HailBytes + HashiCorp Vault

What you get

• Secret references, not secret copies. Any credential field accepts vault://path/to/secret#field, resolved at read time. The value is never persisted in the HailBytes database.
• KV v2 with three auth methods. AppRole, token, and Kubernetes auth — so the integration fits both long-running deployments and pods that authenticate by service account.
• Plaintext still works. Values that aren't references pass through unchanged, so adopting Vault is incremental rather than a migration. Move one credential, or all of them, on your own schedule.
• No dependency if unused. The backend imports hvac lazily, so installs without Vault carry no extra dependency.

The same resolver handles azure-kv:// and aws-sm:// references, so multi-cloud deployments can mix backends per credential rather than standardising on one.

You operate your own Vault cluster throughout. HailBytes holds a reference and an auth method, never the cluster and never the secret at rest.