HashiCorp - Vault Associate Study Guide

9: Access management architecture

This chapter defines the two client-side access management components that let workloads consume Vault secrets without embedding a Vault token in application code. It walks through the Vault Agent as a host-side sidecar or daemon that authenticates on behalf of an application, caches responses, and renders secrets into files, then covers the Vault Secrets Operator as the Kubernetes-native controller that reflects Vault secrets into cluster-local Secret objects, with attention to the encrypted client cache, instant updates over Vault Events, and the secret transformation pipeline.