Add Hashicorp Vault provider

[stvcooke]

To track interest and discussion on adding a vault provider.

[busser]

Thanks for taking this initiative!

Currently users have the option of using vault-env and we need to decide how murmur positions itself compared to the alternatives.

Do users want murmur to be a simpler alternative to vault-env? Do they want murmur to support Vault's advanced features like dynamic secrets and the many authentication options?

Please everyone, let us know what you think. Your comments will impact what murmur becomes :)

[stvcooke]

I'm not finding a whole lot of documentation or examples on using banzaicloud's vault-env as a standalone. The best example I've found so far is this blog post. My current understanding is it requires installing one or two operators onto the cluster with custom annotations on the deployments/pods. If that is incorrect, there's not an easy place to find documentation on the functionality.

There's possibility for something lighter and simpler, that doesn't require any operators. It would reduce maintenance costs by not having the operator(s). Also, a few solid examples and users could get up and running much quicker.

The companies I've worked at primarily used vault as a kv store. As for authentication options, I think starting with using the pod's service account credentials would be consistent with the other providers. Maybe if a token environment variable were present, that could be used instead for local testing.

[busser]

Thanks for the continued interest in Vault support! I've given this some thought and here's where I stand:

Scope: Static secrets only (initially)

I think Murmur should focus on static K/V secrets from Vault. Dynamic secrets are a poor fit for environment variables since environment variables are immutable after process start. This keeps the implementation focused and aligns with Murmur's philosophy of being a simple secrets injection tool.

We could potentially handle dynamic secrets in the future by writing them to files and putting the file path in the environment variable, but that's a more complex feature that can come later.

Authentication: Comprehensive support

Unlike my earlier hesitation, I now believe we should support all of Vault's authentication methods from the start. Otherwise Murmur won't be useful in many real-world scenarios. The implementation should discover Vault client configuration from the environment in a way that mimics other Vault clients (like the CLI or Terraform provider).

This approach would make Vault a first-class citizen alongside our existing providers (AWS, Azure, GCP, Scaleway).

Thoughts on this direction? I think it strikes the right balance between simplicity and real-world usability.