# Store Key Value consul or Vault? **URL:** \ **Category:** Vault\ **Tags:** envconsul, vault, consul-vault\ **Created:** [August 29, 2020, 8:35pm UTC](https://discuss.hashicorp.com/t/store-key-value-consul-or-vault/13526 "2020-08-29T20:35:51Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![afonsoaugusto](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/afonsoaugusto/32/10545_2.png) [@afonsoaugusto](https://discuss.hashicorp.com/u/afonsoaugusto)\ **Post date:** [August 29, 2020, 8:35pm UTC](https://discuss.hashicorp.com/t/store-key-value-consul-or-vault/13526/1 "2020-08-29T20:35:51Z")
For both products has the feature KV. For purpose storage variables, whats the indicate? consul or vault? I need load the values in my application, I will use consul-template for load variables in my environment with vault? Thankโ€™s ---
**Author:** ![shantanugadgil](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shantanugadgil/32/923_2.png) [@shantanugadgil](https://discuss.hashicorp.com/u/shantanugadgil)\ **Post date:** [August 31, 2020, 4:57pm UTC](https://discuss.hashicorp.com/t/store-key-value-consul-or-vault/13526/2 "2020-08-31T16:57:16Z")
as far as I understand: Firstly: Vault for secrets. Consul for configuration values. Secondly: Vault with Consul backend means something like Nomad can fetch config and/or secrets from the Consul kv store. Vault with Raft backend would mean something like Nomad will have to talk directly to the Vault servers to fetch the secrets and talk to Consul for config KV. (how the config params get into Consul in the first place, is orthogonal to this discussion, I think) \*\*\* I will love to see someone from HashiCorp weigh in on this, as I too am curious about the optimum configuration, in case someone is using HashiStack (Vault + Consul + Nomad) ---
**Author:** ![DevOpsRob](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/devopsrob/32/1607_2.png) [@DevOpsRob](https://discuss.hashicorp.com/u/DevOpsRob)\ **Post date:** [September 10, 2020, 7:31am UTC](https://discuss.hashicorp.com/t/store-key-value-consul-or-vault/13526/3 "2020-09-10T07:31:14Z")
Any vault secrets stores in a consul backend will be encrypted so Nomad will need to talk to vault to obtain the secret values. In terms of general configuration values, yes nomad could talk directly to consul. I would strongly advise that a consul KV store be deployed separately to the vault backend as a different unrelated cluster to shorten the attack surface. ---
**Author:** ![DevOpsRob](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/devopsrob/32/1607_2.png) [@DevOpsRob](https://discuss.hashicorp.com/u/DevOpsRob)\ **Post date:** [September 10, 2020, 8:16am UTC](https://discuss.hashicorp.com/t/store-key-value-consul-or-vault/13526/4 "2020-09-10T08:16:13Z")
> [@shantanugadgil](#): > > \*\*\* I will love to see someone from HashiCorp weigh in on this, as I too am curious about the optimum configuration, in case someone is using HashiStack (Vault + Consul + Nomad) So in terms of using the HashiStack, Nomad has native integration with Consul connect. One just needs to add to the nomad configuration and it will work. In terms of Vault, again, it has native integration, one just needs to add the vault stanza to the nomad config. This will allow the passing of secrets to workloads. We have some documentation for this. Vault integration: [Vault Integration | Nomad | HashiCorp Developer](https://www.nomadproject.io/docs/integrations/vault-integration) Using Vault for jobs: [vault Block - Job Specification | Nomad | HashiCorp Developer](https://www.nomadproject.io/docs/job-specification/vault) Consul connect: [Consul Service Mesh | Nomad | HashiCorp Developer](https://www.nomadproject.io/docs/integrations/consul-connect) Hope this helps ๐Ÿ™‚ ---
**Author:** ![shantanugadgil](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shantanugadgil/32/923_2.png) [@shantanugadgil](https://discuss.hashicorp.com/u/shantanugadgil)\ **Post date:** [September 10, 2020, 9:38am UTC](https://discuss.hashicorp.com/t/store-key-value-consul-or-vault/13526/5 "2020-09-10T09:38:51Z")
> [@DevOpsRob](#): > > In terms of general configuration values, yes nomad could talk directly to consul. I would strongly advise that a consul KV store be deployed separately to the vault backend as a different unrelated cluster to shorten the attack surface. I wish there was a 10,000 foot view of Vault+Consul+Nomad, where it could be clear that the Consul backend for the Vault servers is (OR is not) to be mixed with the Consul cluster which Nomad is hooked into. something like the following, but with Vault thrown into the mix! ๐Ÿ˜€ > **[Consul Architecture | Consul | HashiCorp Developer](https://developer.hashicorp.com/consul/docs/architecture)** > > Consul datacenters consist of clusters of server agents (control plane) and client agents deployed alongside service instances (data plane). Learn how these components and their different communication methods make Consul possible. OR > **[Nomad Reference Architecture | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/tutorials/enterprise/production-reference-architecture-vm-with-consul)** > > This reference architecture describes the recommended compute and networking > resources you should provision when using Nomad Enterprise in a production > environment.