Set Up Vault Proxy to Integrate with HashiCorp Vault

Contributed by: Prachi Jain

Difficulty level: Advanced

Vault Proxy simplifies integrating your applications with HashiCorp Vault by acting as an API proxy that manages authentication, token renewal, and caching. It automatically authenticates to Vault, renews tokens, and optionally enforces the use of its authenticated token for clients. Additionally, it provides client-side caching for tokens and secrets, reducing the load on Vault and enhancing scalability. This Shortcut explains how to set up Vault Proxy and fetch secrets through it.

Prerequisites

You need a running Vault cluster. Refer to the Shortcut “Run HashiCorp Vault with Helm” for a refresher on running Vault.

Configure Vault Proxy

Take the following steps to get Vault Proxy running on your local system:

1. Get Vault binary:

   1. Download the binary:

      curl -o vault.zip https://releases.hashicorp.com/vault/1.17.5/vault_1.17.5_darwin_amd64.zip

   2. Unzip and move:

      unzip vault.zip
      mv vault /usr/local/bin/

2. Write a configuration file proxy-config.hcl with api_proxy enabled:

   # The address of the Vault server you're connecting to vault { address = "http://127.0.0.1:8200" } auto_auth { method { type = "approle" config = { role_id_file_path = "role-id" secret_id_file_path = "secret-id" remove_secret_id_file_after_reading = false } } sink "file" { config = { path = "/tmp/file" } } } # Enable Vault proxy mode api_proxy { # Enable the auto-auth method if you are using authentication ...