Documentation

How to compare secrets between two HashiCorp Vault clusters

Compare KV v2 secrets between two HashiCorp Vault clusters, mounts or environments: the vault CLI approach and its limits, then Lockstep.

Syncing Vault KV secrets between environments safely

Sync Vault KV v2 secrets between environments without overwriting newer changes: check-and-set writes, no deletes, reviews and sync plans.

Detecting secret drift between Vault environments in CI

Detect drift between two HashiCorp Vault environments in CI with the lockstep CLI: diff-style exit codes, a read-only token and no values in logs.

Exporting, importing and migrating Vault secrets

Export a HashiCorp Vault KV v2 mount to an encrypted file, compare a Vault against it, and import it into another environment with rules that rename paths and rewrite values.

Building a comparison profile

Stop expected differences between HashiCorp Vault environments from drowning out real drift: build a Lockstep comparison profile by clicking Ignore, map paths, and reuse it in the UI and CI.

Logging in to Vault with JWT from CI

Log in to HashiCorp Vault from GitHub Actions or GitLab CI with the pipeline's OIDC identity token and Vault's JWT auth method, and run Lockstep comparisons and exports with no stored secrets.

Using the tool

How to use Lockstep: compare Vault KV v2 locations or an export, profiles, copying and overriding values, sync plans, value tools, certificate expiry, export and import.

Command line

The lockstep command line: compare two Vault KV v2 locations into a YAML report with Vault UI links and vault kv get commands, then apply it key by key.

Authentication

Signing in to Vault with Lockstep: token, userpass, LDAP, OIDC redirect, JWT and Kubernetes service account, with the Vault-side setup for each.

Configuration

Every LOCKSTEP_* environment variable: preset Vault connections, custom URLs, sessions, TLS, Kubernetes auth and shared comparison profiles.

Deploying on Kubernetes

Deploy Lockstep on Kubernetes with its Helm chart: a checklist, Ingress, OIDC callback, NetworkPolicy and Kubernetes service account auth.

Security model

Lockstep's security model: what it sees, stores, logs and writes, example read-only and copy Vault policies, and the signed, scanned supply chain.