5 best practices to get to production readiness with Hashicorp Vault in Kubernetes

**Executive summary:** This post describes Expel's approach and recommendations for securely deploying and operating HashiCorp Vault on Kubernetes (GKE), including automated initialization and bootstrapping via a sidecar that stores unseal keys and root tokens in Google Secret Manager, running Vault in an isolated nodepool with pod anti-affinity, enforcing end-to-end TLS (TLS passthrough), ensuring traffic reaches the active Vault server using service_registration, and managing tenant configuration via the Terraform Vault provider rather than an operator.