vault can be deployed on-premises, in public clouds such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure, or within container orchestration platforms like Kubernetes and OpenShift. Operators commonly use provisioning tools including Terraform and configuration management systems like Ansible (software), Puppet (software), and Chef (software). High-availability setups use consensus protocols related to RAFT (computer science) and storage backends like Consul (software). Backup, disaster recovery, and unsealing workflows may involve multi-party key sharing inspired by Shamir's Secret Sharing and integration with HSMs. Observability relies on exporters for Prometheus and dashboards in Grafana; alerting integrates with PagerDuty and Opsgenie.
Vault is maintained by HashiCorp with contributions from a community on platforms such as GitHub, and discussions happen in forums attended by users from organizations like Netflix and Spotify. The project is released under a combination of licenses: core components under Mozilla Public License and enterprise features under a business license similar to patterns used by companies like Confluent. Commercial support and training are available from HashiCorp and partners including Accenture and HashiCorp Certified training providers. Roadmap and feature development are influenced by industry trends shaped by projects like Kubernetes and standards bodies such as Cloud Native Computing Foundation. Category:HashiCorp