community.hashi_vault.hashi_vault lookup plugin getting permission denied constantly

hard to comment on this without knowing what it does

The vault_kv2_get plugins were written specifically for it, as mentioned in the guides it’s much more straightforward to use. However the hashi_vault lookup still works and does auth very similarly. I suspect you have the path wrong.

Is this referring to the vault logs or something else?

The mount_point option in the collection’s plugins is the mount point for the auth method, which doesn’t apply to token auth. I see in your example you’re trying to set it to the secret engine mount point. That won’t work because the hashi_vault lookup is not secret engine aware except implicitly (this is one of the things that make it less than ideal).

If you use vault_kv2_get you can set engine_mount_point (if needed).

In hashi_vault you need to include the engine mount point as part of the path.

You example should probably be:

- name: somename
  debug:
    msg: "Test secret: {{ lookup('community.hashi_vault.hashi_vault', 'secrets/data/path/to/secret:key', token=client_token, url='some_url', validate_certs=false, return_format='values') }} "