Include rotated secrets for cloud vault secrets VAULT-22307

[dhuckins]

🛠️ Description

Allows users to fetch rotating secrets using the hcp_vault_secrets_app and hcp_vault_secrets_secret data sources

hcp_vault_secrets_app

hcp_vault_secrets_app: keys from complex (rotating) secrets are concatenated in the same pattern we've been using

Given these secrets

with

data "hcp_vault_secrets_app" "example" {
  app_name = "sample-app"
}

output "all-secrets" {
  value = data.hcp_vault_secrets_app.example.secrets
  sensitive = true
}

gives (secret values print out to stdout successfully, am not including here)

❯ terraform output all-secrets
tomap({
  "READ_ME" = ***
  "Step1" = ***
  "Step2" = ***
  "Step3" = ***
  "mongodb_atlas_password" = ***
  "mongodb_atlas_username" = ***
})

hcp_vault_secrets_secret

For backwards compatibility in the hcp_vault_secrets_secret, any rotating secret will be JSON encoded
using the same secrets setup above in the portal

data "hcp_vault_secrets_secret" "rotating" {
  app_name    = "sample-app"
  secret_name = "mongodb_atlas"
}

output "rotating-secret" {
  value = data.hcp_vault_secrets_secret.rotating.secret_value
  sensitive = true
}

gives

❯ terraform output rotating-secret
"{\"password\":\"***\",\"username\":\"***\"}"

Because the user may not expect a json payload we emit a warning

🏗️ Acceptance tests

• Are there any feature flags that are required to use this functionality?
• Have you added an acceptance test for the functionality being added?
• Have you run the acceptance tests on this branch?

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccXXX'

...

[averche]

A few comments, nothing is blocking, LGTM!

[averche]

Nice improvement!

[averche]

Would it be cleaner to switch on secret.Type instead?

[dhuckins]

cleaner: yes

was concerned about the string type, are we going to switch to enum at some point?

[averche]

maybe 🤷 It's OK to leave as is for now

[averche]

Same as above, switching on secret.Type might be cleaner

[averche]

I'm a bit unsure about this warning. We may want to keep this data source as an equivalent of vault_generic_secret data source. In this case, it should be perfectly valid to use it to fetch a rotating secret.

I think it's OK to leave it here as well.

[dhuckins]

lets keep, was in the original discussion when we planned this out

[jasonpilz]

LGTM