HashiCorp Vault

v1.0.5

Resolve secrets from Vault KV v2.

What it is Resolves a config secret reference from a HashiCorp Vault KV v2 mount.

When to use it Your provider API keys and DB passwords already live in Vault.

CategorySecret StatusAvailable

Overview

The HashiCorp Vault secret plugin resolves a config secret reference (a provider API key, a database password) straight out of a HashiCorp Vault KV v2 mount over Vault’s HTTP API, instead of an environment variable or a file busbar reads at boot.

A reference names the KV v2 path and the field to extract: either the #field suffix Vault’s own UI/CLI output already uses (kv/data/openai#api_key) or the equivalent two-key form ({ path: "kv/data/openai", field: "api_key" }). Auth is a pre-obtained token sent as X-Vault-Token, Vault’s simplest, most universal scheme; AppRole/Kubernetes login flows are a natural extension for later. A 404 (no secret there), a 403 (bad token/policy), and a 5xx (Vault itself unhealthy) each surface as a distinct, specific error, never collapsed into a generic failure.

It implements the same signed plugin ABI every first-party store/auth/secret plugin does.

Install it

Download the signed tarball for your platform (button above), drop it in plugins/, and set:

secrets:
  vault:
    settings: { addr: "https://vault.internal:8200", token: { env: VAULT_TOKEN } }

providers:
  openai:
    api_key: { module: vault, settings: { path: "kv/data/openai#api_key" } }

Independently versioned from busbar itself: pin both explicitly in production. Requires busbar 1.5.0+.

Prefer to install by hand? No plugins.fetch config needed: download the signed tarball (links above), drop it in your plugins.dir, and busbar loads it at boot; signature and trust checks still apply. You can also push it live over the admin API. See the plugin install docs.

Settings

Setting	Required	Default	Description
`addr`	Yes	—	Module setting. Vault server address, e.g. `https://vault.internal:8200`.
`token`	Yes	—	Module setting. Vault token, sent as `X-Vault-Token`. Give a secret reference (`{ env: }`/`{ file: }`), never a plaintext literal.
`ca_cert_pem`	No	—	Module setting. Additional trusted root CA (PEM), layered on the built-in roots.
`timeout_secs`	No	`10`	Module setting. HTTP connect + total request timeout, in seconds.
`path`	Yes	—	Per-reference (at the call site). Full Vault v1 API path incl. the KV v2 `data/` segment; a `#field` suffix selects the field.
`field`	No	—	Per-reference (at the call site). Field to extract from the secret; required unless `path` carries a `#field` suffix, and wins if both are given.

← Back to the Plugin Store