Add support for external secret vaults (#2479)