Originally published at woitzik.dev

Disclosure: This post contains Amazon affiliate links (marked with *). If you buy through them, I earn a small commission at no extra cost to you. I only link gear I actually own and use daily.

Vault is the trust root for every other secret on the cluster. 25+ services depend on External Secrets Operator syncing from Vault's KV v2 engine — all running on a single BMAX Mini PC* . Authelia , databases, ArgoCD notifications, Velero credentials — all of them pull from secret/<app>/* paths. Unsealing this Vault after a restart is a separate problem, solved by the polling sidecar pattern — this article only covers what's configured once Vault is already up.

Vault's configuration — policies, Kubernetes auth method, roles — was managed through vault login and CLI commands. No version control, no audit trail, no reproducibility. If someone changed a policy by hand, nobody else knew.

The goal: bring Vault's configuration (not secret values) under Terraform.…