[Feature Request] Support partial updates to database secret backend

[Xopherus]

Feature Request:

For some context, I have a repo which codifies most of the mount configuration in my system - basically roles and secret backend configuration (minus the secrets themselves). That means when someone needs a new secret backend, we'll have to manually mount + configure it. After that if we have to add additional roles or make configuration changes (e.g., change a default_lease_ttl) we can do so via mount tuning or via the secret backend's API.

Per the docs, if I want to set up a database connection via the database secret backend, I must issue a write like so:

vault write database/config/connection plugin_name="mysql-database-plugin" connection_url="user:pass@tcp(host:port)/db"

So for example, if I want to add max_connection_lifetime=10m to the connection, I have to issue this:

vault write database/config/connection plugin_name="mysql-database-plugin" connection_url="user:pass@tcp(host:port)/db" max_connection_lifetime=10m

It would be nice to allow partial updates like this:
vault write database/config/connection max_connection_lifetime=10m

[james-lawrence]

duplicate of #1468

[rwiggins]

Ran into this today. For instance, adding to allowed_roles requires issuing a write with a bunch of details in it. Pretty sure it requires more than just the connection_url and plugin_name to prevent clobbering.

Really frustrating.