Two Paths to Credential Rotation

// Must write an entire new Vault plugin
package sonarqubeplugin

// ─ New plugin binary to register with Vault
func Factory(ctx context.Context,
    conf *backend.BackendConfig) (logical.Backend, error) {
    b := &backend{}
    b.Backend = &framework.Backend{
        Paths:       b.paths(),
        BackendType: logical.TypeLogical,
    }
    return b, b.Setup(ctx, conf)
}

// ─ Implement config, roles, creds paths
func (b *backend) paths() []*framework.Path {
    return []*framework.Path{
        b.pathConfig(),
        b.pathRoles(),
        b.pathCredsRead(), // rotation logic here
    }
}

// ─ Write rotation logic (SonarQube-specific)
// ─ Write revocation logic
// ─ Register SHA256-pinned binary with Vault
// ─ Write tests, handle Vault SDK lifecycle

// Only write a new adapter — plugin unchanged
package sonarqube

// ─ Implement the Adapter interface (3 methods)
type Adapter struct {
    baseURL    string
    adminToken string
    httpClient *http.Client
}

func (a *Adapter) Rotate(
    ctx context.Context,
    req adapter.RotateRequest,
) (adapter.Result, error) {
    // call SonarQube API, return encrypted result
}

func (a *Adapter) Revoke(
    ctx context.Context,
    req adapter.RevokeRequest,
) error { /* revoke token */ }

func (a *Adapter) Status(
    ctx context.Context,
    credentialID string,
) (adapter.CredentialStatus, error) { /* check */ }

func (a *Adapter) Name() string { return "sonarqube" }

// ─ Register in main.go: reg.Register(sonarqube.New(cfg))
// ─ No Vault plugin changes. No binary re-registration.