vault_plugin

Manage Vault (or OpenBao) plugins.

Added in version 1.8.0.

Important

This module requires the general Vault setup.

saltext.vault.states.vault_plugin.registered(name, plugin_type, sha256=None, command=None, args=None, env=None, oci_image=None, runtime=None, download=False)

Ensure an unversioned plugin is registered as specified.

name

Name of the plugin to manage.

plugin_type

Type of the plugin to manage. Either auth, database or secret.

sha256

SHA256 hexdigest of the plugin binary or the OCI image. Before Vault runs a plugin, it checks the plugin SHA against this value. If the actual SHA of the plugin binary and the SHA provided here do not match, Vault refuses to run the plugin.

Note

Required to register a plugin binary. Must be unset to register an extracted .zip file.

command

Specifies the command used to execute the plugin. This is relative to the plugin directory, e.g. “myplugin”, or if oci_image is also specified, it is relative to the image’s working directory. If unspecified and oci_image is not defined, defaults to the name.

Note

Ignored when registering with an extracted .zip file as the associated run command is known then.

args

List of arguments used to execute the plugin. Optional.

env

List of environment variables used during the execution of the plugin. Each entry is of the form “key=value”.

Important

Not managed statefully since the API does not report the value, i.e. this is only set when a plugin is registered for the first time or when other values change.

oci_image

Vault only: Specifies OCI image to run. If specified, setting command, args, and env updates the container’s entrypoint, args, and environment variables (append-only) respectively.

runtime

Vault only: Specifies Vault plugin runtime to use if oci_image is specified.

download

Vault Enterprise only: Download the specified plugin from HashiCorp’s releases page.

saltext.vault.states.vault_plugin.unregistered(name, plugin_type)

Ensure an unversioned plugin is not registered.

name

Name of the plugin to manage.

plugin_type

Type of the plugin to manage. Either auth, database or secret.

saltext.vault.states.vault_plugin.version_registered(name, plugin_type, version, sha256=None, command=None, args=None, env=None, oci_image=None, runtime=None, download=False)

Ensure a versioned plugin is registered as specified.

name

Name of the plugin to manage.

plugin_type

Type of the plugin to manage. Either auth, database or secret.

version

Specifies the semantic version of this plugin. Used as the tag when specifying oci_image, but with any leading ‘v’ trimmed.

sha256

SHA256 hexdigest of the plugin binary or the OCI image. Before Vault runs a plugin, it checks the plugin SHA against this value. If the actual SHA of the plugin binary and the SHA provided here do not match, Vault refuses to run the plugin.

Note

Required to register a plugin binary. Must be unset to register an extracted .zip file.

command

Specifies the command used to execute the plugin. This is relative to the plugin directory, e.g. “myplugin”, or if oci_image is also specified, it is relative to the image’s working directory. If unspecified and oci_image is not defined, defaults to the name.

Note

Ignored when registering with an extracted .zip file as the associated run command is known then.

args

List of arguments used to execute the plugin. Optional.

env

List of environment variables used during the execution of the plugin. Each entry is of the form “key=value”.

Important

Not managed statefully since the API does not report the value, i.e. this is only set when a plugin is registered for the first time or when other values change.

oci_image

Vault only: Specifies OCI image to run. If specified, setting command, args, and env updates the container’s entrypoint, args, and environment variables (append-only) respectively.

runtime

Vault only: Specifies Vault plugin runtime to use if oci_image is specified.

download

Vault Enterprise only: Download the specified plugin from HashiCorp’s releases page.

saltext.vault.states.vault_plugin.version_unregistered(name, plugin_type, version)

Ensure one or more versions of a versioned plugin are not registered.

name

Name of the plugin to manage.

plugin_type

Type of the plugin to manage. Either auth, database or secret.

version

Version to remove. Can be a glob, which removes all matching versions.

saltext.vault.states.vault_plugin.version_pinned(name, plugin_type, version, now=False, now_globally=False)

Ensure a plugin is pinned to a specific version.

Note

Only available on Vault.

name

Name of the plugin to manage.

plugin_type

Type of the plugin to manage. Either auth, database or secret.

version

Version to pin.

now

After pinning, reload all mounts of the plugin. Defaults to false.

now_globally

When now is true, begin reloading plugin on all cluster nodes. Defaults to false, which only reloads mounts on the targeted node.

saltext.vault.states.vault_plugin.version_unpinned(name, plugin_type, now=False, now_globally=False)

Ensure a plugin is pinned to a specific version.

Note

Only available on Vault.

name

Name of the plugin to manage.

plugin_type

Type of the plugin to manage. Either auth, database or secret.

now

After unpinning, reload all mounts of the plugin. Defaults to false.

now_globally

When now is true, begin reloading plugin on all cluster nodes. Defaults to false, which only reloads mounts on the targeted node.