# zholarys/vault-secrets-demo architecture

> Architecture diagram of the GitHub repository zholarys/vault-secrets-demo, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zholarys/vault-secrets-demo
- Repository: https://github.com/zholarys/vault-secrets-demo

## Overview

This is a local Vault KV v2 learning demo. The operator provisions a dummy secret and read-only policy, creates a short-lived scoped token, then runs a Python client that retrieves the permitted secret without logging its value. The README also documents checking that an unrelated path is denied. The client source was not included in the sampled excerpts, so its internal implementation is not expanded.

Main entry points: [`docker-compose.yml`](https://github.com/zholarys/vault-secrets-demo/blob/main/docker-compose.yml) (Vault server), [`app/read_secret.py`](https://github.com/zholarys/vault-secrets-demo/blob/main/app/read_secret.py) (Secret reader), [`read-only-policy.hcl`](https://github.com/zholarys/vault-secrets-demo/blob/main/read-only-policy.hcl) (Read-only policy)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_setup["Secret setup"]
  node_policy["Read-only policy"]
end

subgraph group_vault["Vault service"]
  node_vault_server[("Vault server<br/>[docker-compose.yml]")]
  node_secret[("KV v2 secret<br/>[docker-compose.yml]")]
  node_token["Scoped token"]
end

subgraph group_client["Python client"]
  node_python_client["Secret reader<br/>[read_secret.py]"]
  node_access_check["Access check"]
end

node_operator(("Operator"))

node_operator -->|"writes secret"| node_vault_server
node_vault_server -->|"stores secret"| node_secret
node_operator -->|"supplies policy"| node_policy
node_policy -->|"installs policy"| node_vault_server
node_operator -->|"creates token"| node_vault_server
node_vault_server -->|"issues token"| node_token
node_operator -->|"runs client"| node_python_client
node_token -->|"authenticates"| node_python_client
node_python_client -->|"requests secret"| node_vault_server
node_vault_server -->|"returns response"| node_python_client
node_python_client -->|"reports success"| node_operator
node_operator -->|"runs checks"| node_access_check
node_access_check -->|"checks paths"| node_vault_server

click node_vault_server "https://github.com/zholarys/vault-secrets-demo/blob/main/docker-compose.yml"
click node_secret "https://github.com/zholarys/vault-secrets-demo/blob/main/docker-compose.yml"
click node_policy "https://github.com/zholarys/vault-secrets-demo/blob/main/read-only-policy.hcl"
click node_python_client "https://github.com/zholarys/vault-secrets-demo/blob/main/app/read_secret.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_policy toneBlue
class node_vault_server,node_secret,node_token toneAmber
class node_python_client,node_access_check toneMint
class node_operator toneIndigo
```

## Components

### Secret setup

- [Read-only policy](https://github.com/zholarys/vault-secrets-demo/blob/main/read-only-policy.hcl): `read-only-policy.hcl`

### Vault service

- [Vault server](https://github.com/zholarys/vault-secrets-demo/blob/main/docker-compose.yml): `docker-compose.yml`
- [KV v2 secret](https://github.com/zholarys/vault-secrets-demo/blob/main/docker-compose.yml): `docker-compose.yml`
- **Scoped token**

### Python client

- [Secret reader](https://github.com/zholarys/vault-secrets-demo/blob/main/app/read_secret.py): `app/read_secret.py`
- **Access check**

### Other components

- **Operator**

## Connections

- Operator → Vault server: writes secret
- Vault server → KV v2 secret: stores secret
- Operator → Read-only policy: supplies policy
- Read-only policy → Vault server: installs policy
- Operator → Vault server: creates token
- Vault server → Scoped token: issues token
- Operator → Secret reader: runs client
- Scoped token → Secret reader: authenticates
- Secret reader → Vault server: requests secret
- Vault server → Secret reader: returns response
- Secret reader → Operator: reports success
- Operator → Access check: runs checks
- Access check → Vault server: checks paths