Production-grade study plan for centralized secrets management, dynamic credential generation, and zero-trust secret delivery into Kubernetes workloads. Covers Vault HA clustering on Raft storage, Kubernetes Auth Method, Vault Agent Sidecar Injector, External Secrets Operator (ESO), transit data encryption, and automated PKI / mTLS certificate lifecycle.
Initialize a 3-node HA Vault Raft cluster with automated KMS unseal; simulate node failure, verify Raft leader election without service downtime, and inspect tamper-evident audit logs.
Establish zero-trust authentication between Kubernetes and Vault using the Kubernetes Auth Method, validating Pod ServiceAccount JWT tokens with API Server TokenReview.
Syllabus Mastery Objectives:
Enable and configure the Vault Kubernetes Auth Method with TokenReview API validation.
Map Kubernetes ServiceAccounts and Namespaces to targeted Vault roles and ACL policies.
Implement short-lived token issuance with strictly bounded TTLs and renewal mechanisms.
Harden communication with TLS verification and cluster CA trust certificates.
Hands-On Operational Lab Challenge:
Configure the Kubernetes Auth Method against a target namespace; configure a microservice ServiceAccount, perform token exchange via CLI, and verify that unauthorized ServiceAccounts receive 403 Forbidden.
Inject secrets directly into application Pods via mutating admission webhooks, rendering confidential variables into ephemeral shared memory volumes without ever writing to persistent disk.
Syllabus Mastery Objectives:
Deploy and configure the Vault Helm chart with the Vault Agent Sidecar Injector controller.
Leverage Pod annotations (vault.hashicorp.com/*) to drive automated sidecar and init-container injection.
Render custom application config files and environment variables using Consul Template syntax.
Configure automatic secret reloads upon rotation using signals (vault.hashicorp.com/agent-inject-command).
Enforce in-memory emptyDir: { medium: Memory } mounts to prevent confidential tokens from persisting to node disk.
Hands-On Operational Lab Challenge:
Annotate a production web deployment to inject database credentials directly into /vault/secrets/config.json; update the secret in Vault and verify the sidecar agent automatically fetches the new secret and signals the application container.
Integrate with ArgoCD without committing sensitive credentials or raw Secret manifests into Git.
Configure Secret deletion policies and lifecycle reconciliation to eliminate orphaned credentials.
Hands-On Operational Lab Challenge:
Create a ClusterSecretStore authenticated to Vault; declare an ExternalSecret targeting sensitive API tokens, sync via ArgoCD, and verify the resulting native Kubernetes Secret is created and refreshed on rotation.
Eliminate static, permanent credentials by implementing dynamic on-demand database credentials with automatic lease revocations, automated internal PKI certificate authority, and Transit encryption.
Syllabus Mastery Objectives:
Configure Vault Database Secrets Engines (PostgreSQL / MySQL) generating unique, short-lived user roles for every workload instance.
Automate lease expiration and proactive credential revocation upon pod termination.
Establish an internal Private Key Infrastructure (PKI) secrets engine issuing on-demand TLS/mTLS certificates with cert-manager.
Utilize the Vault Transit Secrets Engine for Cryptography-as-a-Service (envelope encryption) without exposing raw encryption keys to application developers.
Hands-On Operational Lab Challenge:
Configure the PostgreSQL secrets engine; trigger an application to request temporary DB credentials with a 1-hour lease; verify the dynamic role exists in Postgres, wait for TTL expiry, and verify Vault automatically drops the role.