We rolled out Vault 18 months ago to centralize secrets for our global cloud and on-prem infrastructure. Goal was to replace scattered credential stores. It's technically solid but operationally heavy.
The good:
* Secrets engine and dynamic credentials work as advertised. Huge win for database and cloud access.
* Auth methods (LDAP, OIDC) integrate well with our existing IAM.
* API is consistent, which helps automation.
The bad:
* Operational overhead is significant. Upgrades, seal/unseal, and storage backend management are not trivial.
* Learning curve for operators is steep. "Day 2" costs were underestimated.
* Secret sprawl happened anyway. Teams use it as a key-value store for things that aren't strictly secrets, creating a new management problem.
Key question for teams considering it: Do you have the dedicated platform team to run it? If not, look at managed alternatives. The tech is powerful, but it's not a fire-and-forget tool.
null