Guides / Secrets Management

How to Install & Set Up HashiCorp Vault

Install HashiCorp Vault from the official APT repository, write your first secret, then see how it initializes/unseals/authorizes for real once you're past the dev server.

Updated 20268-step setupDownload HashiCorp Vault →

Prerequisites

  • ✓A Linux host

What Vault is actually managing

Vault sits between callers and secrets and mediates every request through two layers: auth methods, which establish who's calling (tokens, LDAP, a Kubernetes service account, AWS IAM), and policies, HCL rules that say what paths that identity can read or write. The secrets themselves are organized behind secrets engines — a static key-value store for the simple case, but also database, PKI, and cloud engines that mint short-lived, automatically-expiring credentials on demand instead of handing out something permanent.

Install on Ubuntu/Debian (HashiCorp APT repo)

terminal
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install vault

Install on RHEL, CentOS Stream, Fedora, or Amazon Linux (HashiCorp YUM repo)

terminal
sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
sudo yum -y install vault

Alternative — run Vault in Docker

terminal
docker run --cap-add=IPC_LOCK -d --name vault -p 8200:8200 hashicorp/vault

Start a dev server

terminal
vault server -dev
!

Vault is licensed under the BUSL. For a fully open source, OSI-approved alternative with the same CLI, see the OpenBao guide.

Write and read a secret

terminal
export VAULT_ADDR='http://127.0.0.1:8200'
vault status
vault kv put secret/my-app password=s3cr3t
vault kv get secret/my-app

Beyond -dev: init and unseal

A dev server starts already unsealed and pre-authenticated, which is exactly what makes it unsuitable for anything real. A production Vault generates its master encryption key once, during vault operator init, and immediately splits it into key shares (5 by default, needing any 3 to reconstruct) using Shamir's Secret Sharing — no single operator ever holds the whole key. Every restart leaves Vault sealed until enough shares are supplied again.

terminal
vault operator init                # prints 5 unseal key shares + a root token, once — record them somewhere durable
vault operator unseal              # run 3 times total, once per distinct share
vault status                       # Sealed: false once the threshold is met
!

Vault cannot decrypt its data if you lose enough key shares to drop below the threshold — there's no backdoor. Store the shares separately from the server and from each other.

Scope access with a policy

app-readonly.hcl
path "secret/data/my-app" {
  capabilities = ["read"]
}
load it and issue a scoped token
vault policy write app-readonly app-readonly.hcl
vault token create -policy="app-readonly"

Documentation & Knowledge Base

Official DocumentationVault Documentation →Knowledge Base & CommunityHashiCorp Discuss — Vault →
Download HashiCorp Vault— all versions & official links→

Related Guides

OpenBaoInstall guide →SOPSInstall guide →External Secrets OperatorInstall guide →

Need HashiCorp Vault deployed and managed for you?

We're OpenStack Dev — we design, deploy, and operate production DevOps infrastructure.

Get in TouchAll Install Guides