From 24aafb0b696e36d48be4b89bffd70502fcaf105f Mon Sep 17 00:00:00 2001
From: Kevin Stiehl <kevin.stiehl@numericas.de>
Date: Mon, 26 Oct 2020 14:20:04 +0100
Subject: [PATCH] add vaultSecretFileReferences (#2203)

* add vaultSecretFileReferences

* fix test

* fix test

* go generate

* remove code duplication

Co-authored-by: Christopher Fenner <26137398+CCFenner@users.noreply.github.com>
---
 cmd/abapAddonAssemblyKitCheckCVs_generated.go |   1 +
 cmd/abapAddonAssemblyKitCheckPV_generated.go  |   1 +
 ...AssemblyKitCreateTargetVector_generated.go |   1 +
 ...ssemblyKitPublishTargetVector_generated.go |   1 +
 ...onAssemblyKitRegisterPackages_generated.go |   1 +
 ...donAssemblyKitReleasePackages_generated.go |   1 +
 ...ssemblyKitReserveNextPackages_generated.go |   1 +
 ...apEnvironmentAssemblePackages_generated.go |   1 +
 ...abapEnvironmentCheckoutBranch_generated.go |   1 +
 cmd/abapEnvironmentCloneGitRepo_generated.go  |   1 +
 cmd/abapEnvironmentPullGitRepo_generated.go   |   1 +
 cmd/abapEnvironmentRunATCCheck_generated.go   |   1 +
 cmd/artifactPrepareVersion_generated.go       |   1 +
 cmd/checkmarxExecuteScan_generated.go         |   1 +
 cmd/cloudFoundryCreateServiceKey_generated.go |   1 +
 cmd/cloudFoundryCreateService_generated.go    |   1 +
 cmd/cloudFoundryCreateSpace_generated.go      |   1 +
 cmd/cloudFoundryDeleteService_generated.go    |   1 +
 cmd/cloudFoundryDeleteSpace_generated.go      |   1 +
 cmd/cloudFoundryDeploy_generated.go           |   1 +
 cmd/containerSaveImage_generated.go           |   1 +
 cmd/detectExecuteScan_generated.go            |   1 +
 cmd/fortifyExecuteScan_generated.go           |   1 +
 cmd/gctsCloneRepository_generated.go          |   1 +
 cmd/gctsCreateRepository_generated.go         |   1 +
 cmd/gctsDeploy_generated.go                   |   1 +
 cmd/gctsExecuteABAPUnitTests_generated.go     |   1 +
 cmd/gctsRollback_generated.go                 |   1 +
 cmd/githubCheckBranchProtection_generated.go  |   1 +
 cmd/githubCreatePullRequest_generated.go      |   1 +
 cmd/githubPublishRelease_generated.go         |   1 +
 cmd/githubSetCommitStatus_generated.go        |   1 +
 cmd/gitopsUpdateDeployment_generated.go       |   1 +
 cmd/jsonApplyPatch_generated.go               |   1 +
 cmd/kanikoExecute_generated.go                |   1 +
 cmd/karmaExecuteTests_generated.go            |   1 +
 cmd/kubernetesDeploy_generated.go             |   1 +
 cmd/malwareExecuteScan_generated.go           |   1 +
 cmd/mavenBuild_generated.go                   |   1 +
 cmd/mavenExecuteIntegration_generated.go      |   1 +
 cmd/mavenExecuteStaticCodeChecks_generated.go |   1 +
 cmd/mavenExecute_generated.go                 |   1 +
 cmd/mtaBuild_generated.go                     |   1 +
 cmd/nexusUpload_generated.go                  |   1 +
 cmd/npmExecuteLint_generated.go               |   1 +
 cmd/npmExecuteScripts_generated.go            |   1 +
 cmd/protecodeExecuteScan_generated.go         |   1 +
 cmd/sonarExecuteScan_generated.go             |   1 +
 cmd/whitesourceExecuteScan_generated.go       |   1 +
 cmd/xsDeploy_generated.go                     |   1 +
 pkg/config/config.go                          |   2 +-
 pkg/config/vault.go                           | 110 +++++++++++++-----
 pkg/config/vault_test.go                      |  58 +++++++--
 pkg/generator/helper/helper.go                |   1 +
 .../custom_step_code_generated.golden         |   1 +
 .../step_code_generated.golden                |   1 +
 56 files changed, 185 insertions(+), 38 deletions(-)

