Vault Associate · Domain 9 of 9

Vault Associate Domain 9: Access management architecture

Client-side tools that bring secrets to applications without changing their code: Vault Agent with auto-auth and templating, and the Vault Secrets Operator that syncs Vault secrets into Kubernetes Secrets.

Exam weight estimate
Not published
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–4 hrs

About 9 min read Reviewed October 2026

Overview

Access management architecture covers the components that sit between Vault and applications so that apps can consume secrets without implementing Vault's API. HashiCorp lists two objectives: describe the Vault Agent and describe the Vault Secrets Operator. Vault Agent is a client daemon that authenticates automatically with auto-auth, keeps its token renewed, writes it to sinks, and renders secrets into files or environment variables using templates.

The Vault Secrets Operator, often called VSO, is a Kubernetes operator. It watches custom resources such as VaultConnection, VaultAuth, VaultStaticSecret, VaultDynamicSecret and VaultPKISecret, reads the referenced secrets from Vault, and writes them into native Kubernetes Secrets. It refreshes them as they change or approach expiry and can trigger rollout restarts of deployments that use them.

How it's tested

Questions in this group are short and descriptive. Expect a deployment scenario, such as a legacy app reading a config file or a Kubernetes team using native Secrets, and a choice between Vault Agent features and the Vault Secrets Operator. Some items ask what a specific Agent block does.

  • Choose the integration

    An application and platform are described, and you choose Vault Agent, the Agent injector or the Vault Secrets Operator.

  • Name the Agent feature

    A need such as automatic login, token storage or rendering a config file is given, and you name auto-auth, sinks or templates.

  • VSO resources

    A Kubernetes requirement is described, and you identify the custom resource or behavior that VSO uses to meet it.

Reasoning it through

A legacy application reads database credentials from a properties file and cannot be modified. Teaching it to call the Vault API would require code changes. Vault Agent can authenticate with auto-auth, fetch dynamic credentials, render them into the properties file with a template and re-render when the lease renews or new credentials are issued, so the application keeps reading a file as before.

Objectives 2

Official objectives from the HashiCorp outline, in outline order.

9a Describe the Vault AgentA client daemon for auto-auth, token management and templating.
What it means
Vault Agent is a mode of the Vault binary, started with vault agent -config, that runs beside an application to authenticate to Vault, manage the resulting token and deliver secrets in a form the application already understands.
What to understand
Auto-auth logs in with a configured method such as Kubernetes, AWS or AppRole and re-authenticates when needed. Sinks write the token to a file, optionally response-wrapped or encrypted. Templates use Consul Template syntax to render secrets into files and re-render when they change. Process supervisor mode injects secrets as environment variables into a child process and restarts it on change. In Kubernetes, the Agent injector adds Agent as an init or sidecar container through pod annotations. Vault Proxy now handles API proxying and caching.
How it shows up
Expect to name the Agent feature behind a requirement, such as auto-auth, sinks or templates.
Common confusion
Thinking Vault Agent is a separate server that stores secrets; it is a client that fetches them.
9b Describe the Vault Secrets OperatorA Kubernetes operator that syncs Vault secrets into Kubernetes Secrets.
What it means
The Vault Secrets Operator runs in a Kubernetes cluster and keeps native Kubernetes Secrets synchronised with secrets in Vault, so pods consume them through standard environment variables or volume mounts.
What to understand
VSO is installed with Helm and configured through custom resources. VaultConnection defines the Vault address, VaultAuth defines how the operator authenticates, typically with the Kubernetes auth method, and VaultStaticSecret, VaultDynamicSecret and VaultPKISecret define what to sync and into which Kubernetes Secret. The operator renews or refreshes leases, updates the Secret when Vault data changes, and can restart referenced Deployments, StatefulSets or DaemonSets so pods pick up new values.
How it shows up
A Kubernetes team wants native Secrets without sidecars, and you identify VSO and its resources.
Common confusion
Assuming VSO injects a sidecar into every pod like the Agent injector.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Vault Agent

    Client daemon run with vault agent.

    Remember
    Authenticates and delivers secrets for apps.
    Tested as
    Tool choice questions.
    Trap
    Treating it as a Vault server.

  • Auto-auth

    Automatic login with a configured method.

    Remember
    Re-authenticates and renews tokens.
    Tested as
    Feature questions.
    Trap
    Expecting manual login.

  • Sink

    Destination where Agent writes its token.

    Remember
    Usually a file; can be wrapped.
    Tested as
    Feature questions.
    Trap
    Confusing it with templates.

  • Agent templates

    Render secrets into files with Consul Template syntax.

    Remember
    Re-render when secrets change.
    Tested as
    Legacy app scenarios.
    Trap
    Thinking apps must call the API.

  • Process supervisor mode

    Runs a child process with secrets as env vars.

    Remember
    Restarts the process when secrets change.
    Tested as
    Feature questions.
    Trap
    Assuming files are always required.

  • Agent injector

    Kubernetes webhook adding Agent containers.

    Remember
    Driven by pod annotations.
    Tested as
    Kubernetes questions.
    Trap
    Confusing it with VSO.

  • Vault Secrets Operator

    Operator syncing Vault data to Kubernetes Secrets.

    Remember
    No sidecar per pod.
    Tested as
    Kubernetes questions.
    Trap
    Assuming it injects sidecars.

  • VaultAuth and VaultConnection

    VSO resources for login and server address.

    Remember
    Usually use the Kubernetes auth method.
    Tested as
    VSO configuration questions.
    Trap
    Forgetting authentication setup.

