Why environment variables aren't a secrets manager.

Env vars leak into process listings and crash logs, with no rotation or audit trail. Vault authenticates a client, then hands out a scoped, short-lived token.

Authenticate → authorize → fetch

Authenticatevia K8s ServiceAccount, cloud IAM role

Vault verifies identityagainst the configured auth method

Short-lived token issuedscoped by policy

Secret returnedaccess logged

vault policy

# checkout-service can ONLY read its own secrets
path "secret/data/checkout/*" {
  capabilities = ["read"]
}

# auth via the pod's own K8s ServiceAccount —
# no static Vault credential baked in anywhere
vault auth enable kubernetes

Vault's Kubernetes auth method reuses the exact same least-privilege identity system as Module 3's RBAC — now also gating access to secrets.