Add a plugin-import module + config/plugins for catalog registration

Registering a plugin in the catalog is a distinct concern from mounting an
engine, so give it its own module and config directory instead of folding
sha256/command into each engine's backend module.

- Add a generic 'plugin' module (vault_plugin: type/name/command/sha256/
  plugin_version) that imports a binary into the catalog.
- Add a config/plugins/ discovery group (filename = catalog name) and wire it
  through vault_cluster (plugins variable + module) and the syd1 environment.
- Add config/plugins/vault-plugin-secrets-gpg.yaml pinning the released v0.1.0
  binary sha256. Other engines can now register their plugin by dropping a file
  here; their *_secret_backend module just mounts the registered type.

modules/vault_cluster/main.tf

@@ -334,6 +334,18 @@ module "litellm_secret_backend_role" {
   depends_on = [module.litellm_secret_backend]
 }
 
+module "plugin" {
+  source = "./modules/plugin"
+
+  for_each = var.plugins
+
+  name           = each.value.name
+  type           = each.value.type
+  command        = each.value.command
+  sha256         = each.value.sha256
+  plugin_version = each.value.version
+}
+
 module "vault_policy" {
   source = "./modules/vault_policy"
 

modules/vault_cluster/modules/plugin/main.tf

@@ -0,0 +1,12 @@
+# Registers ("imports") a plugin binary in the Vault/OpenBao plugin catalog so
+# it can be mounted. The binary must already exist in the server
+# plugin_directory (installed out of band, e.g. by Puppet); `command` is its
+# filename there. The sha256 must match the on-disk binary or the server refuses
+# to launch the plugin.
+resource "vault_plugin" "this" {
+  type    = var.type
+  name    = var.name
+  command = coalesce(var.command, var.name)
+  sha256  = var.sha256
+  version = var.plugin_version
+}

modules/vault_cluster/modules/plugin/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}

modules/vault_cluster/modules/plugin/variables.tf

@@ -0,0 +1,27 @@
+variable "name" {
+  description = "Name to register the plugin under in the catalog (also the mount type)"
+  type        = string
+}
+
+variable "type" {
+  description = "Plugin type: secret, auth or database"
+  type        = string
+  default     = "secret"
+}
+
+variable "command" {
+  description = "Plugin binary filename relative to the server plugin_directory. Defaults to the plugin name."
+  type        = string
+  default     = null
+}
+
+variable "sha256" {
+  description = "SHA-256 of the installed plugin binary; must match the on-disk binary"
+  type        = string
+}
+
+variable "plugin_version" {
+  description = "Optional plugin version to register the catalog entry under"
+  type        = string
+  default     = null
+}

modules/vault_cluster/variables.tf

@@ -315,6 +315,18 @@ variable "litellm_secret_backend_role" {
   default = {}
 }
 
+variable "plugins" {
+  description = "Map of plugins to import (register) in the catalog, keyed by catalog name"
+  type = map(object({
+    name    = string
+    type    = optional(string, "secret")
+    command = optional(string)
+    sha256  = string
+    version = optional(string)
+  }))
+  default = {}
+}
+
 variable "policy_auth_map" {
   description = "Map of auth mounts -> auth roles -> policy names"
   type        = map(map(list(string)))