How zholarys/vault-secrets-demo works
This is a local Vault KV v2 learning demo. The operator provisions a dummy secret and read-only policy, creates a short-lived scoped token, then runs a Python client that retrieves the permitted secret without logging its value. The README also documents checking that an unrelated path is denied. The client source was not included in the sampled excerpts, so its internal implementation is not expanded.
Main entry points: docker-compose.yml Vault server · read_secret.py Secret reader · read-only-policy.hcl Read-only policy
Components 7
Secret setup
- Read-only policy
read-only-policy.hcl
Vault service
- Vault server
docker-compose.yml - KV v2 secret
docker-compose.yml - Scoped token
Python client
- Secret reader
app/read_secret.py - Access check
Other components
- Operator
Connections 13
- Operator → Vault server: writes secret
- Vault server → KV v2 secret: stores secret
- Operator → Read-only policy: supplies policy
- Read-only policy → Vault server: installs policy
- Operator → Vault server: creates token
- Vault server → Scoped token: issues token
- Operator → Secret reader: runs client
- Scoped token → Secret reader: authenticates
- Secret reader → Vault server: requests secret
- Vault server → Secret reader: returns response
- Secret reader → Operator: reports success
- Operator → Access check: runs checks
- Access check → Vault server: checks paths