HashiCorp Vault — FAQ

3 minute read

Frequently asked questions about HashiCorp Vault.

General

What is the difference between Vault OSS and Enterprise?

Feature OSS Enterprise
KV, Transit, PKI ✅ ✅
Auth methods ✅ ✅
HA with Raft ✅ ✅
Namespaces ❌ ✅
Control Groups ❌ ✅
Replication (DR/Performance) ❌ ✅
Transform Engine ❌ ✅
Automated Snapshots ❌ ✅
Sentinel Policies ❌ ✅

Is Vault free?

Yes, Vault OSS is free and open source under the BSL license. HCP Vault (cloud-managed) has a free tier. Enterprise requires a commercial license.

Can I use Vault in production with OSS?

Absolutely. Many organizations run Vault OSS in production. You miss enterprise features like namespaces and replication, but all core secrets management features are available.

Architecture

How many Vault nodes do I need?

Deployment Nodes Why
Dev/Test 1 Simplicity
Small Production 3 HA with Raft quorum
Large Production 5 Higher fault tolerance

What storage backend should I use?

Raft (recommended) — built-in, HA-capable, no external dependencies. Previously, Consul was the recommended backend, but Raft is now preferred for most deployments.

Does Vault store my secrets in plain text?

No. All data is encrypted with AES-256-GCM before being written to the storage backend. The storage backend only sees ciphertext.

Operations

What happens if Vault is sealed?

All secrets become inaccessible. Applications using Vault will fail to retrieve secrets until Vault is unsealed. Use auto-unseal with cloud KMS to minimize this risk.

How do I recover if I lose unseal keys?

If you lose enough unseal keys to not meet the threshold, the data is permanently inaccessible. With auto-unseal, the cloud KMS key serves this purpose instead. Always distribute and backup unseal/recovery keys securely.

How do I rotate Vault’s own TLS certificates?

# Replace certificate files, then reload
vault operator reload
# Or: kill -HUP $(pgrep vault)

No restart required — Vault reloads TLS configuration on SIGHUP.

Can I change the storage backend?

Not directly. You must:

  1. Take a snapshot or export secrets
  2. Deploy a new Vault cluster with the new backend
  3. Restore or re-import secrets

Secrets Management

KV v1 vs KV v2 — which should I use?

KV v2 for nearly all use cases. It provides versioning, metadata, soft-delete, and check-and-set operations. Use KV v1 only for simple key-value storage where versioning overhead is unwanted.

How do dynamic secrets work?

  1. Application requests credentials from Vault
  2. Vault connects to the target system (e.g., PostgreSQL)
  3. Vault creates a unique credential pair
  4. Vault returns credentials with a lease (TTL)
  5. When the lease expires, Vault revokes the credentials
  6. The target system removes the user

What is the maximum secret size?

Vault has a default maximum request size of 32 MB. For large data, use Transit’s envelope encryption pattern instead of storing large blobs in KV.

Authentication

AppRole vs Kubernetes Auth — when to use which?

Scenario Recommendation
CI/CD pipelines AppRole
Kubernetes pods Kubernetes auth
VMs / bare metal AppRole
Human users OIDC or LDAP
AWS workloads AWS auth

How do I authenticate from a CI/CD pipeline?

# Most common: AppRole
# Store role_id in CI settings (not sensitive)
# Deliver secret_id via response wrapping or push mechanism

vault write auth/approle/login \
    role_id=$ROLE_ID \
    secret_id=$SECRET_ID

Troubleshooting

“permission denied” errors

  1. Check that your token has the correct policies
  2. Verify the policy paths match your request path exactly
  3. Remember: KV v2 paths are secret/data/... not secret/...
  4. Use vault token capabilities <token> <path> to debug

Vault is not responding

  1. Check if Vault is running: systemctl status vault
  2. Check if sealed: vault status
  3. Check logs: journalctl -u vault
  4. Check network/firewall: curl -s $VAULT_ADDR/v1/sys/health

Leases are piling up

# Check lease count
vault read sys/metrics | grep num_leases

# Revoke by prefix
vault lease revoke -prefix database/creds/

# Tidy leases
vault write sys/leases/tidy

Congratulations! 🎉

You’ve completed the entire HashiCorp Vault tutorial. You now have the knowledge to:

  • Deploy and manage Vault in production
  • Implement secrets management for applications
  • Build PKI infrastructure and mTLS
  • Automate secret injection with Vault Agent
  • Integrate with Kubernetes
  • Monitor and maintain HA clusters
  • Prepare for the Vault Associate certification

Go back to: Vault Home

You may also enjoy