# Securing Secrets in the Cloud: A Hands-On Guide to HashiCorp Vault

### Why Use Secrets?

Secrets are used to store confidential data such as database usernames and passwords. It's unwise to create a configuration file with these secrets and then push it to a distributed version control system (VCS). Doing so exposes sensitive information, even if it’s encoded in base64, which can easily be decoded by anyone.

To safeguard confidential data, several solutions are available:

1. **Sealed Secrets**
    
2. **External Secret Operator (ESO)**
    
3. **Secret Store CSI driver**
    

In today's blog, we will focus on HashiCorp Vault, with plans to explore other options in future posts.

Now Let's see how?

## **Prerequisites**

* An existing [HCP account](https://portal.cloud.hashicorp.com/sign-in)
    
* A cluster
    

1. Click On "Vault Secrets" from menu on Hashicorp vault Dashboard.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722099264832/0f727395-785e-4891-904c-4a921c17eb44.png align="center")

2. Click on "Create first app".
    
3. Provide name of your app then click on "Create app".
    
4. Once You're on the secret Page, Click on "Create new Secret".
    
5. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722099510751/01f923d1-da56-479a-85f9-3aba5ddf3cf2.png align="center")
    
    For Auto rotating secret , You need to upgrade to paid version. Today we will see only static secret. Select "Static secret".
    
6. Provide name and value of you secret then click Save.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722099686026/c064b817-1c84-4446-82cd-270a9962d1d6.png align="center")
    
7. To Create another secret Click on "create new Secret".
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722099805256/a225d967-381b-4d96-86f1-a5f641fde46f.png align="center")
    
8. Provide name and value of your second secret then click save.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722099869527/dd87d031-2435-4faa-993f-1d300261d37b.png align="center")
    
9. It's time to create IAM Access to access this secret. Click on "Access Control(IAM) from main dashboard of Hashicorp vault.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722099988156/d5b2403a-a2e7-4259-bf75-e39f0a7ca5c3.png align="center")

10. Click on "**Service principals"** from left menu.
    
11. Click on "Create Service principals".
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722100167864/2739506d-560b-4842-93d8-a4739ed55c0a.png align="center")
    
12. Provide name for **Service principal name.** Select service "Secrets". Select role "Vault Secrets App Secret Reader" and Click on Create service principal.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722100450923/22d268cb-41b9-42eb-ab22-7db80ea8f775.png align="center")
    
13. Click on "Keys" From Left menu.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722100756423/7b81d1ab-bfd6-4a4b-ab1c-ec290b7489c1.png align="center")
    
14. Click on "Generate Key" and save "Client ID" and "Client Secret" somewhere else we need that later on
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722100971849/6fab1a4c-5a75-41d7-8b63-92b8f54b2b03.png align="center")
    
15. Install Vault Secrets Operator using below helm command.
    
    ```yaml
    helm repo add hashicorp https://helm.releases.hashicorp.com
    ```
    
    ```yaml
    helm install vault-secrets-operator hashicorp/vault-secrets-operator \
         --namespace vault-secrets-operator-system \
         --create-namespace
    ```
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722101576351/14aa1a11-8dda-4827-87e6-635882c0c654.png align="center")

16. Create a Kubernetes secret for the HCP service principal credentials using following command.
    

```yaml
kubectl create secret generic vso-demo-sp \
    --namespace default \
    --from-literal=clientID=$HCP_CLIENT_ID \
    --from-literal=clientSecret=$HCP_CLIENT_SECRET
```

You need to use client Id and secret which we created earlier.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722101781376/df8d53c8-fe36-487f-87c9-9a31d698992b.png align="center")

17. Now Configure Vault Secrets Operator with the HCP organization and project ID.
    

```yaml
kubectl create -f - <<EOF
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: HCPAuth
metadata:
  name: default
  namespace: vault-secrets-operator-system
spec:
  organizationID: <ORganization ID>
  projectID: <project ID>
  servicePrincipal:
    secretRef: vso-demo-sp
EOF
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722102079153/cbfa1c77-3132-47f9-903d-bd85cb4efd72.png align="center")

18. Now Create secret using below command.
    
    ```yaml
    kubectl create -f - <<EOF
    apiVersion: secrets.hashicorp.com/v1beta1
    kind: HCPVaultSecretsApp
    metadata:
      name: my-secret
    spec:
      appName: $APP_NAME
      destination:
        create: true
        labels:
          hvs: "true"
        name: my-secret
      refreshAfter: 3m
    EOF
    ```
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722102421961/235e96b7-288e-4212-9097-0499544d27a7.png align="center")

Now if you check secret, You will see new secret has been created.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722102569907/e62e6f60-2da9-46e4-9c8c-be1ac40752c3.png align="center")

Now if you check it's yaml file using following command

```yaml
k get secret my-secret -oyaml
```

You will find username and password.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722102704737/516e1f2b-c67f-4ff2-836c-e43a2febdf6e.png align="center")

Now Your secret are more secure. No need to worry about storing secret in configuration file and pushing code into VCS.

That was all for today. You can use in-house Hasicorp vault in kubernetes in production.

We will see Other ways to store your secrets in upcoming blogs.