diff --git a/cmd/abapAddonAssemblyKitCheckCVs_generated.go b/cmd/abapAddonAssemblyKitCheckCVs_generated.go
index f98fc8f06..04db9b30c 100644
--- a/cmd/abapAddonAssemblyKitCheckCVs_generated.go
+++ b/cmd/abapAddonAssemblyKitCheckCVs_generated.go
@@ -93,6 +93,7 @@ It resolves the dotted version string into version, support package level and pa
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapAddonAssemblyKitCheckPV_generated.go b/cmd/abapAddonAssemblyKitCheckPV_generated.go
index affa2df7a..ecb52d103 100644
--- a/cmd/abapAddonAssemblyKitCheckPV_generated.go
+++ b/cmd/abapAddonAssemblyKitCheckPV_generated.go
@@ -93,6 +93,7 @@ It resolves the dotted version string into version, support package stack level
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go b/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go
index 0cb3b88bf..d246802bb 100644
--- a/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go
+++ b/cmd/abapAddonAssemblyKitCreateTargetVector_generated.go
@@ -93,6 +93,7 @@ The Target Vector describes the software state, which shall be reached in the ma
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go b/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go
index 8f6a35cb8..6add0addd 100644
--- a/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go
+++ b/cmd/abapAddonAssemblyKitPublishTargetVector_generated.go
@@ -62,6 +62,7 @@ With targetVectorScope "T" the Target Vector will be published to the test envir
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/abapAddonAssemblyKitRegisterPackages_generated.go b/cmd/abapAddonAssemblyKitRegisterPackages_generated.go
index 81a0756cc..a752d0f89 100644
--- a/cmd/abapAddonAssemblyKitRegisterPackages_generated.go
+++ b/cmd/abapAddonAssemblyKitRegisterPackages_generated.go
@@ -94,6 +94,7 @@ The new status "L"ocked is written back to the addonDescriptor in the commonPipe
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapAddonAssemblyKitReleasePackages_generated.go b/cmd/abapAddonAssemblyKitReleasePackages_generated.go
index 03c1a2441..513708157 100644
--- a/cmd/abapAddonAssemblyKitReleasePackages_generated.go
+++ b/cmd/abapAddonAssemblyKitReleasePackages_generated.go
@@ -91,6 +91,7 @@ store. The new status "R"eleased is written back to the addonDescriptor in the c
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go b/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go
index b6e5945df..3ed724399 100644
--- a/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go
+++ b/cmd/abapAddonAssemblyKitReserveNextPackages_generated.go
@@ -96,6 +96,7 @@ The name, type and namespace of each package is written back to the addonDescrip
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapEnvironmentAssemblePackages_generated.go b/cmd/abapEnvironmentAssemblePackages_generated.go
index 05d4be95b..46e8c45db 100644
--- a/cmd/abapEnvironmentAssemblePackages_generated.go
+++ b/cmd/abapEnvironmentAssemblePackages_generated.go
@@ -98,6 +98,7 @@ Platform ABAP Environment system and saves the corresponding [SAR archive](https
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/abapEnvironmentCheckoutBranch_generated.go b/cmd/abapEnvironmentCheckoutBranch_generated.go
index 24db088f4..171e9dd2f 100644
--- a/cmd/abapEnvironmentCheckoutBranch_generated.go
+++ b/cmd/abapEnvironmentCheckoutBranch_generated.go
@@ -72,6 +72,7 @@ Please provide either of the following options:
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/abapEnvironmentCloneGitRepo_generated.go b/cmd/abapEnvironmentCloneGitRepo_generated.go
index d31ec018a..2a6636357 100644
--- a/cmd/abapEnvironmentCloneGitRepo_generated.go
+++ b/cmd/abapEnvironmentCloneGitRepo_generated.go
@@ -72,6 +72,7 @@ Please provide either of the following options:
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/abapEnvironmentPullGitRepo_generated.go b/cmd/abapEnvironmentPullGitRepo_generated.go
index f14ad78e1..9f4d9b753 100644
--- a/cmd/abapEnvironmentPullGitRepo_generated.go
+++ b/cmd/abapEnvironmentPullGitRepo_generated.go
@@ -71,6 +71,7 @@ Please provide either of the following options:
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/abapEnvironmentRunATCCheck_generated.go b/cmd/abapEnvironmentRunATCCheck_generated.go
index b09831a44..1b3ab2c73 100644
--- a/cmd/abapEnvironmentRunATCCheck_generated.go
+++ b/cmd/abapEnvironmentRunATCCheck_generated.go
