I really like this idea. I think you would need to implement a custom CredentialsProvider that reads the credentials from vault. The interesting question is where this CredentialsProvider would get his Token / AppRole Credentials from - and how this could be scoped to different Folders / Jobs.

I wrapped a groovy script in a job to sync credentials periodically from vault to jenkins' credential store. The access token is read from vault-plugin config. From there on you can use vault credentials wherever you need them in jenkins.

I think about turning that into a plugin, as soon as I find some time for that. Until then, you might try the script approach yoursefl. Jenkins is very open when it comes to groovy scripting 

tkoren Have you had a chance to either make the script available or to turn the script into a PR? We're starting to look at making this work now but I have no idea where to even start

I'd be really interested in helping with this. Exposing the vault secrets via a CredentialsProvider will make for a much more flexible plugin. I'll knock together a PR unless someone shouts.

rvodden if you do let me know if you need a tester. I would love to have this! Removing the credentials from Jenkins will go a long way towards making jenkins easier to deploy from a script / configuration management system.

Is there any partially completed work on this? Is there any active work being done right now? We can help if needed.

We'd like to use this to auth the github organization plugin, the kubernetes plugin, etc. and would allow us to have a solid security posture on jenkins. If this were a plugin that exposed a credential provider (not a sync to the jenkins credential store) then the only credential we would need in the jenkins credential store is the one used by the vault plugin. In the case of an out of band verified auth method such as jwt based ones like gcp auth or k8s auth the value of the credential is not sensitive. This way no actual sensitive information is stored in Jenkins but rather just exposed to jobs ephemerally via this vault plugin.

sanbornick I haven't seen anything. Above rvodden said he was going to put together a PR but  I haven't seen one yet.  I would love to have the ability to use Vault to handle all the credentials. That would reduce the attack surface for all the connected services

I did have a look at this, and then real life got in the way. Let me have a look at how far I got and at the very least push a branch up or something.