Scaffold the ghp Vault secrets engine Terraform provider #1

2026-08-15T19:25:38+10:00

unkin-agent commented

2026-08-15 19:25:38 +10:00

Why

The ghp Vault secrets engine ('vault-plugin-secrets-ghp', mounted at ghp) mints short-lived scoped ghp tokens, but its mount, config, and roles had no Terraform surface. This provider gives one so the engine can be driven declaratively from terraform-vault, mirroring terraform-provider-giteavaultsecret.

Changes

Add the provider (local name ghpvaultsecret, source git.unkin.net/unkin/ghpvaultsecret) with VAULT_ADDR/VAULT_TOKEN fallback.
Add ghpvaultsecret_secret_backend: mount the engine and write its config — base_url (default https://ghp.unkin.net), write-only admin_token, write-only ca_cert, tls_skip_verify, request_timeout_seconds. Read never returns the sensitive fields, so they are preserved in state without drift.
Add ghpvaultsecret_secret_role: token_type (agent/proxy), installation_id, app_record_id, repositories, scopes, session_prefix, ttl, max_ttl; validate that agent roles set installation_id.
Add unit tests for the value conversions and the role/backend field mapping (including proxy-role null preservation).
Mirror the Woodpecker pipelines (pre-commit/build/test on PR, package + PUT zip to the artifactapi terraform registry on tag), Makefile version-bump/package targets, examples, README, and a Docker e2e harness against a mock ghp.

gofmt, go vet, go build, and go test -race all pass locally.

## Why The ghp Vault secrets engine ('vault-plugin-secrets-ghp', mounted at `ghp`) mints short-lived scoped ghp tokens, but its mount, config, and roles had no Terraform surface. This provider gives one so the engine can be driven declaratively from `terraform-vault`, mirroring `terraform-provider-giteavaultsecret`. ## Changes - Add the provider (local name `ghpvaultsecret`, source `git.unkin.net/unkin/ghpvaultsecret`) with `VAULT_ADDR`/`VAULT_TOKEN` fallback. - Add `ghpvaultsecret_secret_backend`: mount the engine and write its `config` — `base_url` (default `https://ghp.unkin.net`), write-only `admin_token`, write-only `ca_cert`, `tls_skip_verify`, `request_timeout_seconds`. Read never returns the sensitive fields, so they are preserved in state without drift. - Add `ghpvaultsecret_secret_role`: `token_type` (agent/proxy), `installation_id`, `app_record_id`, `repositories`, `scopes`, `session_prefix`, `ttl`, `max_ttl`; validate that agent roles set `installation_id`. - Add unit tests for the value conversions and the role/backend field mapping (including proxy-role null preservation). - Mirror the Woodpecker pipelines (pre-commit/build/test on PR, package + PUT zip to the artifactapi terraform registry on tag), Makefile version-bump/package targets, examples, README, and a Docker e2e harness against a mock ghp. `gofmt`, `go vet`, `go build`, and `go test -race` all pass locally.

unkin-agent added 1 commit 2026-08-15 19:25:38 +10:00

Scaffold the ghp Vault secrets engine provider

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

986aecd28f

Model the provider on terraform-provider-giteavaultsecret, adjusting the
schemas to the ghp engine (vault-plugin-secrets-ghp) so its mount, config,
and roles can be managed declaratively.

- Add provider (local name ghpvaultsecret, source
  git.unkin.net/unkin/ghpvaultsecret) with VAULT_ADDR/VAULT_TOKEN fallback.
- Add ghpvaultsecret_secret_backend: mounts the engine and writes config
  (base_url, write-only admin_token, write-only ca_cert, tls_skip_verify,
  request_timeout_seconds); read never returns the sensitive fields.
- Add ghpvaultsecret_secret_role: token_type, installation_id, app_record_id,
  repositories, scopes, session_prefix, ttl, max_ttl; validate that agent
  roles set installation_id.
- Add unit tests for the value conversions and the role/backend field mapping.
- Mirror the woodpecker pre-commit/build/test (PR) and tag release (package +
  PUT zip to the artifactapi terraform registry) pipelines, Makefile version
  bump/package targets, examples, README, and a Docker e2e harness.

unkin-agent closed this pull request

2026-08-15 20:27:38 +10:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-ghpvaultsecret#1