Common Problems Running HashiCorp Vault on Kubernetes (and How to Actually Fix Them)

Vault and Kubernetes are both excellent at hiding the actual cause of a failure behind a generic-looking error. Put them together — Vault injecting secrets into pods via a sidecar, authenticating pods via Kubernetes service account tokens — and you get failure modes that look identical from the outside ("pod stuck in Init," "502 from the app,"...