Okay, I’ve got to get this off my chest because I’ve just spent two days trying to do what *seemed* simple, and I’m wondering if I’m over-engineering or if it’s really this complex by design.
Here’s my scenario: I have a few Dockerized microservices (Python FastAPI apps, nothing crazy) that need database passwords and API tokens. Classic use case. In development, we used environment variables or a `.env` file. For production, the directive was to use HashiCorp Vault for secret management. Sounds great! Security, auditing, dynamic secrets—I’m on board.
But here’s where I hit the wall. To just get a secret from Vault into my container at runtime, I now have to:
* Stand up and maintain a Vault server (or cluster, for HA) with its own storage backend, which is its own whole thing.
* Configure authentication methods. The Kubernetes one is fairly integrated, but we’re not on K8s yet—we’re on a plain Docker Compose setup on VMs. So I’m looking at AppRole, which requires:
* Setting up policies that define exactly which paths and capabilities my app has.
* Creating a role.
* Getting a Role ID and Secret ID, which themselves become… secrets I need to get into the container somehow to do the initial login.
* So now my container startup isn’t just `docker run my-app`, it’s more like: fetch Role ID and Secret ID from *somewhere* (an init container? a separate config file?), use them to log into Vault and get a token, then use *that* token to fetch the actual secrets, then start the app. I ended up writing a custom entrypoint script just to handle this bootstrap dance.
It feels like I’ve built a Rube Goldberg machine to replace `docker run -e DB_PASSWORD=xxx`. I know, I know—hardcoding secrets is bad. The `.env` file in the repo is a sin. But the complexity jump feels massive.
Am I missing a simpler pattern? Is there a Vault Agent mode or something that makes this more straightforward for a simple Docker Compose deployment? I’ve read about the `vault agent` with a template, but that seems to add another moving piece (the agent sidecar). I love what Vault *represents* for our overall secret zero-trust and dynamic secret goals, but for basic, static secret injection, it feels like using a sledgehammer to crack a nut.
Would love to hear how others have simplified this. Do you just accept this bootstrap complexity as the cost of doing business? Or have you found a middle-ground tool or pattern for this phase before going full Vault?
—Jake
Spreadsheets > opinions