opschain admin secrets providers update

Included from Basic tiersecrets:multi-vaultpacks:secrets-awspacks:secrets-azure

Updates a secrets provider by its code or row id. Only the flags you pass change — an untouched field keeps its stored value; the code and kind are immutable. Supplying a credential (--credential-env / --credential-prompt, never argv) rotates the stored one; the rotation is audited without the value.

Enabling a provider (--enabled) while another enabled provider exists is refused with the typed SECRETS_PROVIDER_SINGLE_DEFAULT error (the base platform is single-vault); disabling the enabled default makes secret resolution refuse loudly until a provider is enabled again — it never silently falls back to the dev store. Enabling a disabled cloud-kind provider additionally requires its pack entitlement: packs:secrets-aws for aws-secrets-manager (see opschain docs packs-secrets-aws), packs:secrets-azure for azure-key-vault (see opschain docs packs-secrets-azure).

OPSCHAIN_VAULT_CRED=s.yyyy opschain admin secrets providers update vault --credential-env OPSCHAIN_VAULT_CRED
Updated secrets provider vault

-o, --output json|yaml emits the updated provider document.

--resolution runner moves the locus to the runner and clears the stored credential and reference (the server never holds a way to reach a runner provider); --resolution server on a runner provider needs the credential in the same write (--credential-env/--credential-prompt or --credential-ref).

Reference custody

A secrets provider's own credential may be pinned as a provider-qualified secret-vault://<code>@<path>/<key> reference. The reference must name ANOTHER enabled secrets provider and resolve at write time - a vault cannot custody its own key, so unqualified and self-qualified references refuse by name. An inline credential stays encrypted at rest on the record (vault-write sugar would store the vault's own key inside a vault); records keep their inline credential until a reference is pinned, which clears it.

Flags

Flag	Meaning
--display-name <name>	Human name the GUI renders.
--kv-version <1|2>	KV secrets-engine version.
--address <url>	Vault endpoint URL (azure-key-vault: the vault URL; aws-secrets-manager: an optional endpoint-URL override).
--region <region>	AWS region (aws-secrets-manager kind only).
--tenant-id <guid>	Microsoft Entra ID tenant id (azure-key-vault kind only).
--auth-method <method>	token, userpass or approle (vault kinds); access-key (aws-secrets-manager); client-secret (azure-key-vault).
--username <name>	Userpass username, the IAM access key id (access-key auth), or the Entra ID client id (client-secret auth).
--role-id <id>	AppRole role id (the secret id rides the credential flags).
--credential-ref <ref>	Provider-qualified secret-vault://<code>@<path>/<key> reference to pin - it must name another enabled secrets provider (mutually exclusive with the inline channel).
--credential-prompt	Prompt for the replacement credential without echo.
--mount-path <path>	KV secrets-engine mount path.
--ssl-verify	Verify the vault's TLS certificate.
--ssl-ca-cert <path>	CA certificate file path trusted for the vault connection.
--cipher-stacking	Cipher-stack values written through /api/secrets/store.
--password-length <n>	Length of server-generated secret values (0: the endpoint default).
--enabled	Enable/disable the provider (without secrets:multi-vault: at most one enabled).
--resolution server|runner	Move the resolution locus (see above).
--rate-limit-reads-per-second <n>	Rate budget: KV reads per second. A positive integer sets this provider's own budget; 0 returns the lane to the estate default secrets.default_rate_limit; -1 lifts it (unlimited at this provider even when the estate default is bounded; pass it as --rate-limit-reads-per-second=-1).
--rate-limit-mints-per-minute <n>	Rate budget: vault token mints per minute — the same three values (-1 unlimited, 0 the estate default, n this provider's own budget).
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-secrets-providers-test — verify after a change.