codesnips
yaml 131 lines · 1 tab

HashiCorp Vault for secrets management in Kubernetes

Ryan Nakamura Feb 2026
1 tab 
# === Vault Agent Injector: Auto-inject secrets into pods ===
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-server
  template:
    metadata:
      labels:
        app: api-server
      annotations:
        # Vault Agent Injector annotations
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "api-server"

        # Inject database credentials
        vault.hashicorp.com/agent-inject-secret-db-creds: "database/creds/api-readonly"
        vault.hashicorp.com/agent-inject-template-db-creds: |
          {{- with secret "database/creds/api-readonly" -}}
          export DATABASE_URL="postgres://{{ .Data.username }}:{{ .Data.password }}@db.internal:5432/myapp"
          {{- end }}

        # Inject API keys from KV store
        vault.hashicorp.com/agent-inject-secret-api-keys: "secret/data/production/api-keys"
        vault.hashicorp.com/agent-inject-template-api-keys: |
          {{- with secret "secret/data/production/api-keys" -}}
          export STRIPE_SECRET_KEY="{{ .Data.data.stripe_key }}"
          export SENDGRID_API_KEY="{{ .Data.data.sendgrid_key }}"
          {{- end }}

        # Auto-rotate: re-read secrets every 5 minutes
        vault.hashicorp.com/agent-inject-command-db-creds: "kill -HUP $(pidof api-server)"
        vault.hashicorp.com/secret-volume-path: "/vault/secrets"
    spec:
      serviceAccountName: api-server
      containers:
        - name: api
          image: myapp-api:latest
          command:
            - /bin/sh
            - -c
            - |
              # Source the injected secrets
              source /vault/secrets/db-creds
              source /vault/secrets/api-keys
              exec ./start-server
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
---
# === Vault Policy ===
# Save as: vault-policy-api-server.hcl
# vault policy write api-server vault-policy-api-server.hcl
#
# path "database/creds/api-readonly" {
#   capabilities = ["read"]
# }
#
# path "secret/data/production/api-keys" {
#   capabilities = ["read"]
# }
#
# path "secret/metadata/production/*" {
#   capabilities = ["list"]
# }
---
# === Vault Kubernetes Auth Setup (run once) ===
# vault auth enable kubernetes
#
# vault write auth/kubernetes/config \
#   kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443"
#
# vault write auth/kubernetes/role/api-server \
#   bound_service_account_names=api-server \
#   bound_service_account_namespaces=production \
#   policies=api-server \
#   ttl=1h
---
# === External Secrets Operator (alternative approach) ===
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
  namespace: production
spec:
  provider:
    vault:
      server: "https://vault.internal:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "api-server"
          serviceAccountRef:
            name: "api-server"
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: api-secrets
  namespace: production
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: api-secrets          # Creates this K8s Secret
    creationPolicy: Owner
  data:
    - secretKey: STRIPE_KEY
      remoteRef:
        key: production/api-keys
        property: stripe_key
    - secretKey: SENDGRID_KEY
      remoteRef:
        key: production/api-keys
        property: sendgrid_key
    - secretKey: JWT_SECRET
      remoteRef:
        key: production/auth
        property: jwt_secret
1 file · yaml Explain with highlit

Integrate HashiCorp Vault with Kubernetes for dynamic secrets management. Use the Vault Agent sidecar injector to automatically inject secrets into pods, configure KV secret engines, and set up Kubernetes authentication. Eliminate hardcoded secrets from your manifests.

Related snips

ruby 
payload = {
  sub: user.id,
  iss: 'https://auth.example.com',
  aud: 'codesnips-api',
  exp: 15.minutes.from_now.to_i,
  iat: Time.now.to_i,

JWT issuance and verification without common footguns

jwt authentication api
by Kai Nakamura 2 tabs
bash 
#!/usr/bin/env bash
set -euo pipefail

export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"

Secrets management with environment isolation and Vault

secrets-management vault environment-variables
by Kai Nakamura 1 tab
typescript 
import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";

const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";

JWT access + refresh token rotation (conceptual)

security node jwt
by codesnips 3 tabs
go 
package files

import (
  "context"
  "time"

Presigned S3 upload URLs (AWS SDK v2)

go aws s3
by Leah Thompson 1 tab
erb 
<%# private stream: turbo signs the serialized record name %>
<%= turbo_stream_from current_user %>

<section class="notifications">
  <h1>Notifications</h1>

Turbo Streams + authorization: signed per-user stream name

rails turbo hotwire
by codesnips 3 tabs
go 
package api

import (
  "io"
  "net/http"
  "os"

Safe multipart uploads using temp files (bounded memory)

go http uploads
by Leah Thompson 1 tab

Share this code

Here's the card — post it anywhere.

HashiCorp Vault for secrets management in Kubernetes — share card
Link copied