A collection of custom plugins for HashiCorp Vault. Plugins in this repository are written in Go and follow the Vault SDK framework.Backend pattern with plugin multiplexing (plugin.ServeMultiplex).
Korean documentation (한국어): README.ko.md
| Directory | Description |
|---|---|
plugins/vault-plugin-secrets-kafka |
Kafka auth secret engine (dynamic SCRAM issuance/revocation + a foundation for static bundles). Includes a local docker compose stack and a Spring Boot validation UI |
plugins/vault-plugin-secrets-machine |
Machine (local OS account) static credentials: stores passwords and rotates them on a schedule over SSH (Linux) or WinRM (Windows). Mount path is typically machine/; model is analogous to database static roles. |
plugins/vault-plugin-secrets-github |
Secret engine to mint GitHub App installation access tokens |
plugins/vault-plugin-auth-mac-passkey |
Auth method to issue Vault tokens using macOS Touch ID (WebAuthn passkeys) via a local macOS helper |
Cross-compile targets: linux (amd64, arm, arm64), windows (amd64, arm64), darwin (arm64). Each cell links to the workflow for that row and shows its latest status on main. Badge alt text is the platform only (the plugin is identified in the first column).
For vault-plugin-auth-mac-passkey, the Go plugin uses the same per-target workflows as the secret plugins (generated by scripts/generate-plugin-ci-workflows.sh). The Swift CLI and macOS .app have their own workflows so you can see helper build status separately (see table below).
Repository for badge URLs: Great-Stone/vault-plugins. If you fork, update the owner/name in the image URLs (or re-run scripts/generate-plugin-ci-workflows.sh after changing workflows).
| Plugin | linux/amd64 | linux/arm | linux/arm64 | windows/amd64 | windows/arm64 | darwin/arm64 |
|---|---|---|---|---|---|---|
| secret-kafka |  |
 |
 |
 |
 |
 |
| secret-machine |  |
 |
 |
 |
 |
 |
| secret-github |  |
 |
 |
 |
 |
 |
| auth-mac-passkey |  |
 |
 |
 |
 |
 |
| Component | Status |
|---|---|
Swift CLI (localhelper/vault-login-passkey-macos) |
 |
.app bundle (localhelper/vault-login-passkey-macos-app) |
 |
To publish a release with all plugin binaries, run the GitHub Actions workflow Release plugins and provide a semver version (for example v1.2.3). The workflow cross-compiles all plugins for the supported targets, generates SHA256SUMS, tags the current main commit, and uploads assets to the GitHub Release.
- Vault plugin development:
https://developer.hashicorp.com/vault/docs/plugins/plugin-development - Register a plugin:
https://developer.hashicorp.com/vault/docs/plugins/register-plugin