What is Vault?

https://developer.hashicorp.com/vault/docs/about-vault/what-is-vault

Vault provides centralized, well-audited privileged access and secret management for mission-critical data whether you deploy systems on-premises, in the cloud, or in a hybrid environment.

With a modular design based around a growing plugin ecosystem, Vault lets you integrate with your existing systems and customize your application workflow.

Modern software works because of secrets. Secrets are sensitive, discrete pieces of information like credentials, encryption keys, authentication certificates, and other critical pieces of information your applications need to run consistently and securely.

Vault helps harden applications by centralizing secret management. With Vault you can:

• Manage static secrets
• Manage certificates
• Manage identities and authentication
• Manage 3rd-party secrets
• Manage sensitive data
• Support regulatory compliance

https://developer.hashicorp.com/vault/docs/auth

Vault with Keycloak as workload IAM

https://github.com/fanqingsong/vault_on_keycloak_as_iam

Demonstrates how applications use Keycloak-issued JWTs to authenticate with HashiCorp Vault and securely access secrets using short-lived, least-privilege tokens.

This repository contains a runnable example in which an application:

1. authenticates to Keycloak with the OAuth 2.0 client credentials grant;
2. receives a signed access token representing its workload identity;
3. exchanges that JWT for a short-lived Vault token; and
4. reads only the KV secret allowed by its Vault policy.

This is a local development example. Its fixed passwords, HTTP endpoints, Vault dev mode, and embedded Keycloak client secret are intentionally unsuitable for production.

The Keycloak client secret is the bootstrap credential in this example. Keycloak's signature proves to Vault that the JWT was issued for that client. The Vault JWT role then maps that identity to the minimal demo-app policy.