core/seal: Add Scaleway Key Manager (scalewaykms) auto-unseal seal …

[Dimitriajax]

Description

Adds Scaleway Key Manager (scalewaykms) as an auto-unseal seal type. Wires the scalewaykms wrapper into seal configuration, environment variable mapping, and config parsing tests.

Depends on: go-kms-wrapping release with wrappers/scalewaykms/v2 v2.0.0 and go-kms-wrapping/v2 v2.0.24.

seal "scalewaykms" {
  region     = "fr-par"
  key_id     = "<uuid>"
  project_id = "<uuid>"
  access_key = "..."
  secret_key = "..."
}

go test ./internalshared/configutil/ -count=1

TODO only if you're a HashiCorp employee

• Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch.
  • LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
• Jira: If this change has an associated Jira, it's referenced either in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

  Enables Vault auto-unseal via Scaleway Key Manager for Scaleway deployments. Optional new seal type; existing seal types unchanged.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

  Revert PR is sufficient. No schema or state migrations.

• If applicable, I've documented the impact of any changes to security controls.

  New optional seal backend only. Master key wrapping via Scaleway KMS (go-kms-wrapping). Credentials from seal config or env vars. No new audit/logging pipelines.

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[hashicorp-cla-app]

All committers have signed the CLA.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jul 10, 2026 11:22am