@@ -73,6 +73,7 @@ Regardless of the option you chose, please make sure to provide the configuratio
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/artifactPrepareVersion_generated.go b/cmd/artifactPrepareVersion_generated.go
index a43ec02e1..e29cd0c94 100644
--- a/cmd/artifactPrepareVersion_generated.go
+++ b/cmd/artifactPrepareVersion_generated.go
@@ -173,6 +173,7 @@ Define ` + "`" + `buildTool: custom` + "`" + `, ` + "`" + `filePath: <path to yo
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/checkmarxExecuteScan_generated.go b/cmd/checkmarxExecuteScan_generated.go
index 718360a76..ad72230d1 100644
--- a/cmd/checkmarxExecuteScan_generated.go
+++ b/cmd/checkmarxExecuteScan_generated.go
@@ -209,6 +209,7 @@ thresholds instead of ` + "`" + `percentage` + "`" + ` whereas we strongly recom
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				influx.persist(GeneralConfig.EnvRootPath, "influx")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/cloudFoundryCreateServiceKey_generated.go b/cmd/cloudFoundryCreateServiceKey_generated.go
index ab2b366e2..d25b94d3b 100644
--- a/cmd/cloudFoundryCreateServiceKey_generated.go
+++ b/cmd/cloudFoundryCreateServiceKey_generated.go
@@ -64,6 +64,7 @@ func CloudFoundryCreateServiceKeyCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/cloudFoundryCreateService_generated.go b/cmd/cloudFoundryCreateService_generated.go
index 26b0cda58..207934e4f 100644
--- a/cmd/cloudFoundryCreateService_generated.go
+++ b/cmd/cloudFoundryCreateService_generated.go
@@ -76,6 +76,7 @@ Please provide either of the following options:
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/cloudFoundryCreateSpace_generated.go b/cmd/cloudFoundryCreateSpace_generated.go
index 053cd8747..6bca8a4d0 100644
--- a/cmd/cloudFoundryCreateSpace_generated.go
+++ b/cmd/cloudFoundryCreateSpace_generated.go
@@ -63,6 +63,7 @@ Mandatory:
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/cloudFoundryDeleteService_generated.go b/cmd/cloudFoundryDeleteService_generated.go
index f65daffdf..f99ea40f3 100644
--- a/cmd/cloudFoundryDeleteService_generated.go
+++ b/cmd/cloudFoundryDeleteService_generated.go
@@ -63,6 +63,7 @@ func CloudFoundryDeleteServiceCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/cloudFoundryDeleteSpace_generated.go b/cmd/cloudFoundryDeleteSpace_generated.go
index 6770e927e..675a17fd4 100644
--- a/cmd/cloudFoundryDeleteSpace_generated.go
+++ b/cmd/cloudFoundryDeleteSpace_generated.go
@@ -63,6 +63,7 @@ Mandatory:
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/cloudFoundryDeploy_generated.go b/cmd/cloudFoundryDeploy_generated.go
index 9f49e0da5..c542b4523 100644
--- a/cmd/cloudFoundryDeploy_generated.go
+++ b/cmd/cloudFoundryDeploy_generated.go
@@ -136,6 +136,7 @@ func CloudFoundryDeployCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				influx.persist(GeneralConfig.EnvRootPath, "influx")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/containerSaveImage_generated.go b/cmd/containerSaveImage_generated.go
index a20a7d9ae..c40b39c84 100644
--- a/cmd/containerSaveImage_generated.go
+++ b/cmd/containerSaveImage_generated.go
@@ -60,6 +60,7 @@ It can be used no matter if a Docker daemon is available or not. It will also wo
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/detectExecuteScan_generated.go b/cmd/detectExecuteScan_generated.go
index f7aa9a88b..d1b62c6af 100644
--- a/cmd/detectExecuteScan_generated.go
+++ b/cmd/detectExecuteScan_generated.go
@@ -71,6 +71,7 @@ Please configure your BlackDuck server Url using the serverUrl parameter and the
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/fortifyExecuteScan_generated.go b/cmd/fortifyExecuteScan_generated.go
index b5881aa87..4fe986a05 100644
--- a/cmd/fortifyExecuteScan_generated.go
+++ b/cmd/fortifyExecuteScan_generated.go
@@ -170,6 +170,7 @@ DISCLAIMER: The step has not yet been tested on a wide variaty of projects, and
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				influx.persist(GeneralConfig.EnvRootPath, "influx")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/gctsCloneRepository_generated.go b/cmd/gctsCloneRepository_generated.go
index 99b2c4db9..da331a101 100644
--- a/cmd/gctsCloneRepository_generated.go
+++ b/cmd/gctsCloneRepository_generated.go
@@ -61,6 +61,7 @@ func GctsCloneRepositoryCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/gctsCreateRepository_generated.go b/cmd/gctsCreateRepository_generated.go
