Bump vault-gcp-secrets-plugin

[bmaximuml]

Description

Bumps vault-gcp-secrets-plugin

Why

This update fixes a number of bugs which prevented newer google apis being exposed to vault.

Our use case is around google artifact registry - since google is deprecating google container registry, we are forced to migrate to google artifact registry. In the current vault release, we can specify GCR permissions as below, however doing so for GAR gives the following error: unsupported resource type: projects/locations/repositories

This PR points to the tip of the main branch in vault-plugin-secrets-gcp. Ideally, it would point to a release, however one has not been made since this was merged. I have an open issue requesting for one to be made.

Specify permissions for GCR (legacy):

resource "vault_gcp_secret_roleset" "gcr_reader" {
  backend      = "gcp"
  roleset      = "gcr_reader"
  secret_type  = "access_token"
  project      = "myproject1"
  token_scopes = ["https://www.googleapis.com/auth/cloud-platform"]

  binding {
    resource = "buckets/eu.artifacts.myproject1.appspot.com"
    roles = [
      "roles/storage.legacyBucketReader",
      "roles/storage.legacyObjectReader",
    ]
  }
}

Attempt to specify permissions for GAR (fixed with this PR):

data "google_artifact_registry_repository" "eu_gcr_io" {
  location      = "europe"
  repository_id = "eu.gcr.io"
  project       = "myproject1"
}

resource "vault_gcp_secret_roleset" "gcr_reader" {
  backend      = "gcp"
  roleset      = "gcr_reader"
  secret_type  = "access_token"
  project      = "myproject1"
  token_scopes = ["https://www.googleapis.com/auth/cloud-platform"]

  binding {
    resource = "//artifactregistry.googleapis.com/${data.google_artifact_registry_repository.eu_gcr_io.id}"
    roles = [
      "roles/artifactregistry.reader",
    ]
  }
}

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[bmaximuml]

Thanks @divyaac !

[bmaximuml]

Hi @divyaac , I've noticed this PR wasn't included in the recent releases of vault. Is there anything I need to do to get this into the next release?

[fairclothjm]

@bmaximuml Hello, we do not release pseudo versions of plugins with Vault. We will be cutting a new plugin release along with the upcoming Vault 1.18 release.

[bmaximuml]

@fairclothjm thanks for the update. I'll keep an eye out for 1.18!