util: allow configuring VAULT_BACKEND for Vault connection

It seems that the version of the key/value engine can not always be
detected for Hashicorp Vault. In certain cases, it is required to
configure the `VAULT_BACKEND` (or `vaultBackend`) option so that a
successful connection to the service can be made.

The `kv-v2` is the current default for development deployments of
Hashicorp Vault (what we use for automated testing). Production
deployments default to version 1 for now.

Signed-off-by: Niels de Vos <ndevos@redhat.com>

examples/kms/vault/kms-config.yaml

@@ -9,6 +9,7 @@ data:
         "vaultAddress": "http://vault.default.svc.cluster.local:8200",
         "vaultAuthPath": "/v1/auth/kubernetes/login",
         "vaultRole": "csi-kubernetes",
+        "vaultBackend": "kv-v2",
         "vaultPassphraseRoot": "/v1/secret",
         "vaultPassphrasePath": "ceph-csi/",
         "vaultCAVerify": "false"
@@ -16,6 +17,7 @@ data:
       "vault-tokens-test": {
           "encryptionKMSType": "vaulttokens",
           "vaultAddress": "http://vault.default.svc.cluster.local:8200",
+          "vaultBackend": "kv-v2",
           "vaultBackendPath": "secret/",
           "vaultTLSServerName": "vault.default.svc.cluster.local",
           "vaultCAVerify": "false",
@@ -34,6 +36,7 @@ data:
       "vault-tenant-sa-test": {
           "encryptionKMSType": "vaulttenantsa",
           "vaultAddress": "http://vault.default.svc.cluster.local:8200",
+          "vaultBackend": "kv-v2",
           "vaultBackendPath": "shared-secrets",
           "vaultTLSServerName": "vault.default.svc.cluster.local",
           "vaultCAVerify": "false",

examples/kms/vault/tenant-config.yaml

@@ -7,6 +7,7 @@ metadata:
   name: ceph-csi-kms-config
 data:
   vaultAddress: "http://vault.default.svc.cluster.local:8200"
+  vaultBackend: "kv-v1"
   vaultBackendPath: "secret/"
   vaultTLSServerName: "vault.default.svc.cluster.local"
   vaultCAVerify: "false"

examples/kms/vault/tenant-sa-admin.yaml

@@ -21,7 +21,7 @@ data:
     vault login ${VAULT_DEV_ROOT_TOKEN_ID}
 
     # create a secret store for the tenant
-    vault secrets enable -path="tenant" kv
+    vault secrets enable -version=2 -path="tenant" kv
 
     # create a policy for the tenant
     vault policy write "${TENANT_NAMESPACE}" - << EOS

examples/kms/vault/tenant-sa.yaml

@@ -19,5 +19,6 @@ kind: ConfigMap
 metadata:
   name: ceph-csi-kms-config
 data:
+  vaultBackend: kv-v2
   vaultBackendPath: tenant
   vaultRole: ceph-csi-tenant