index 615375417..de3c61684 100644
--- a/cmd/gctsCreateRepository_generated.go
+++ b/cmd/gctsCreateRepository_generated.go
@@ -65,6 +65,7 @@ func GctsCreateRepositoryCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/gctsDeploy_generated.go b/cmd/gctsDeploy_generated.go
index 1b57b95c3..6f96d09ff 100644
--- a/cmd/gctsDeploy_generated.go
+++ b/cmd/gctsDeploy_generated.go
@@ -62,6 +62,7 @@ func GctsDeployCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/gctsExecuteABAPUnitTests_generated.go b/cmd/gctsExecuteABAPUnitTests_generated.go
index 7454eadac..8625ce874 100644
--- a/cmd/gctsExecuteABAPUnitTests_generated.go
+++ b/cmd/gctsExecuteABAPUnitTests_generated.go
@@ -61,6 +61,7 @@ func GctsExecuteABAPUnitTestsCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/gctsRollback_generated.go b/cmd/gctsRollback_generated.go
index 8dd603265..a6468a6e5 100644
--- a/cmd/gctsRollback_generated.go
+++ b/cmd/gctsRollback_generated.go
@@ -66,6 +66,7 @@ gctsRollback will rollback to the previously active commit in the local reposito
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/githubCheckBranchProtection_generated.go b/cmd/githubCheckBranchProtection_generated.go
index 1bd738e56..72ca7f5aa 100644
--- a/cmd/githubCheckBranchProtection_generated.go
+++ b/cmd/githubCheckBranchProtection_generated.go
@@ -65,6 +65,7 @@ It can for example be used to verify if certain status checks are mandatory. Thi
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/githubCreatePullRequest_generated.go b/cmd/githubCreatePullRequest_generated.go
index 9d2522179..a5623098e 100644
--- a/cmd/githubCreatePullRequest_generated.go
+++ b/cmd/githubCreatePullRequest_generated.go
@@ -68,6 +68,7 @@ It can for example be used for GitOps scenarios or for scenarios where you want
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/githubPublishRelease_generated.go b/cmd/githubPublishRelease_generated.go
index 8c5b2cee5..d1960696f 100644
--- a/cmd/githubPublishRelease_generated.go
+++ b/cmd/githubPublishRelease_generated.go
@@ -79,6 +79,7 @@ The result looks like
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/githubSetCommitStatus_generated.go b/cmd/githubSetCommitStatus_generated.go
index fd3435502..07922f3e8 100644
--- a/cmd/githubSetCommitStatus_generated.go
+++ b/cmd/githubSetCommitStatus_generated.go
@@ -73,6 +73,7 @@ It can for example be used to create additional check indicators for a pull requ
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/gitopsUpdateDeployment_generated.go b/cmd/gitopsUpdateDeployment_generated.go
index bb08887c4..a1c24aecb 100644
--- a/cmd/gitopsUpdateDeployment_generated.go
+++ b/cmd/gitopsUpdateDeployment_generated.go
@@ -69,6 +69,7 @@ As of today, it supports the update of deployment yaml files via kubectl patch.
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/jsonApplyPatch_generated.go b/cmd/jsonApplyPatch_generated.go
index 44d1376d9..a0f4237de 100644
--- a/cmd/jsonApplyPatch_generated.go
+++ b/cmd/jsonApplyPatch_generated.go
@@ -58,6 +58,7 @@ This step can, e.g., be used if there is a json schema which needs to be patched
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/kanikoExecute_generated.go b/cmd/kanikoExecute_generated.go
index a5542c3cc..cb74cf817 100644
--- a/cmd/kanikoExecute_generated.go
+++ b/cmd/kanikoExecute_generated.go
@@ -98,6 +98,7 @@ func KanikoExecuteCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/karmaExecuteTests_generated.go b/cmd/karmaExecuteTests_generated.go
index 11ecf81ea..4e924f7d8 100644
--- a/cmd/karmaExecuteTests_generated.go
+++ b/cmd/karmaExecuteTests_generated.go
@@ -67,6 +67,7 @@ In the Docker network, the containers can be referenced by the values provided i
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/kubernetesDeploy_generated.go b/cmd/kubernetesDeploy_generated.go
index f6c9f5080..1b837f649 100644
--- a/cmd/kubernetesDeploy_generated.go
+++ b/cmd/kubernetesDeploy_generated.go
@@ -95,6 +95,7 @@ helm upgrade <deploymentName> <chartPath> --install --force --namespace <namespa
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/malwareExecuteScan_generated.go b/cmd/malwareExecuteScan_generated.go
index ae7402303..5407cafc6 100644
--- a/cmd/malwareExecuteScan_generated.go
+++ b/cmd/malwareExecuteScan_generated.go
