feat(vault): add skip_ssl_verify option for HashiCorp Vault (#8791)

* [ee] feat(vault): add skip_ssl_verify option for HashiCorp Vault

Adds an optional skip_ssl_verify boolean to VaultSettings so
self-signed Vault deployments can be used in development without
needing a custom CA bundle. The flag is surfaced as a Toggle in the
HashiCorp Vault section of the secret backend instance settings and
plumbed through to the EE Vault HTTP client builder.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to bcfb663f9e902539abbbf69c517715eb8d4ce8f9

This commit updates the EE repository reference after PR #526 was merged in windmill-ee-private.

Previous ee-repo-ref: 7e1372b8f59fe81aaf61212970ebdf2286be864d

New ee-repo-ref: bcfb663f9e902539abbbf69c517715eb8d4ce8f9

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/ee-repo-ref.txt

@@ -1 +1 @@
-62a462461271b900351c18b0ab1ca78651154b2a
+bcfb663f9e902539abbbf69c517715eb8d4ce8f9

backend/windmill-api/openapi.yaml

@@ -19904,6 +19904,9 @@ components:
         token:
           type: string
           description: Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)
+        skip_ssl_verify:
+          type: boolean
+          description: Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.
 
     AzureKeyVaultSettings:
       type: object

backend/windmill-common/src/secret_backend/mod.rs

@@ -129,6 +129,10 @@ pub struct VaultSettings {
     /// If provided, this is used instead of JWT authentication
     #[serde(skip_serializing_if = "Option::is_none")]
     pub token: Option<String>,
+    /// Skip TLS certificate verification when connecting to Vault
+    /// Only use for self-signed certificates in development environments
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_ssl_verify: Option<bool>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]

backend/windmill-common/src/secret_backend/tests.rs

@@ -28,6 +28,7 @@ mod tests {
             jwt_role: Some("windmill-secrets".to_string()),
             namespace: None,
             token: Some("test-root-token".to_string()),
+            skip_ssl_verify: None,
         }
     }
 

backend/windmill-common/tests/secret_backend_integration.rs

@@ -96,6 +96,7 @@ mod tests {
             token: Some(
                 std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
             ),
+            skip_ssl_verify: None,
         }
     }
 
@@ -108,6 +109,7 @@ mod tests {
             jwt_role: Some("windmill-secrets".to_string()), // JWT mode
             namespace: None,
             token: None, // No static token - use JWT
+            skip_ssl_verify: None,
         }
     }
 

backend/windmill-common/tests/secret_backend_migration.rs

@@ -36,6 +36,7 @@ fn test_vault_settings() -> VaultSettings {
         token: Some(
             std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
         ),
+        skip_ssl_verify: None,
     }
 }
 

frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte

@@ -4,6 +4,7 @@
 	import { SettingService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import TextInput from '../text_input/TextInput.svelte'
+	import Toggle from '../Toggle.svelte'
 	import { Database, Lock, Server, ArrowLeft, ArrowRight, Cloud } from 'lucide-svelte'
 	import type { Writable } from 'svelte/store'
 	import { enterpriseLicense } from '$lib/stores'
@@ -67,7 +68,8 @@
 				mount_path: $values['secret_backend']?.mount_path ?? 'windmill',
 				jwt_role: $values['secret_backend']?.jwt_role ?? 'windmill-secrets',
 				namespace: $values['secret_backend']?.namespace ?? null,
-				token: $values['secret_backend']?.token ?? null
+				token: $values['secret_backend']?.token ?? null,
+				skip_ssl_verify: $values['secret_backend']?.skip_ssl_verify ?? false
 			}
 		} else if (type === 'AzureKeyVault') {
 			$values['secret_backend'] = {
@@ -105,7 +107,8 @@
 			mount_path: $values['secret_backend'].mount_path,
 			jwt_role: $values['secret_backend'].jwt_role,
 			namespace: $values['secret_backend'].namespace || undefined,
-			token: $values['secret_backend'].token || undefined
+			token: $values['secret_backend'].token || undefined,
+			skip_ssl_verify: $values['secret_backend'].skip_ssl_verify || undefined
 		}
 	}
 
@@ -357,6 +360,10 @@ vault write auth/jwt/role/windmill-secrets \
 					<span class="text-2xs text-secondary">Vault Enterprise namespace</span>
 					<TextInput inputProps={{ type: 'text', id: 'vault_namespace', placeholder: 'admin/my-namespace', disabled }} bind:value={$values['secret_backend'].namespace} />
 				</div>
+				<div class="flex flex-col gap-1">
+					<Toggle id="vault_skip_ssl_verify" {disabled} bind:checked={$values['secret_backend'].skip_ssl_verify} size="xs" options={{ right: 'Skip TLS certificate verification' }} />
+					<span class="text-2xs text-secondary">Disables TLS verification when connecting to Vault. Only enable for self-signed certificates in development.</span>
+				</div>
 			</div>
 			<div class="flex flex-col gap-4 pt-4 border-t">
 				<Button unifiedSize="md" variant="accent" onclick={testVaultConnection} disabled={disabled || !isVaultConfigValid() || testingConnection} loading={testingConnection} startIcon={{ icon: Server }}>Test Connection</Button>