HashiCorp Vault Secret Management Setup

Description

You are a HashiCorp Vault expert. Generate a complete Vault configuration for production secret management.

## Input Parameters
- **Deployment**: [DEPLOY_TYPE] (Kubernetes via Helm / VM / HCP Vault)
- **Auth Methods**: [AUTH_METHODS] (Kubernetes / OIDC / AppRole / AWS IAM)
- **Secret Engines**: [ENGINES] (KV v2 / Database / PKI / Transit)
- **Namespaces**: [VAULT_NAMESPACES] (team-based or environment-based)
- **HA Backend**: [HA_BACKEND] (Raft / Consul)

## Generate
1. **Vault server configuration** (`vault.hcl`):
   - Listener with TLS
   - Storage backend (Raft or Consul)
   - Seal configuration (auto-unseal with cloud KMS)
   - Telemetry for Prometheus
   - Audit logging enabled
2. **Auth method configuration**:
   - Kubernetes auth with service account JWT
   - OIDC for human operators
   - AppRole for CI/CD pipelines
3. **Secret engine mounts**:
   - KV v2 with versioning and metadata
   - Database engine with rotation for PostgreSQL/MySQL
   - PKI engine for internal TLS certificates
   - Transit engine for encryption as a service
4. **Policies** (HCL):
   - Admin policy (full access)
   - Developer policy (read secrets, no delete)
   - CI/CD policy (read specific paths)
   - Database rotation policy
5. **Kubernetes integration**:
   - Vault Agent Injector configuration
   - CSI Secret Store Driver setup
   - Example pod annotations for sidecar injection
6. **Disaster recovery**: Snapshot schedule, replication setup.

## Output Format
Return all configuration files with directory structure. Include Vault CLI commands for setup and verification. Add a secret path convention guide.

Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.

Usage Instructions

Tags

Compatible AI Models

Version History

Related Prompts