Where does the Vault Agent store its cache?

Storing secrets in an encrypted file, even if encrypted by Vault Transit, would still involve writing them to disk, which the Vault Agent's in-memory cache design specifically avoids for security reasons.

The Vault Agent caches secrets *from* the Vault key/value store or other secret engines; it does not store its cache *within* the Vault key/value store itself.

Storing an unencrypted cache in a file would be a severe security vulnerability, directly exposing sensitive secrets on disk, which is contrary to Vault's security principles.

The Vault Agent's cache is intentionally designed to be stored only in volatile memory. This is a critical security measure to prevent sensitive secrets from being written to persistent storage (like disk) on the client machine, thereby reducing the risk of data compromise if the host is breached.