# Simple key-value secret storage
# Version history, soft delete support
 
# Write
vault kv put secret/user-service/production \
  db_url="postgres://user:pass@rds.amazonaws.com:5432/users" \
  jwt_secret="$(openssl rand -hex 32)"
 
# Read
vault kv get secret/user-service/production
 
# Get specific field
vault kv get -field=db_url secret/user-service/production
 
# Version history
vault kv get -version=2 secret/user-service/production
 
# Policy (HCL)
path "secret/data/user-service/production" {
  capabilities = ["read"]
}
# user-service sirf apna secret read kar sakti hai, dusre ki nahi

# Vault setup (admin karta hai once)
vault secrets enable database
 
vault write database/config/users-db \
  plugin_name=postgresql-database-plugin \
  allowed_roles="user-service,order-service" \
  connection_url="postgresql://{{username}}:{{password}}@rds.amazonaws.com:5432/users" \
  username="vault-admin" \
  password="admin-password"
 
# Role define karo (kya creds banaenge)
vault write database/roles/user-service \
  db_name=users-db \
  creation_statements="
    CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
    GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";
  " \
  default_ttl="1h" \
  max_ttl="24h"
 
# Service se dynamic creds request karo
vault read database/creds/user-service
# Output:
# Key                Value
# ---                -----
# lease_id           database/creds/user-service/xyz123
# lease_duration     1h
# username           v-approl-user-ser-RANDOM
# password           A1a-RANDOM-RANDOM
 
# Revoke before expiry (service stop/compromise)
vault lease revoke database/creds/user-service/xyz123

// Go Transit engine usage
package encryption
 
import (
    "encoding/base64"
    vault "github.com/hashicorp/vault/api"
)
 
type VaultEncryptor struct {
    client  *vault.Client
    keyName string
}
 
func (e *VaultEncryptor) Encrypt(plaintext string) (string, error) {
    encoded := base64.StdEncoding.EncodeToString([]byte(plaintext))
    
    secret, err := e.client.Logical().Write(
        "transit/encrypt/"+e.keyName,
        map[string]interface{}{
            "plaintext": encoded,
        },
    )
    if err != nil {
        return "", fmt.Errorf("vault encrypt: %w", err)
    }
    
    ciphertext, ok := secret.Data["ciphertext"].(string)
    if !ok {
        return "", errors.New("vault: invalid ciphertext response")
    }
    return ciphertext, nil   // "vault:v1:ABC123..."
}
 
func (e *VaultEncryptor) Decrypt(ciphertext string) (string, error) {
    secret, err := e.client.Logical().Write(
        "transit/decrypt/"+e.keyName,
        map[string]interface{}{
            "ciphertext": ciphertext,
        },
    )
    if err != nil {
        return "", fmt.Errorf("vault decrypt: %w", err)
    }
    
    encoded := secret.Data["plaintext"].(string)
    decoded, err := base64.StdEncoding.DecodeString(encoded)
    if err != nil {
        return "", fmt.Errorf("base64 decode: %w", err)
    }
    return string(decoded), nil
}

# PKI engine setup
vault secrets enable pki
vault secrets tune -max-lease-ttl=87600h pki
 
# Root CA generate karo
vault write pki/root/generate/internal \
  common_name="company.internal" \
  ttl=87600h   # 10 years (root CA)
 
# Intermediate CA (better practice)
vault secrets enable -path=pki_int pki
vault write pki_int/intermediate/generate/internal \
  common_name="company Intermediate CA"
 
# Certificate role
vault write pki_int/roles/user-service \
  allowed_domains="user-service.default.svc.cluster.local" \
  allow_subdomains=true \
  max_ttl="24h"   # certificates valid for 24 hours only
 
# Issue certificate (service karta hai)
vault write pki_int/issue/user-service \
  common_name="user-service.default.svc.cluster.local" \
  ttl=24h
# Returns: certificate, private_key, issuing_ca

# Setup AppRole for user-service
vault auth enable approle
 
vault write auth/approle/role/user-service \
  token_policies="user-service-policy" \
  token_ttl=1h \
  token_max_ttl=4h \
  secret_id_ttl=24h \        # SecretID expires in 24h
  secret_id_num_uses=0        # Unlimited uses within TTL
 
# Get RoleID (permanent, non-secret)
vault read auth/approle/role/user-service/role-id
# role_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 
# Generate SecretID (per deployment)
vault write -f auth/approle/role/user-service/secret-id
# secret_id:        yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
# secret_id_ttl:    24h
 
# Login
vault write auth/approle/login \
  role_id="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
  secret_id="yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"
# Returns: token (1h valid)

# K8s Pod with Vault Agent sidecar
apiVersion: v1
kind: ServiceAccount
metadata:
  name: user-service
  annotations:
    vault.hashicorp.com/role: "user-service"    # Vault role name
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  template:
    metadata:
      annotations:
        # Vault Agent Injector automatically injects sidecar
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "user-service"
        
        # Which secret, as what file
        vault.hashicorp.com/agent-inject-secret-config.env: "secret/data/user-service/production"
        
        # Template: secret ko env file format mein
        vault.hashicorp.com/agent-inject-template-config.env: |
          {{- with secret "secret/data/user-service/production" -}}
          export DB_URL="{{ .Data.data.db_url }}"
          export JWT_SECRET="{{ .Data.data.jwt_secret }}"
          export REDIS_URL="{{ .Data.data.redis_url }}"
          {{- end }}
    
    spec:
      serviceAccountName: user-service
      containers:
        - name: user-service
          image: user-service:abc1234
          command: ["sh", "-c", "source /vault/secrets/config.env && exec /server"]
          # OR: read file programmatically in Go

// Go: read secrets from Vault Agent rendered file
func loadSecrets() (*Config, error) {
    // Vault Agent ne /vault/secrets/db-creds.json write kiya hai
    data, err := os.ReadFile("/vault/secrets/db-creds.json")
    if err != nil {
        return nil, fmt.Errorf("read vault secrets: %w", err)
    }
    
    var creds struct {
        Username string `json:"username"`
        Password string `json:"password"`
    }
    if err := json.Unmarshal(data, &creds); err != nil {
        return nil, fmt.Errorf("parse vault secrets: %w", err)
    }
    
    return &Config{
        DBUser:     creds.Username,
        DBPassword: creds.Password,
    }, nil
}