Skip to content

Vault from dev to production

Run Vault like you mean it: an HA raft cluster with TLS and auto-unseal, OIDC and Kubernetes auth, ACL policies and KV v2, dynamic database credentials, short-lived PKI, AppRole and Agent integration, audit that auditors trust, and a rotation story you can defend.

Intermediate5 sections · 13 lessons · ~7h total · 14-question self-test

01

Cluster & seal

3 lessonsTest yourself

01Why production Vault existsStanding secrets, sprawl, and the platform you need.25 min 02Dev server to HA raftStorage, unseal, and what breaks when a node dies.30 min 03TLS listeners and auto-unsealapi_addr, seals, and recovery keys done right.30 min

02

Identity & policy

2 lessonsTest yourself

01Auth methods: OIDC and KubernetesHumans via SSO, workloads via service accounts.30 min 02ACL policies that scalePath capabilities, identity, and least privilege.30 min

03

Secrets engines

3 lessonsTest yourself

01KV v2 versioning and check-and-setStatic secrets without stampeding them.25 min 02Dynamic secrets for databases and cloudCredentials that expire faster than attackers can use them.30 min 03PKI and short-lived certificatesAn internal CA with 24-hour leaf certs.30 min

04

App delivery

2 lessonsTest yourself

01AppRole and response wrappingMachines without a browser, delivered once.30 min 02Vault Agent and secret injectionTemplates, renewals, and keeping apps dumb.30 min

05

Ops & recovery

3 lessonsTest yourself

01Audit devices and on-call signalsWho read what, and what pages you.25 min 02Rotation and break-glassRoot credential rotation and the sealed-glass drill.25 min 03Snapshots, upgrades, and DRRaft snapshots and rehearsed recovery.30 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

14 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam