Vault patterns

Skill Mattakushi432/Claude-Code-Skills-Custom-DevTools-Pack/plugins/devtools-pack/skills/vault-patterns

A curated pack of custom Claude Code skills for developers — installable as a Claude Code plugin marketplace.

Install

npx -y skills add Mattakushi432/Claude-Code-Skills-Custom-DevTools-Pack --skill vault-patterns

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

When to activate: HashiCorp Vault, secrets engine, auth method, dynamic secrets, lease, agent sidecar, KV store, PKI, AppRole

SKILL.md

4.2 KB, as published. Nobody here has run it

HashiCorp Vault Patterns

Core Concepts

Secrets Engines — plugins that store/generate/encrypt secrets
  kv-v2        — versioned key-value store
  database     — dynamic DB credentials (auto-rotated)
  pki          — certificate authority
  aws/gcp/azure — dynamic cloud credentials

Auth Methods — how clients prove identity
  kubernetes   — pod service account JWT
  approle      — CI/CD pipelines
  aws          — IAM role binding
  oidc         — SSO / human users

Policies — what a token can access
  path "secret/data/myapp/*" { capabilities = ["read"] }

KV v2 — Static Secrets

# Enable
vault secrets enable -path=secret kv-v2

# Write
vault kv put secret/myapp/prod \
  db_password="s3cr3t" \
  api_key="abc123"

# Read
vault kv get -field=db_password secret/myapp/prod

# List versions
vault kv metadata get secret/myapp/prod

# Read specific version
vault kv get -version=3 secret/myapp/prod

Dynamic Database Credentials

# Enable
vault secrets enable database

# Configure connection
vault write database/config/mydb \
  plugin_name=postgresql-database-plugin \
  connection_url="postgresql://{{username}}:{{password}}@db:5432/mydb" \
  allowed_roles="readonly,readwrite" \
  username="vault" \
  password="vaultpass"

# Create role (credentials expire in 1h)
vault write database/roles/readonly \
  db_name=mydb \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# Generate credentials (app calls this)
vault read database/creds/readonly
# → username: v-readonly-Abc123, password: A1B2C3...

Kubernetes Auth Method

# Enable
vault auth enable kubernetes

# Configure
vault write auth/kubernetes/config \
  kubernetes_host="https://kubernetes.default.svc" \
  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

# Create role binding pod SA → vault policy
vault write auth/kubernetes/role/myapp \
  bound_service_account_names=myapp-sa \
  bound_service_account_namespaces=prod \
  policies=myapp-policy \
  ttl=1h

Vault Agent Sidecar (Kubernetes)

spec:
  serviceAccountName: myapp-sa
  volumes:
    - name: vault-secrets
      emptyDir: { medium: Memory }
  initContainers:
    - name: vault-agent-init
      image: hashicorp/vault:1.15
      args: [agent, -config=/vault/config/agent.hcl, -exit-after-auth]
      volumeMounts:
        - name: vault-secrets
          mountPath: /vault/secrets
  containers:
    - name: myapp
      volumeMounts:
        - name: vault-secrets
          mountPath: /vault/secrets
          readOnly: true
      env:
        - name: DB_PASSWORD
          value: /vault/secrets/db_password   # or use envconsul

# agent.hcl
vault {
  address = "https://vault.vault.svc.cluster.local:8200"
}
auto_auth {
  method "kubernetes" {
    mount_path = "auth/kubernetes"
    config = { role = "myapp" }
  }
}
template {
  destination = "/vault/secrets/db_password"
  contents    = <<EOT
{{ with secret "database/creds/readonly" }}{{ .Data.password }}{{ end }}
EOT
}

Policy Example

# myapp-policy.hcl
path "secret/data/myapp/prod/*" {
  capabilities = ["read"]
}
path "database/creds/readonly" {
  capabilities = ["read"]
}
path "pki/issue/myapp" {
  capabilities = ["create", "update"]
}

vault policy write myapp myapp-policy.hcl

Key Rules

Never store long-lived static credentials — use dynamic secrets with short TTL
Seal/unseal with auto-unseal (AWS KMS, GCP KMS) — never manual unseal in prod
Enable audit logging: vault audit enable file file_path=/var/log/vault/audit.log
Use vault agent sidecar to handle token renewal automatically
Rotate the root token immediately after cluster init; use break-glass procedure instead