I'm setting up Vault to store secrets. SSH backend with OTP auth looks like a good way to stop managing SSH keys for access.
I have SSH backend working, and am looking at hooking up Jenkins with the SSH-OTP auth so that I can remove the deployment keys too.
I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault.
Are there plugins or any Jenkins hacks for this purpose, or if not, is it possible to write one of my own?
Note: Right now, Jenkins uses SSH keys. I want to eliminate the use of keys, and configure Jenkins to get an SSH OTP from Vault every time it needs to SSH into some host for a deploy.