Plugin Store · Secret
Resolve secrets from Vault KV v2.
The HashiCorp Vault secret plugin resolves a config secret reference (a provider API key, a database password) straight out of a HashiCorp Vault KV v2 mount over Vault’s HTTP API, instead of an environment variable or a file busbar reads at boot.
A reference names the KV v2 path and the field to extract — either the #field suffix Vault’s own UI/CLI output already uses (kv/data/openai#api_key) or the equivalent two-key form ({ path: "kv/data/openai", field: "api_key" }). Auth is a pre-obtained token sent as X-Vault-Token — Vault’s simplest, most universal scheme; AppRole/Kubernetes login flows are a natural extension for later. A 404 (no secret there), a 403 (bad token/policy), and a 5xx (Vault itself unhealthy) each surface as a distinct, specific error, never collapsed into a generic failure.
It implements the same signed plugin ABI every first-party store/auth/secret plugin does.
Install it
Download the signed tarball for your platform (button above), drop it in plugins/, and set:
secrets:
vault:
settings: { addr: "https://vault.internal:8200", token: { env: VAULT_TOKEN } }
providers:
openai:
api_key: { module: vault, settings: { path: "kv/data/openai#api_key" } }Independently versioned from busbar itself — pin both explicitly in production. Requires busbar 1.5.0+.