HashiCorp Vault - Secrets Management
Secure storage, dynamic secrets, policies, encryption and application integration. Centralise and protect your secrets.
- Deploy and configure Vault
- Manage static and dynamic secrets
- Define access policies
- Integrate Vault with applications
- Store and distribute your applications' secrets without ever putting them in plain text in code again
- Generate ephemeral database credentials: automatic rotation, no long-term credentials
- Integrate Vault into your CI/CD pipelines: each job retrieves its secrets on the fly, with an audit trail
- Audit who accessed which secret and when, making GDPR and SOC2 compliance easier
The programme
Day 1 - Fundamentals
- Vault architecture: server, storage backend, seal/unseal, audit
- Secrets engines: KV v1/v2, PKI (internal CA, x509 certificates), Transit (encryption as a service)
- Authentication: Token, AppRole, Kubernetes, AWS IAM
- HCL policies: capabilities, path-based ACLs, Sentinel
- Workshop: deploying Vault, storing KV secrets and issuing PKI certificates
Day 2 - Dynamic secrets & integration
- Dynamic secrets: PostgreSQL (short-lived credentials), AWS (temporary IAM), Azure
- Vault Agent and Vault Injector for Kubernetes: injecting secrets into pods
- CI/CD integration: GitLab CI + Vault OIDC, automatic rotation
- High availability: integrated Raft, auto-unseal (AWS KMS, GCP KMS)
- Workshop: GitLab pipeline that retrieves a dynamic Vault secret and deploys to Kubernetes
Who is this for
Ops, DevOps engineers and SREs.
Prerequisites
- Linux and API basics
- Security basics
Format
Frequently asked questions
Is the course eligible for OPCO or CPF funding?
No. Sphinx-Digital is not Qualiopi certified and is not listed on Mon Compte Formation. The course is invoiced directly to the company or the individual, with no external funding.
What is the difference between the public (inter-company) and in-company formats?
In the public format, you join a session with participants from other companies (3 to 10 people). In-company, we run a session dedicated to your team, on your site or remotely, with content adapted to your context. In-company pricing is available on quote.
Remote or on-site: what are the practical differences?
Content and labs are identical. Remotely, labs run on cloud environments accessible from a browser, with nothing to install. On-site, you provide the workstations; labs can run in the cloud or locally depending on your infrastructure.
How many participants per session?
3 to 10 participants at most. This deliberate limit ensures everyone can ask questions, adapt the exercises to their context and get a detailed answer.
What is the evening format?
The evening format spreads the same course over 4 sessions of 3.5 hours (14 hours in total), in the evening from 6:30 pm to 10:00 pm. Same content, same labs, same price, so you can build skills without taking days off.
How does payment work?
Courses are invoiced on quote, by bank transfer. Payment in instalments is possible. We issue a training agreement for companies that want their training department to cover the cost.
Interested in this course?
Join the next session or request a tailored in-company session.
What participants say
Not sure this course fits your context?
A 20-minute call to take stock before you enrol, with no sales pitch.