ds-resolve-vault

Overview ¶

Command ds-resolve-vault is the HashiCorp Vault resolver plugin (§12, §37.4). It reads a KV secret through the `vault` CLI, which must be installed and logged in, hashes the value in memory, and returns existence and the hash. The value never leaves this process. The address is `vault:<mount>/<path>#<field>`, the `vault:` optional; without `#<field>` the field is `value`.