Workshop: HashiCorp Vault for Development Teams

Workshop template to teach HashiCorp Vault for development teams.

Objectives

Write an application that...

1. Gets a secret from secrets management.

   1. Learn how to use the Vault API
   2. Learn how to use Vault Agent

2. Reloads when a secret changes.

   1. Refactor application to reload
   2. Configure Vault agent to reload application

3. Encrypts data in memory using secrets management.

   1. Install Vault SDK for application
   2. Write code to encrypt/decrypt with Vault keys

Prerequisites

• Docker for Desktop v4.11.1
• Vault CLI v1.16.1+
• Kubernetes v1.24.3+
• Minikube v1.26.1+

Demo Application

                              Get all payments from database
                 ┌───────────────────────────────────────────────────────┐
                 │                                                       │
                 │                                                       │
                 │                                                       │
                 │        3.If success, store encrypted payload          ▼
           payments-app────────────────────────────────────────────►payments-database
           │          ▲
           │          │
           │          │
1.POST     │          │ 2.Return
  encrypted│          │ payment
  payload  │          │ status
           │          │
           ▼          │
           payments-processor

Usage

Kubernetes

For Kubernetes, you can review the tasks in the kubernetes/Makefile directory.

Run the commands in order...

1. make setup
2. make java

To issue API calls, you can use the Postman collection. However, you'll need to update the Environment to use Minikube's tunnel addresses if you are on Mac.

Run minikube service payments-app --url. It will output the URL for the tunnel that routes to localhost.

Docker Compose

For Docker-only (mostly for in-depth examination), you can review the tasks in the docker-compose/Makefile directory.

Vault Agent Approach

Run the commands in order...

1. make setup
2. make java

Spring Cloud Vault Approach

This uses Spring Cloud Vault configuration to inject secrets and refreshes the database connection and processor sessions on an interval.

Run the commands in order...

1. make setup
2. make java-sdk

Clean Up

To clean up deployments, run make clean in the working directory for the Docker or Kubernetes setups.

Supported Platforms

• Kubernetes - in code and slides
• Docker (using Docker for Desktop) - in code only

Supported Languages & Frameworks

• Spring Boot (Java)