Plugins: Auto version selection for auth/secrets + tune version

[tomhjp]

Two main features:

• Auto version selection for auth/secret engines when versioned plugins are registered
• Add the ability to tune plugin version for auth/secret engines so that in-place upgrades can be performed

Other changes:

• external_plugin_test.go moves the calling code a level up the stack, using the system backend's HandleRequest instead of directly calling the implementation functions for each route. Moves the tests slightly closer to production call stacks.

There's still some more follow-up work to do in future PRs, including:

• Website documentation
• Add -plugin-version flag to vault auth tune and vault secrets tune
• Replace version with plugin_version everywhere (I excluded that from this PR to avoid diff noise) Done in Plugins: Consistently use plugin_version #17171
• Take a holistic look at the changelogs for this set of features

[tvoran]

👍 Seems to work for me when I tested with multiple versions of a secret engine! Just left a couple stray observations.

I also noticed that vault read sys/mounts/<mount> always shows running_sha as n/a even with an external plugin mounted (though I'm not sure what that's actually used for).

And another side note, I also tried mounting a builtin plugin, then registering a version of the same plugin, and tuning the mount for the version, then reloading, and vault read sys/mounts/<mount> still showed running_version as the builtin version. I think the versioned plugin started up since I see the process running, but I didn't verify anything else beyond that.

[tvoran]

It looks like selectPluginVersion() only returns plugins that aren't builtin, so I'm curious if it's possible to mount a builtin plugin if there's also a versioned instance of it registered.

[tomhjp]

Currently no, registering a versioned plugin with the same name overrides the built-in in the same way that registering an unversioned plugin of the same name does. However, I'm wondering whether it might be nice to also allow specifying -plugin-version=builtin or -plugin-version=1.12.0+builtin to explicitly select the builtin.

[tvoran]

Gotcha, it just seemed strange to me that I could see the built-in plugin in vault plugin list -detailed, but couldn't mount it. And I'd vote for using the version listed in the catalog (-plugin-version=1.12.0+builtin) if we end up going that way.

[tomhjp]

@tvoran sorry I realised just after I merged I forgot to respond to the main review comment. I think it came up in another PR, but the empty running_sha was expected, but should now be fixed from #17217.

vault read sys/mounts/<mount> still showed running_version as the builtin version.

Thanks for testing that, sounds like a bug. I'll take a look and follow up on it in another PR.