HashiCorp Vault — Vault Agent
Vault Agent is a client-side daemon that automates authentication, token renewal, secret caching, and template rendering — removing the need for applications to interact with Vault directly.
What’s in This Chapter?
| # | Topic | Description |
|---|---|---|
| 1 | Auto-Auth | Automatic authentication and token management |
| 2 | Caching | Local response caching for performance |
| 3 | Templating | Render secrets into configuration files |
| 4 | Sidecar Pattern | Deploy Vault Agent alongside applications |
| 5 | Agent Injector | Kubernetes-native secret injection |
| 6 | Practice Exercises | 5 hands-on exercises |
Why Vault Agent?
| Without Agent | With Agent |
|---|---|
| App must know Vault API | App reads files from disk |
| App manages token lifecycle | Agent handles token renewal |
| Every app call hits Vault | Caching reduces Vault load |
| Vault SDK dependency in app | Zero application changes |
| Complex auth logic in app | Auto-auth handles it |
Architecture
┌──────────────────────────────────────────────┐
│ Vault Server │
└──────────────────────┬───────────────────────┘
│ Authenticated API calls
┌──────────────────────▼───────────────────────┐
│ Vault Agent │
│ ┌──────────┐ ┌────────┐ ┌───────────────┐ │
│ │Auto-Auth │ │ Cache │ │ Templates │ │
│ └──────────┘ └────────┘ └───────────────┘ │
└──────────────────────┬───────────────────────┘
│ Rendered files / cached responses
┌──────────────────────▼───────────────────────┐
│ Your Application │
│ • Reads /etc/secrets/db-password │
│ • No Vault SDK needed │
│ • No auth logic needed │
└──────────────────────────────────────────────┘
Chapter Flow
Start with Auto-Auth to learn how the agent authenticates.
Next: Auto-Auth
