3 min to read

Understanding HashiCorp Vault - Core Concepts and Architecture

A comprehensive guide to HashiCorp Vault's fundamentals and working principles

Featured image


🎯 Overview

This post explores HashiCorp Vault, a powerful secrets and encryption management system. We’ll dive into its core concepts, working principles, and architecture.


🔐 What is Vault?

HashiCorp Vault is an identity-based secrets and encryption management system. It provides:

  • Secure storage for sensitive data like API keys, passwords, and certificates
  • Encryption services controlled through authentication and authorization methods
  • Multiple interfaces (UI, CLI, HTTP API) for managing secrets
  • Strict access control and audit capabilities


How Vault Works


Core Workflow Steps:
  1. Authentication: Clients provide credentials to prove their identity
  2. Validation: Vault validates clients against trusted third-party sources (Github, LDAP, AppRole)
  3. Authorization: Vault checks client permissions against security policies
  4. Access: Vault issues tokens based on client identity policies


Key Features


1. Secure Secret Storage
  • Centralized storage for all credentials
  • Encryption before persistent storage
  • Multiple storage backend support
2. Dynamic Secrets
  • On-demand secret generation
  • Automatic secret rotation
  • Support for various systems (AWS, SQL databases)
3. Data Encryption
  • Encryption/decryption without storage
  • Centralized encryption parameters
  • Developer-friendly implementation
4. Lease Management
  • Automatic secret expiration
  • Built-in renewal API
  • Time-based access control
5. Revocation
  • Individual secret revocation
  • Tree-based revocation
  • Support for key rolling


Vault Architecture

sequenceDiagram participant Client participant Vault Server participant Storage Backend Note over Client, Vault Server: Initialization Phase Client ->> Vault Server: Initialize Vault (POST /v1/sys/init) Vault Server ->> Storage Backend: Store master keys and initial token Storage Backend -->> Vault Server: Acknowledge storage Vault Server -->> Client: Return unseal keys and initial root token Note over Client, Vault Server: Unseal Phase loop Unseal Process Client ->> Vault Server: Unseal Vault (POST /v1/sys/unseal) Vault Server -->> Vault Server: Verify unseal key Vault Server -->> Client: Unseal progress update end Note over Client, Vault Server: Operational Phase Client ->> Vault Server: Login (POST /v1/auth/{method}/login) Vault Server ->> Storage Backend: Validate credentials Storage Backend -->> Vault Server: Token generation Vault Server -->> Client: Return token Client ->> Vault Server: Request secret (GET /v1/secret/data/{name}) Vault Server ->> Storage Backend: Retrieve secret Storage Backend -->> Vault Server: Return secret Vault Server -->> Client: Secret data


Initialization Phase

graph LR; A[Client] -->|Init Request| B[Vault Server]; B -->|Store| C[Storage Backend]; B -->|Return Keys| A;

Unseal Phase

  1. Initial sealed state
  2. Multiple unseal key submissions
  3. Threshold-based unsealing

Operational Phase

graph LR; A[Client] -->|Login Request| B[Vault Server]; B -->|Validate| C[Storage Backend]; B -->|Session Token| A; A -->|Secret Request| B; B -->|Return Secret| A;


Next Steps

In the next post, we’ll explore the practical aspects of installing and using Vault in a production environment.


References