Add HashiCorp Vault key manager plugin to SPIRE server#5500

Draft

InverseIntegral wants to merge 43 commits intospiffe:mainfrom

InverseIntegral:main

Commits on Oct 3, 2025

Create skeleton of HC Vault based server keymanager plugin (#5058)

InverseIntegral
authored and
MarcosDY
committed
Start implementing signing function for HC vault (#5058)

InverseIntegral
authored and
MarcosDY
committed
Make SignData work with HC Vault keymanager plugin (#5058)

InverseIntegral
authored and
MarcosDY
committed
Rename transit key type constants (#5058)

InverseIntegral
authored and
MarcosDY
committed
Make vault client more robust by handling invariant violations (#5058)

InverseIntegral
authored and
MarcosDY
committed
Move logic from plugin to vault client (#5058)

InverseIntegral
authored and
MarcosDY
committed
Refactor logic to generate vault client (#5058)

InverseIntegral
authored and
MarcosDY
committed
Use latest key version to sign data (#5058)

InverseIntegral
authored and
MarcosDY
committed
Move data encoding to vault client (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add simple vault client auth test (#5058)

InverseIntegral
authored and
MarcosDY
committed
Remove unused test code (#5058)

InverseIntegral
authored and
MarcosDY
committed
Support configuring vault namespace (#5058)

InverseIntegral
authored and
MarcosDY
committed
Support AppRole authentication (#5058)

InverseIntegral
authored and
MarcosDY
committed
Make transit engine path configurable (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add comments to exported functions (#5058)

InverseIntegral
authored and
MarcosDY
committed
Support certificate authentication (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add missing app role auth test case (#5058)

InverseIntegral
authored and
MarcosDY
committed
Support K8s auth (#5058)

InverseIntegral
authored and
MarcosDY
committed
Support verifying server certificate via CA (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test vault client create key function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test vault client get key function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test vault client sign data function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test vault key manager configure function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test vault key manager generate key function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Load keys from Vault on configure (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test get key entry function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Test get keys function (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add simple plugin documentation (#5058)

InverseIntegral
authored and
MarcosDY
committed
Remove unused hooks (#5058)

InverseIntegral
authored and
MarcosDY
committed
Fix hcl examples in documentation (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add KeyManager vault integration test (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add warning when skipping TLS verification (#5058)

InverseIntegral
authored and
MarcosDY
committed
Prevent shadowing of variable (#5058)

InverseIntegral
authored and
MarcosDY
committed
Improve comment (#5058)

InverseIntegral
authored and
MarcosDY
committed
Add type assertion check (#5058)

InverseIntegral
authored and
MarcosDY
committed
Remove TODO (#5058)

InverseIntegral
authored and
MarcosDY
committed
Remove TODO (#5058)

InverseIntegral
authored and
MarcosDY
committed
Introduce unique server id for HA setup (#5058)

InverseIntegral
authored and
MarcosDY
committed
Make key names unique by adding a UUID (#5058)

InverseIntegral
authored and
MarcosDY
committed
Cleanup keys with same SPIRE key id (#5058)

InverseIntegral
authored and
MarcosDY
committed
resolve lint issues and implement Validate in plugin
MarcosDY
committed
Resolve file issue
MarcosDY
committed
Require validate provided key identifier
MarcosDY
committed