@@ -61,6 +61,7 @@ func MalwareExecuteScanCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/mavenBuild_generated.go b/cmd/mavenBuild_generated.go
index ec6d54554..b6cc2a1f5 100644
--- a/cmd/mavenBuild_generated.go
+++ b/cmd/mavenBuild_generated.go
@@ -63,6 +63,7 @@ supports ci friendly versioning by flattening the pom before installing.`,
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/mavenExecuteIntegration_generated.go b/cmd/mavenExecuteIntegration_generated.go
index 905816c49..1b99c6778 100644
--- a/cmd/mavenExecuteIntegration_generated.go
+++ b/cmd/mavenExecuteIntegration_generated.go
@@ -62,6 +62,7 @@ the integration tests via the Jacoco Maven-plugin.`,
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/mavenExecuteStaticCodeChecks_generated.go b/cmd/mavenExecuteStaticCodeChecks_generated.go
index cbd2f69b0..a004550f2 100644
--- a/cmd/mavenExecuteStaticCodeChecks_generated.go
+++ b/cmd/mavenExecuteStaticCodeChecks_generated.go
@@ -73,6 +73,7 @@ For PMD the failure priority and the max allowed violations are configurable via
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/mavenExecute_generated.go b/cmd/mavenExecute_generated.go
index cc7fb9c65..b2aa561b7 100644
--- a/cmd/mavenExecute_generated.go
+++ b/cmd/mavenExecute_generated.go
@@ -63,6 +63,7 @@ func MavenExecuteCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/mtaBuild_generated.go b/cmd/mtaBuild_generated.go
index dc84009e3..4b0e94a50 100644
--- a/cmd/mtaBuild_generated.go
+++ b/cmd/mtaBuild_generated.go
@@ -95,6 +95,7 @@ func MtaBuildCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/nexusUpload_generated.go b/cmd/nexusUpload_generated.go
index 146009c2e..8a9dd672d 100644
--- a/cmd/nexusUpload_generated.go
+++ b/cmd/nexusUpload_generated.go
@@ -83,6 +83,7 @@ If an image for mavenExecute is configured, and npm packages are to be published
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/npmExecuteLint_generated.go b/cmd/npmExecuteLint_generated.go
index 3d2a36276..3a5840458 100644
--- a/cmd/npmExecuteLint_generated.go
+++ b/cmd/npmExecuteLint_generated.go
@@ -57,6 +57,7 @@ either use ESLint configurations present in the project or use the provided gene
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/npmExecuteScripts_generated.go b/cmd/npmExecuteScripts_generated.go
index 183dfe4e0..3f097aa7d 100644
--- a/cmd/npmExecuteScripts_generated.go
+++ b/cmd/npmExecuteScripts_generated.go
@@ -60,6 +60,7 @@ func NpmExecuteScriptsCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/protecodeExecuteScan_generated.go b/cmd/protecodeExecuteScan_generated.go
index 4fa9fbcb0..e095cf3a5 100644
--- a/cmd/protecodeExecuteScan_generated.go
+++ b/cmd/protecodeExecuteScan_generated.go
@@ -124,6 +124,7 @@ func ProtecodeExecuteScanCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				influx.persist(GeneralConfig.EnvRootPath, "influx")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/sonarExecuteScan_generated.go b/cmd/sonarExecuteScan_generated.go
index 3e5b0f3d8..df7f90cf9 100644
--- a/cmd/sonarExecuteScan_generated.go
+++ b/cmd/sonarExecuteScan_generated.go
@@ -117,6 +117,7 @@ func SonarExecuteScanCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				influx.persist(GeneralConfig.EnvRootPath, "influx")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/cmd/whitesourceExecuteScan_generated.go b/cmd/whitesourceExecuteScan_generated.go
index 6b813baed..7cb6b099a 100644
--- a/cmd/whitesourceExecuteScan_generated.go
+++ b/cmd/whitesourceExecuteScan_generated.go
@@ -107,6 +107,7 @@ check and additional Free and Open Source Software Publicly Known Vulnerabilitie
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
 				telemetry.Send(&telemetryData)
diff --git a/cmd/xsDeploy_generated.go b/cmd/xsDeploy_generated.go
index 60ad72b40..3fe58f6cc 100644
--- a/cmd/xsDeploy_generated.go
+++ b/cmd/xsDeploy_generated.go
@@ -98,6 +98,7 @@ func XsDeployCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
 				telemetryData.ErrorCategory = log.GetErrorCategory().String()
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 53be22440..ad91b26bb 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -234,7 +234,7 @@ func (c *Config) GetStepConfig(flagValues map[string]interface{}, paramJSON stri
 		return StepConfig{}, err
 	}
 	if vaultClient != nil {
-		addVaultCredentials(&stepConfig, vaultClient, parameters)
+		resolveAllVaultReferences(&stepConfig, vaultClient, parameters)
 	}
 
