vault_token: add pgp_key support

[greut]

The goal is to mimic what has been done for Consul, https://github.com/terraform-providers/terraform-provider-consul/blob/master/consul/data_source_consul_acl_token_secret_id.go

Being able to encrypt the client_token via a GPG (public) key would be really helpful for us.

Let me know when I should start investing energy into acceptance tests and documentation.

Cheers,

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #0000

Release note for CHANGELOG:

vault_token to support PGP encryption of the token

Output from acceptance testing:

$ $ VAULT_ADDR=http://localhost:8200 VAULT_TOKEN=root TF_ACC=1 go test -v ./vault -run TestResourceToken    
=== RUN   TestResourceToken_basic
--- PASS: TestResourceToken_basic (0.12s)
=== RUN   TestResourceToken_import
--- PASS: TestResourceToken_import (0.12s)
=== RUN   TestResourceToken_full
--- PASS: TestResourceToken_full (0.11s)
=== RUN   TestResourceToken_lookup
--- PASS: TestResourceToken_lookup (0.11s)
=== RUN   TestResourceToken_expire
--- PASS: TestResourceToken_expire (10.37s)
=== RUN   TestResourceToken_renew
--- PASS: TestResourceToken_renew (20.36s)
=== RUN   TestResourceToken_pgp
--- PASS: TestResourceToken_pgp (0.59s)
PASS
ok      github.com/terraform-providers/terraform-provider-vault/vault   31.789s

[tyrannosaurus-becks]

This is an interesting PR! We haven't had anything like it before. There's a discussion here about a very similar feature. I'm going to read that through and think about it carefully before I do an initial pass of this PR. Thanks for submitting this!

[tyrannosaurus-becks]

Hi! I had the opportunity to think about this more, and to pull it down and play with it a little. It's very cool! I could see that it does what it intends, of course, encrypting the client token if you point it at a Keybase public key to use.

I was almost tempted to ask that we do this at the provider level for all sensitive fields. But I think for now we'll just give this a spin here and if it become popular, consider moving to that.

Thank you adding this!