The Key/Value Secrets Engine is an integral part of almost every Vault implementation. It forms the foundation for securely storing static secrets and is used far more frequently in practice than many dynamic engines.

Following the theoretical introduction in part 2a, this article turns to the practical work with the KV Engine. We demonstrate how to write, read, update and delete secrets, and provide a practical analysis of the differences between KV Version 1 and Version 2. The focus is on production-relevant commands, realistic pitfalls and concrete recommendations for day-to-day operations, which is why I present this knowledge as a mixture of tutorial and cheat sheet.

After having gained a solid overview of the entire ecosystem of secrets engines in the first part, we now delve into the daily life of every Vault cluster. The Key / Value (KV) Secrets Engine is the workhorse for all scenarios where secrets need to be securely stored, versioned, and later retrieved in a targeted way.

Secrets Engines are the core of Vault – they enable us to think of security not just as a matter of storage, but as a process. Whether it's a database password, SSH access, or JWT signature, everything can be managed dynamically, securely, and traceably – if the right engines are known and used correctly. The key lies less in diversity and more in understanding and design. Anyone who wants to use Vault productively cannot avoid a deep understanding of the Secrets Engines.

This article offers a well-founded overview of the function, use cases, and lifecycle of Secrets Engines – from generic engines like KV, Transit, or PKI to specialized modules for Cloud and database platforms.