Step 1: Download Vault

Before we begin, you’ll need to obtain the Vault binary. You can download it directly from the official HashiCorp website or leverage a package manager like Homebrew for macOS or Chocolatey for Windows. Let’s fetch the Vault binary via the command line:

curl -O https://releases.hashicorp.com/vault/1.7.3/vault_1.7.3_linux_amd64.zip

Make sure to replace the version number in the URL above with the latest version available.

Step 2: Install Vault

Once the binary is downloaded, unzip the package and move the Vault binary to a directory included in your system’s PATH. This ensures that Vault can be executed from any location in your terminal. Execute the following commands:

unzip vault_1.7.3_linux_amd64.zip
sudo mv vault /usr/local/bin/

Ensure that you have appropriate permissions to perform these actions.

Step 3: Start Vault Server

Now that Vault is installed, let’s initiate the Vault server. For the sake of simplicity, we’ll start Vault in development mode. This mode is ideal for testing and learning purposes but should not be used in production environments. Execute the following command:

vault server -dev

After executing the command, you’ll see output indicating that the Vault server is running in development mode.

Step 4: Initialize and Unseal Vault

Before Vault can be utilized, it needs to be initialized and unsealed. Initialization generates the initial encryption key and unseal keys. Execute the following command to initialize Vault:

vault operator init

Upon initialization, Vault provides you with an initial root token and a set of unseal keys. Safeguard these credentials as they grant access to the Vault instance.

After initialization, you must unseal Vault using the provided unseal keys:

vault operator unseal

Repeat this process until the required number of unseal keys have been provided.

Step 5: Enable Secrets Engine

With Vault initialized and unsealed, it’s time to enable a secrets engine. Secrets engines are components responsible for managing and generating secrets. For example, to enable the Key/Value secrets engine, execute the following command:

vault secrets enable kv

This command enables the Key/Value secrets engine at the default path, allowing you to store arbitrary secrets securely.

Step 6: Access Vault

Now that Vault is operational, you can access it using either the Vault CLI or HTTP API. To authenticate via the CLI, execute the following command:

vault login

Enter the root token provided during initialization to authenticate successfully.

With authentication complete, you can now leverage Vault to manage secrets, encryption keys, and other sensitive data.