secrets: pass key/value config data to plugins as env (#26455)

Co-authored-by: Michael Schurter <mschurter@hashicorp.com>
Co-authored-by: Tim Gross <tgross@hashicorp.com>

api/tasks.go

@@ -1047,16 +1047,21 @@ func (v *Vault) Canonicalize() {
 }
 
 type Secret struct {
-	Name     string         `hcl:"name,label"`
-	Provider string         `hcl:"provider,optional"`
-	Path     string         `hcl:"path,optional"`
-	Config   map[string]any `hcl:"config,block"`
+	Name     string            `hcl:"name,label"`
+	Provider string            `hcl:"provider,optional"`
+	Path     string            `hcl:"path,optional"`
+	Config   map[string]any    `hcl:"config,block"`
+	Env      map[string]string `hcl:"env,block"`
 }
 
 func (s *Secret) Canonicalize() {
 	if len(s.Config) == 0 {
 		s.Config = nil
 	}
+
+	if len(s.Env) == 0 {
+		s.Env = nil
+	}
 }
 
 // NewTask creates and initializes a new Task.

api/tasks_test.go

@@ -514,6 +514,7 @@ func TestTask_Canonicalize_Secret(t *testing.T) {
 		Provider: "test-provider",
 		Path:     "/test/path",
 		Config:   make(map[string]any),
+		Env:      make(map[string]string),
 	}
 
 	expected := &Secret{
@@ -521,6 +522,7 @@ func TestTask_Canonicalize_Secret(t *testing.T) {
 		Provider: "test-provider",
 		Path:     "/test/path",
 		Config:   nil,
+		Env:      nil,
 	}
 
 	testSecret.Canonicalize()