How was the integration with Vault organized? How were secrets rotated?

Integration with Vault is usually built through its API or client libraries, which allow applications to securely retrieve and update secrets. In our implementation, services authenticated with Vault using AppRole or Kubernetes Auth, ensuring secure access to secrets.

Secret rotation was performed automatically using Vault's built-in mechanisms, such as dynamic secrets and TTL (Time To Live) policies. For example, for databases, we used dynamic credential creation with limited validity, allowing Vault to automatically generate new logins and passwords, and revoke old ones. For static secrets, periodic tasks were used to update values and refresh service configurations via subscription or push notification mechanisms.

An example configuration for rotating dynamic secrets for a database in Vault:

path "database/creds/my-role" {
  capabilities = ["read"]
}

Thus, applications requested temporary credentials that expired and were automatically renewed without manual intervention.