I'm very excited by the offerings of Hashicorp Vault but I'm having trouble wrapping my head around how it fits into our present architecture. The need to manually unseal the vault with every deployment is a great benefit to security, no doubt, but how are applications meant to react when the Vault is initially sealed?
For instance, if application A depends on a database credential generated by Vault in order to initialize, how is this application meant to react when it is deployed while Vault is sealed? Spin-wait while checking for the sealed status?
Additionally, how are other people pre-populating Vault with certain secrets in production? For instance, we have an authentication server that depends on a single consistent system secret that it must fetch from Vault at startup. How can I securely ensure that this secret is available after deploying Vault?
For the record, we are deploying Vault with some other services using docker-compose and ecs compose for deployment.