  • VaultStaticSecret / VaultDynamicSecret

    VSO resources describing what to sync.

    Remember
    Write into a named Kubernetes Secret.
    Tested as
    VSO usage questions.
    Trap
    Mixing static and dynamic types.

  • Rollout restart targets

    VSO restarts workloads on change.

    Remember
    Pods pick up new secret values.
    Tested as
    Rotation questions.
    Trap
    Expecting pods to reload automatically.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Vault Agent vs. Vault Secrets Operator

ConceptMeaningKey differenceCommon trap
Vault Agent Client daemon beside an app Files, env vars, any platform Thinking it is Kubernetes-only
Agent injector Agent added to pods via annotations Sidecar or init container per pod Confusing it with VSO
Vault Secrets Operator Cluster operator for Kubernetes Syncs into native Kubernetes Secrets Expecting a sidecar per pod

Vault Agent features

ConceptMeaningKey differenceCommon trap
Auto-auth Log in automatically Produces and renews the token Confusing with sinks
Sink Store the token Writes token to a file Expecting secrets there
Template Render secrets into files Updates on change Assuming code changes are needed

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Rewrite the app

    What candidates pick
    Modify a legacy app to call Vault directly.
    Why it looks right
    The API is the official interface.
    Why it's wrong
    Vault Agent templates can render secrets into the file the app already reads, with no code changes.

    Clue to watch for The app cannot be modified.

  2. VSO uses sidecars

    What candidates pick
    Expect VSO to add a container to every pod.
    Why it looks right
    The Agent injector works that way.
    Why it's wrong
    VSO runs as a cluster operator and writes native Kubernetes Secrets that pods mount normally.

    Clue to watch for Requirement says no sidecars.

  3. Agent stores secrets

    What candidates pick
    Treat Vault Agent as a local secret store replacing Vault.
    Why it looks right
    It runs close to the app.
    Why it's wrong
    Agent is a client that authenticates to Vault and fetches secrets; Vault remains the source.

    Clue to watch for Question asks where secrets live.

  4. Sink holds secrets

    What candidates pick
    Read database credentials from the auto-auth sink file.
    Why it looks right
    Sinks write files.
    Why it's wrong
    The sink holds the Vault token; secrets are delivered through templates or process supervisor mode.

    Clue to watch for Need is a rendered credentials file.

  5. Pods auto-reload

    What candidates pick
    Assume running pods see updated Kubernetes Secrets in environment variables.
    Why it looks right
    Secrets update in the cluster.
    Why it's wrong
    Environment variables are set at start, so VSO can trigger rollout restarts for new values.

    Clue to watch for Secret rotation in Kubernetes.

Answer framework

Use these steps to choose the right access tool in Domain 9 questions.

  1. Identify where the application runs and whether its code can change to call the Vault API.
  2. If it runs on a VM or cannot change, choose Vault Agent with auto-auth plus templates or process supervisor mode.
  3. If it runs in Kubernetes and should consume native Kubernetes Secrets without sidecars, choose the Vault Secrets Operator.
  4. If per-pod rendered files through annotations are preferred in Kubernetes, consider the Vault Agent injector instead of VSO, accepting an extra container in each pod.
  5. Check the auth method behind the tool, usually Kubernetes or a cloud method, and confirm how rotated secrets reach the running application.

Practice question

A platform team runs dozens of Kubernetes deployments whose manifests already reference standard Kubernetes Secrets. They want those Secrets populated from Vault and refreshed when values change, without adding containers to every pod. Which approach fits best?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with Vault Agent on your laptop. Write a minimal agent configuration with an AppRole auto-auth block, a file sink and one template that renders a KV secret into a file. Start it, change the secret in Vault and watch the file update. Then try process supervisor mode with a small script that prints an environment variable, so you see how Agent restarts the child process.

Next, use a local Kubernetes cluster such as kind or minikube. Install Vault in dev mode with Helm, enable the Kubernetes auth method, and install the Vault Secrets Operator. Create VaultConnection, VaultAuth and VaultStaticSecret resources, confirm a Kubernetes Secret appears, and update the Vault value to watch the sync. If time allows, compare it with the Agent injector by annotating a pod.

Keep a short comparison table of Agent, the injector and VSO, then check yourself with practice questions on this group and revisit the documentation for any tool you confused.

FAQ

How many questions come from Access management architecture?

HashiCorp does not weight Access management architecture. It has two objectives, Vault Agent and the Vault Secrets Operator, so we plan for about three questions.

What does Vault Agent auto-auth do?

It logs in to Vault automatically with a configured auth method, keeps the token renewed, re-authenticates when needed and writes the token to any configured sinks.

How does Vault Agent help applications that cannot call Vault?

Its templates render secrets into files the app already reads, and process supervisor mode passes secrets as environment variables to a child process.

What is the Vault Secrets Operator?

A Kubernetes operator that reads secrets from Vault and writes them into native Kubernetes Secrets, keeping them updated as values change or leases renew.

How is VSO different from the Vault Agent injector?

The injector adds Agent containers to each annotated pod. VSO runs once in the cluster and syncs data into Kubernetes Secrets, so pods need no extra containers.

Which auth method does VSO usually use?

The Kubernetes auth method, configured through a VaultAuth resource that references a service account and a Vault role.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 9 knowledge

You have covered Vault Agent features and the Vault Secrets Operator. Test whether you can choose the right access tool for a given platform.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going