Introduction

Note

These guides were reorganized in August 2026. The previous Solution Design Guide and Operating Guides (Adoption, Standardization, Scaling) have been replaced with three role-based guide types: Installation, Administration, and User. Read the HVD 2.0 release notes for full details on what changed and where to find the content you need.

Why use HashiCorp Validated Designs?

HashiCorp Validated Designs (HVD) provide practitioners with opinionated guidance for achieving production-grade deployments of HashiCorp products. These designs are purpose-built for delivering foundational use cases, with a baseline level of architectural and operational maturity. They draw on the field experiences of Solutions Engineers and Solutions Architects working with customers across a wide range of environments and organizational requirements.

Each guide provides access to an opinionated reference architecture, including key design decisions and the rationale behind them. Where applicable, guides identify modular design components that you can adjust to align with organizational or regulatory requirements without compromising the overall integrity of the implementation. For many deployments we include Terraform modules to automate large portions of infrastructure provisioning and software installation.

Audience

This User Guide is for application teams, service owners, and other Vault consumers who use Vault features after platform operators have deployed and configured the service. It focuses on consuming secrets, credentials, certificates, and cryptographic services through approved workflows.

For deployment and first-run configuration, use the Vault Installation Guide for virtual machines or the Vault Installation Guide for OpenShift. For operator setup and ongoing management of Vault features, use the Vault Administration Guide.

Note

Operator tasks such as authentication-method configuration, policy design, secrets-engine enablement, audit-log configuration, backup and restore, disaster recovery, and upgrades are covered in the Installation and Administration guides.

Use cases covered

This guide covers the Vault capabilities that consumers use once platform operators have configured the service:

Use case	Summary
Static secrets	Retrieve and consume approved static secrets from Vault.
Secrets Sync	Consume secrets through synchronized external destinations configured by operators.
Dynamic secrets	Use short-lived credentials issued by Vault for applications and services.
PKI certificates	Request and renew Vault-issued certificates, including Vault Agent workflows.
Key lifecycle management	Use key management and KMIP workflows after operators configure engines and roles.
Transit and Transform	Use Vault cryptographic and data-protection services for encryption, tokenization, and transformation workflows.
RHEL local account password rotation	Use Vault's OS secrets engine to govern rotation of long-lived RHEL local accounts, such as break-glass and legacy credentials.
Vault Agent templates	Render Vault secrets into application configuration files and runtime environments.
Kubernetes secrets consumption	Consume Vault secrets from Kubernetes workloads using approved integration patterns.
Performance replication	Consume Vault from deployments that use performance replication. This section needs further authoring.

Prerequisites

Before using this guide, confirm that your platform team has provided the Vault address, authentication method, namespace or mount path, and policy grants required for your workload.