From edbc507488939b0fbcbc194e4b84dac4304cb0b5 Mon Sep 17 00:00:00 2001
From: Vault Automation <github-team-secure-vault-core@hashicorp.com>
Date: Tue, 3 Feb 2026 10:41:44 -0500
Subject: [PATCH] Backport Add spiffe secrets engine into ce/main (#10648)

---
 helper/builtinplugins/registry_test.go | 2 +-
 helper/pluginconsts/plugin_consts.go   | 1 +
 scripts/gen_openapi.sh                 | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/helper/builtinplugins/registry_test.go b/helper/builtinplugins/registry_test.go
index 67b2e8c703..6e135f53ac 100644
--- a/helper/builtinplugins/registry_test.go
+++ b/helper/builtinplugins/registry_test.go
@@ -110,7 +110,7 @@ func Test_RegistryKeyCounts(t *testing.T) {
 			name:       "number of secrets plugins",
 			pluginType: consts.PluginTypeSecrets,
 			want:       19,
-			entWant:    3,
+			entWant:    4,
 		},
 	}
 	for _, tt := range tests {
diff --git a/helper/pluginconsts/plugin_consts.go b/helper/pluginconsts/plugin_consts.go
index 634841c9ce..96578af147 100644
--- a/helper/pluginconsts/plugin_consts.go
+++ b/helper/pluginconsts/plugin_consts.go
@@ -44,6 +44,7 @@ const (
 	SecretEngineLDAP         = "ldap"
 	SecretEnginePostgresql   = "postgresql"
 	SecretEngineRabbitMQ     = "rabbitmq"
+	SecretEngineSpiffe       = "spiffe"
 	SecretEngineTerraform    = "terraform"
 	SecretEngineTOTP         = "totp"
 	SecretEngineKV           = "kv"
diff --git a/scripts/gen_openapi.sh b/scripts/gen_openapi.sh
index a2b829a285..fc91149009 100755
--- a/scripts/gen_openapi.sh
+++ b/scripts/gen_openapi.sh
@@ -94,6 +94,7 @@ if vault version | grep -q "+ent"; then
     vault secrets enable "keymgmt"
     vault secrets enable "kmip"
     vault secrets enable "transform"
+    vault secrets enable "spiffe"
     vault auth enable "saml"
     vault auth enable "scep"
     vault auth enable "spiffe"