vault-plugin-secrets-bind-tsig

A HashiCorp Vault / OpenBao secrets engine that manages BIND TSIG keys via the bind-operator companion API.

Vault never talks to Kubernetes directly: it calls the operator's companion API (deployed by the operator, boolean-gated), which creates/rotates/deletes BindTSIGKey custom resources. The operator reconciles those into the actual key material and wires them into named.conf.

Vault plugin ──HTTP──> companion API ──creates/rotates──> BindTSIGKey CR
                                                              │ operator reconciles
                                                              ▼
                                                    Secret (key material) + named.conf

Paths

Path	Purpose
<mount>/config	companion API URL + token + TLS + defaults
<mount>/static-roles/<role>	a stable, named key with managed rotation (the key name never changes, so zone allow-update clauses stay valid)
<mount>/static-creds/<role>	read the current material for a static key (rotates first if the period elapsed)
<mount>/roles/<role>	a dynamic role
<mount>/creds/<role>	mint a unique, lease-bound key; deleted on revoke

Companion API contract

The plugin expects the bind-operator companion API to expose:

• POST /v1/keys — {name, algorithm, cluster_ref, static} → creates a BindTSIGKey, returns {name, algorithm, secret, key_name, cluster_ref}
• GET /v1/keys/{name} — current material
• POST /v1/keys/{name}/rotate — rotate material, returns the new value
• DELETE /v1/keys/{name} — delete the key + its CR

Usage

# register + enable (Vault plugin_directory must contain the binary)
sha=$(sha256sum /opt/vault-plugins/vault-plugin-secrets-bind-tsig | cut -d' ' -f1)
vault plugin register -sha256=$sha secret vault-plugin-secrets-bind-tsig
vault secrets enable -path=bind-tsig vault-plugin-secrets-bind-tsig

# configure the companion API connection
vault write bind-tsig/config \
  api_url=https://bind-tsig-api.bind-system.svc:8443 \
  token=@token default_cluster_ref=bind-authoritative

# a static, rotated key (e.g. the puppet client-update key)
vault write bind-tsig/static-roles/client-update rotation_period=720h
vault read  bind-tsig/static-creds/client-update

# a dynamic, lease-bound key
vault write bind-tsig/roles/ephemeral cluster_ref=bind-authoritative ttl=1h max_ttl=24h
vault read  bind-tsig/creds/ephemeral

Build

make build      # -> dist/vault-plugin-secrets-bind-tsig
make test lint  # go test -race / go vet
make rpm        # vault + openbao RPM flavours

CI (Woodpecker) runs pre-commit/build/lint/test on PRs and builds+publishes the RPMs on a v* tag.