HOWTO: Bootstrap Vault and Seed Platform Secrets¶
The shipped on-prem secrets reference path uses HashiCorp Vault for runtime credential delivery to modules and automation jobs. This HOWTO covers initialisation and unseal, KV secret-engine setup, AppRole authentication for the HyOps CLI and Jenkins, initial credential seeding, and the transition into lifecycle-managed operation.
What this covers:
- Vault initialisation, unseal key distribution, and root token revocation after bootstrap
- KV v2 secrets engine layout aligned with HybridOps module and platform naming conventions
- AppRole auth configuration for HyOps CLI and Jenkins with least-privilege policy binding