dsh-credentials-vault

Configuration

Key	Default	Meaning
address	http://127.0.0.1:8200	Vault base address.
namespace	''	Vault Enterprise namespace. Empty sends no header.
mount	secret	KV secrets-engine mount point.
path	dsh	Path under the mount holding the credential map.
kvVersion	2	KV engine version. v2 gives compare-and-swap and versioning.
tokenRef	VAULT_TOKEN	Env var holding a Vault token. Used when AppRole is not configured.
approleMount	approle	AppRole auth mount path.
roleIdRef	VAULT_ROLE_ID	Env var holding an AppRole role id.
secretIdRef	VAULT_SECRET_ID	Env var holding an AppRole secret id.
readOnly	false	Refuse set/unset entirely.
environmentWins	true	Let an inherited env var shadow Vault, as the local provider does.
cacheTtlMs	0	Cache the secret map for this many ms. 0 reads per operation.
timeoutMs	10000	Vault request timeout.

Nothing secret goes in this file. tokenRef, roleIdRef, and secretIdRef name environment variables carrying the bootstrap credential. The point of the plugin is that long-lived provider keys are not in configuration, and that has to hold for its own bootstrap too.