Retrieve from cubbyhole

[FredPraca]

Use Case

Sometimes, logins are not done through a generic account but through a personal account with sudo capability.
Specifying the sudo-password as clear text inside the Bolt inventory file is not recommended.
Moreover the personal account password should not be shared in Vault and so resides in the cubbyhole.

Describe the Solution You Would Like

Using a configuration like the following would be interesting

version: 2
targets:
  - ...
config:
  transport: ssh
  ssh:
     user:
        _plugin: vault
        path: cubbyhole/admin_account
        field: user
     password:
        _plugin: vault
        path: cubbyhole/admin_account
        field: password

     run-as: root
     sudo-password:
        _plugin: vault
        path: cubbyhole/admin_account
        field: password

It looks like the standard KV engine but may require a parameter specifying the kind of secret engine used.

Alternative

As an alternative, user specific path in a KV may be used along ACL templating.