HashiCorp Vault from zero to a working lab
An interactive, step-by-step guide to centralized secrets management, run for real on the vault-lab-01 VM from the Terraform guide. You drive Vault with the vault CLI from your control node, and every "Expected" block below was captured from that run. After Module 03 you work as a named user; the root token is revoked at the end of Module 09, once you have practised getting it back.
🔐
What you'll build
A Vault server that manages all lab secrets, issues short-lived SSH certificates, runs an internal PKI CA, and integrates with your existing Ansible and Terraform workflows.
👤
Who this is for
Sysadmins who have completed the TF and Ansible guides (or equivalent) and want to replace static secrets with dynamic, auditable secrets management. Written by a sysadmin learning this in a homelab; not a production reference.
☑️
How it works
Expand each step to read the explanation, then check it off. Progress is saved in your browser.
🗂️
Prerequisites
The three VMs from the Terraform guide with the Ansible baseline applied (vault-lab-01 becomes the Vault server), the
vault CLI on the control node, and your fork of iac-lab.
Note:
This guide uses Ubuntu. Commands are easily adapted for RHEL/Rocky.
Sync Progress
Copy this URL and open it in another browser to restore your progress.