Detect when a secret changes in Hashicorp Vault

Question

I'm totally new to Vault and what I want is to detect when a secret changes and execute some code in response. I've been googling for resources about how to do that but haven't found anything useful. From what I've read and learnt, I think the only way of achieving what I want is by implementing a custom secrets engine. Am I right? Do you know a better way of achieving what I want?

Answer 1

There is no event option in the vault as of now, so on changes, we get notified it's natively changing the Key/value pairs.

i would recommend using the polling method if you have any such scenario with the vault.

Here is one nice CRD which also does the polling option and syncs the vault secret to Kubernetes secret.

This might useful for reference : https://github.com/DaspawnW/vault-crd