migrate secrets from database to HashiCorp Vault

HashiCorp Vault server address (e.g., https://vault.company.com:8200)

KV v2 secrets engine mount path (e.g., windmill)

Optional path prefix inserted between the KV data/metadata segment and the workspace id (e.g., "apps/windmill"). When set, secrets are stored at <mount>/data/<prefix>/<workspace>/<secret>, allowing a Vault policy scoped to exactly <mount>/data/<prefix>/*.

Vault JWT auth role name for Windmill (optional, if not provided token auth is used)

Mount path for the JWT auth method in Vault (optional, defaults to "jwt"). Set this when the JWT auth method is mounted at a non-default path, e.g. via vault auth enable -path=<mount> jwt.

Vault Enterprise namespace (optional)

Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)

Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.

Total number of secrets found

Number of secrets successfully migrated

Number of secrets that failed to migrate