HashiCorp Vault Docker Integration with Docker Secret Operator

# Enable AppRole auth method
vault auth enable approle

# Create AppRole for DSO
vault write auth/approle/role/dso-role \
  token_ttl=1h \
  token_max_ttl=4h \
  secret_id_ttl=30m \
  policies="dso-policy"

# Get Role ID
vault read auth/approle/role/dso-role/role-id
# Output: role_id = a1b2c3d4-...

# Generate Secret ID (one-time use)
vault write -f auth/approle/role/dso-role/secret-id
# Output: secret_id = e5f6g7h8-...
        

# Create policy file: dso-policy.hcl
path "secret/data/app/*" {
  capabilities = ["read", "list"]
}

path "database/creds/*" {
  capabilities = ["read"]
}

path "auth/token/renew-self" {
  capabilities = ["update"]
}

# Write policy to Vault
vault policy write dso-policy @dso-policy.hcl
        

# Create static secret
vault kv put secret/app/database-password \
  password="my-secure-password"

# Create dynamic secret (requires database config)
# For this example, assuming PostgreSQL dynamic secrets configured

# Create database role
vault write database/roles/app \
  db_name=postgres \
  creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}';" \
  default_ttl="1h" \
  max_ttl="24h"

# Verify secrets exist
vault kv get secret/app/database-password
vault read database/creds/app
        

# Initialize DSO Cloud Mode with Vault
docker dso init --mode cloud \
  --provider vault \
  --vault-address https://vault.example.com:8200 \
  --vault-auth-method approle \
  --vault-role-id a1b2c3d4-... \
  --vault-secret-id e5f6g7h8-...

# Verify configuration
docker dso system info
# Output:
# Mode: Cloud
# Provider: HashiCorp Vault
# Vault Address: https://vault.example.com:8200
# Auth Method: AppRole
        

version: "3.9"

services:
  app:
    image: myapp:latest
    environment:
      # Static secrets from Vault
      - DB_PASSWORD=dso://secret/data/app/database-password#password
      - API_KEY=dso://secret/data/app/api-key#key
      # Dynamic secrets from Vault
      - DB_USER=dso://database/creds/app#username
      - DB_PASS=dso://database/creds/app#password
    networks:
      - default
    depends_on:
      - postgres

  postgres:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD: dso://secret/data/app/database-password#password
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:
        

# Deploy with secret injection from Vault
docker dso up -d

# Behind the scenes, DSO:
# 1. Authenticates to Vault using AppRole
# 2. Fetches static secrets from KV engine
# 3. Fetches/generates dynamic secrets from database engine
# 4. Injects all secrets into containers
# 5. Manages token renewal and secret rotation

# Check deployment
docker dso inspect app
# Output: Secret injection status: ACTIVE
        

# Check application can access injected secrets
docker exec app env | grep DB_PASSWORD
# Shows: DB_PASSWORD=<secret-from-vault>

# Verify connection to database (using dynamic secret)
docker exec app psql -h postgres -U {{DB_USER}} -c "SELECT version();"
# Should connect successfully with dynamic credentials

# Check Vault audit logs
vault audit list
vault read sys/audit/file-1

# See request logs in Vault
# Should show:
# - auth/approle/login (DSO authentication)
# - secret/data/app/* (secret read)
# - database/creds/* (dynamic secret generation)