Architecting Zero Trust Microservices with HashiCorp Vault

Act as a Lead Security Architect. Design an impenetrable, comprehensive Zero Trust Network Architecture (ZTNA) specifically engineered for a massive microservices ecosystem operating on a [CONTAINER_ORCHESTRATOR] (e.g., EKS or AKS) within [CLOUD_PROVIDER]. Position HashiCorp Vault as the absolute, centralized identity and cryptographic secrets engine. You must technically detail the flawless, programmatic authentication flow bridging the corporate [IDENTITY_PROVIDER] (e.g., Okta via OIDC) to Vault. Explain the mathematical implementation of strictly short-lived, ephemeral credentials (TTL < 15 mins) for every service. Architect a bulletproof solution to completely eradicate the 'secret zero' paradox (the credentials needed to get the credentials) during the automated CI/CD bootstrap process, leveraging platform-native identities (like AWS IAM or GCP Service Accounts). Provide a high-level, production-ready HCL configuration defining the necessary auth methods and restrictive policies.