Skip to content

Commit e595a8c

Browse files
sallyomjoshavant
sallyom
and
joshavant
authored
Add Vault SecretRef plugin (#89255)
* Add Vault SecretRef plugin Signed-off-by: sallyom <[email protected]> * expand Vault setup to registered SecretRef targets Signed-off-by: sallyom <[email protected]> * fix(vault): use sdk secret target seam * fix(vault): preserve auth profile target paths * docs(vault): document plugin enable step * fix(vault): make status provider-alias aware * fix(vault): reject noncanonical secret ids * fix(vault): separate resolver timeout deadlines * fix(vault): forward private CA trust settings * fix(secrets): preserve plugin policy boundaries --------- Signed-off-by: sallyom <[email protected]> Co-authored-by: joshavant <[email protected]>
1 parent 6a6aba0 commit e595a8c

30 files changed

Lines changed: 2677 additions & 8 deletions

‎.github/labeler.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,12 @@
335335
- changed-files:
336336
- any-glob-to-any-file:
337337
- "extensions/tokenjuice/**"
338+
"extensions: vault":
339+
- changed-files:
340+
- any-glob-to-any-file:
341+
- "extensions/vault/**"
342+
- "docs/plugins/vault.md"
343+
- "docs/plugins/reference/vault.md"
338344
"extensions: webhooks":
339345
- changed-files:
340346
- any-glob-to-any-file:

‎docs/.generated/plugin-sdk-api-baseline.sha256‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
d23999706f07d7e3ad75a2d642d9d3df9aa9d9eccfd162e90ee03745af79d788 plugin-sdk-api-baseline.json
2-
dd8db488da6b6a09f1873834fea1b84c95c61ebeba99c347760d767ea6ee0a79 plugin-sdk-api-baseline.jsonl
1+
52c7a8b045ee89b62266910d1d2db6a379c696ed514aeaa7ca3c6f0dbcc3ff67 plugin-sdk-api-baseline.json
2+
a703333cefbf3b36cc826965592a8de3542ac91cfe9cd8c5447cb748407fece3 plugin-sdk-api-baseline.jsonl

‎docs/cli/secrets.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,3 +155,4 @@ If `audit --check` still reports plaintext findings, update the remaining report
155155

156156
- [CLI reference](/cli)
157157
- [Secrets management](/gateway/secrets)
158+
- [Vault SecretRefs](/plugins/vault)

‎docs/docs.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1280,6 +1280,7 @@
12801280
"plugins/webhooks",
12811281
"plugins/admin-http-rpc",
12821282
"plugins/voice-call",
1283+
"plugins/vault",
12831284
"plugins/memory-wiki",
12841285
"plugins/llama-cpp",
12851286
"plugins/memory-lancedb",

‎docs/docs_map.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6783,6 +6783,15 @@ Do not edit it by hand; run `pnpm docs:map:gen`.
67836783
- H2: Surface
67846784
- H2: Related docs
67856785

6786+
## plugins/reference/vault.md
6787+
6788+
- Route: /plugins/reference/vault
6789+
- Headings:
6790+
- H1: Vault plugin
6791+
- H2: Distribution
6792+
- H2: Surface
6793+
- H2: Related docs
6794+
67866795
## plugins/reference/venice.md
67876796

67886797
- Route: /plugins/reference/venice
@@ -7157,6 +7166,21 @@ Do not edit it by hand; run `pnpm docs:map:gen`.
71577166
- H3: Tool does not appear after install
71587167
- H2: See also
71597168

7169+
## plugins/vault.md
7170+
7171+
- Route: /plugins/vault
7172+
- Headings:
7173+
- H1: Vault SecretRefs
7174+
- H2: Before you begin
7175+
- H2: Store a provider key in Vault
7176+
- H2: Make Vault visible to the Gateway
7177+
- H2: Generate and apply a SecretRef plan
7178+
- H2: Configure more provider keys
7179+
- H2: SecretRef id format
7180+
- H2: What OpenClaw stores
7181+
- H2: Containers and managed deployments
7182+
- H2: Related
7183+
71607184
## plugins/voice-call.md
71617185

71627186
- Route: /plugins/voice-call

‎docs/gateway/secrets.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -741,6 +741,7 @@ Some SecretInput unions are easier to configure in raw editor mode than in form
741741

742742
- [Authentication](/gateway/authentication) - auth setup
743743
- [CLI: secrets](/cli/secrets) - CLI commands
744+
- [Vault SecretRefs](/plugins/vault) - HashiCorp Vault provider setup
744745
- [Environment Variables](/help/environment) - environment precedence
745746
- [SecretRef Credential Surface](/reference/secretref-credential-surface) - credential surface
746747
- [Secrets Apply Plan Contract](/gateway/secrets-plan-contract) - plan contract details

‎docs/plugins/plugin-inventory.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ Each entry lists the package, distribution route, and description.
5151

5252
## Core npm package
5353

54-
61 plugins
54+
62 plugins
5555

5656
- **[admin-http-rpc](/plugins/reference/admin-http-rpc)** (`@openclaw/admin-http-rpc`) - included in OpenClaw. OpenClaw admin HTTP RPC endpoint.
5757

@@ -157,6 +157,8 @@ Each entry lists the package, distribution route, and description.
157157

158158
- **[tts-local-cli](/plugins/reference/tts-local-cli)** (`@openclaw/tts-local-cli`) - included in OpenClaw. Adds text-to-speech provider support.
159159

160+
- **[vault](/plugins/reference/vault)** (`@openclaw/vault`) - included in OpenClaw. HashiCorp Vault SecretRef provider integration.
161+
160162
- **[vllm](/plugins/reference/vllm)** (`@openclaw/vllm-provider`) - included in OpenClaw. Adds vLLM model provider support to OpenClaw.
161163

162164
- **[volcengine](/plugins/reference/volcengine)** (`@openclaw/volcengine-provider`) - included in OpenClaw. Adds Volcengine, Volcengine Plan model provider support to OpenClaw.

‎docs/plugins/reference.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ This page is generated from `extensions/*/package.json` and
1515
pnpm plugins:inventory:gen
1616
```
1717

18-
Use [Plugin inventory](/plugins/plugin-inventory) to browse all 133
18+
Use [Plugin inventory](/plugins/plugin-inventory) to browse all 134
1919
generated plugin reference pages by distribution, package, and description.

‎docs/plugins/reference/imessage.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Adds the iMessage channel surface for sending and receiving OpenClaw messages.
1616

1717
## Surface
1818

19-
channels: imessage
19+
channels: imessage; skills
2020

2121
## Related docs
2222

‎docs/plugins/reference/vault.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
summary: "HashiCorp Vault SecretRef provider integration."
3+
read_when:
4+
- You are installing, configuring, or auditing the vault plugin
5+
title: "Vault plugin"
6+
---
7+
8+
# Vault plugin
9+
10+
HashiCorp Vault SecretRef provider integration.
11+
12+
## Distribution
13+
14+
- Package: `@openclaw/vault`
15+
- Install route: included in OpenClaw
16+
17+
## Surface
18+
19+
plugin
20+
21+
## Related docs
22+
23+
- [vault](/plugins/vault)

0 commit comments

Comments
 (0)