Vault — Overview#

Identity#

  • Module path: github.com/hashicorp/vault
  • Go version: go 1.26.1
  • License: Business Source License 1.1 (BUSL-1.1) — licensor IBM Corp (after HashiCorp acquisition); production use permitted, but offering the work to third parties on a hosted/embedded basis to compete with IBM’s paid version is restricted
  • Repository: https://github.com/hashicorp/vault

Purpose#

Vault is a secrets management platform that provides a unified interface for securely storing, accessing, and generating secrets (API keys, passwords, certificates, database credentials, etc.). It solves the challenge of controlling and auditing secret access across modern distributed systems — including dynamic secret generation, automatic revocation via leases, and encryption-as-a-service. It targets platform engineers, security teams, and application developers who need centralized credential management without building custom solutions.

Significance#

Vault is the de facto standard for secrets management in the cloud-native ecosystem, with massive adoption across enterprises running Kubernetes, cloud infrastructure, and microservices. Its SDK (github.com/hashicorp/vault/sdk) and API client (github.com/hashicorp/vault/api) are widely imported by other HashiCorp tools and third-party integrations. The HashiCorp Vault Associate certification reflects its status as an industry-recognized tool. Its 2023 license change from MPL-2.0 to BUSL-1.1 became a landmark event in the open-source community, prompting the OpenBao fork and broader discussion about sustainable open-source business models.

Key metrics#

  • Go files: 2,212 (excluding vendor)
  • Top-level directories: api, audit, builtin, command, helper, http, internal, internalshared, limits, physical, plugins, sdk, serviceregistration, shamir, tools, ui, vault, version, website
  • Direct dependencies: ~210 (336 indirect) in go.mod
  • First commit / age: Repository history is shallow in this clone; Vault’s public history dates to 2015

Notable characteristics#

  • Plugin architecture at scale: The builtin/ directory hosts dozens of auth methods (AWS, GCP, Kubernetes, LDAP, JWT, etc.) and secret engines (databases, AWS, PKI, SSH, etc.), all implemented as pluggable backends conforming to the sdk/logical.Backend interface — one of the most extensive plugin systems in the Go ecosystem.
  • Separate SDK and API submodules: The repo uses Go workspace-style replace directives so that vault/sdk and vault/api are developed in-tree but published as independent importable modules; this dual-library design is a significant architectural choice enabling third-party plugin development without importing the full Vault server.
  • Shamir secret sharing built-in: The shamir/ package implements Shamir’s Secret Sharing for the “unseal” operation — a security-critical cryptographic primitive embedded directly in the core product rather than delegated to a library.
  • License controversy as architectural signal: The shift to BUSL-1.1 (and IBM’s acquisition of HashiCorp) resulted in the OpenBao community fork; the codebase retains clear seams (the sdk abstraction boundary) that made forking tractable, demonstrating how good interface design has practical business consequences.
  • Enterprise / CE split: The codebase has a community edition (CE) main branch with enterprise features developed behind a separate branch/module; the META.d/ directory and build system accommodate this dual-edition release model.
Backward Consul — Testing Vault — Structure Forward