HashiCorp Vault CLI

Use the vault CLI for Vault work. Prefer read-only inspection first, then confirm before writing secrets, changing auth methods, enabling engines, or editing policies.

Quick checks

CODEBLOCK0

If VAULT_ADDR is missing, set it first:

CODEBLOCK1

For a local lab Vault, an example endpoint is:

CODEBLOCK2

Notes:

• - Replace the example address with your actual Vault endpoint.
• Some local test deployments use plain HTTP instead of HTTPS.
• Prefer reading tokens from a local file or environment variable instead of echoing them in chat.

Verify auth before assuming a path is missing:

CODEBLOCK3

Read secrets

For KV v2 paths, use vault kv commands instead of raw API-style paths.

CODEBLOCK4

If output is unclear, use JSON:

CODEBLOCK5

Helper scripts

This skill includes simple wrappers that auto-load local settings:

CODEBLOCK6

Behavior:

• - Defaults VAULT_ADDR to INLINECODE4
• Loads VAULT_TOKEN from ~/.vault-token if not already exported
• Uses vault kv commands for the common KV v2 workflow

Write secrets

Confirm before overwriting or deleting anything.

CODEBLOCK7

Prefer patch when updating a subset of keys on KV v2.

Policies and mounts

Inspect first:

CODEBLOCK8

Change only with explicit user intent:

CODEBLOCK9

Authentication helpers

Common login flows:

CODEBLOCK10

When troubleshooting auth, inspect enabled auth backends and token details first:

CODEBLOCK11

Troubleshooting workflow

1. 1. Check vault status and VAULT_ADDR.
2. Check auth with vault token lookup or the intended login flow.
3. Confirm mount names with vault secrets list.
4. For KV access, verify whether the engine is KV v1 or KV v2 before choosing commands.
5. Prefer -format=json when output will be parsed or compared.
6. Read references/kv-and-troubleshooting.md for command patterns and common errors when the task is non-trivial.