 	// finally do the condition evaluation post processing
diff --git a/pkg/config/vault.go b/pkg/config/vault.go
index 6a6a25012..2c0d4408b 100644
--- a/pkg/config/vault.go
+++ b/pkg/config/vault.go
@@ -1,21 +1,29 @@
 package config
 
 import (
+	"io/ioutil"
+	"os"
+
 	"github.com/SAP/jenkins-library/pkg/config/interpolation"
 	"github.com/SAP/jenkins-library/pkg/log"
 	"github.com/SAP/jenkins-library/pkg/vault"
 	"github.com/hashicorp/vault/api"
 )
 
-var vaultFilter = []string{
-	"vaultAppRoleID",
-	"vaultAppRoleSecreId",
-	"vaultServerUrl",
-	"vaultNamespace",
-	"vaultBasePath",
-	"vaultPipelineName",
-	"vaultPath",
-}
+var (
+	vaultFilter = []string{
+		"vaultAppRoleID",
+		"vaultAppRoleSecreId",
+		"vaultServerUrl",
+		"vaultNamespace",
+		"vaultBasePath",
+		"vaultPipelineName",
+		"vaultPath",
+	}
+
+	// VaultSecretFileDirectory holds the directory for the current step run to temporarily store secret files fetched from vault
+	VaultSecretFileDirectory = ""
+)
 
 // VaultCredentials hold all the auth information needed to fetch configuration from vault
 type VaultCredentials struct {
@@ -51,37 +59,79 @@ func getVaultClientFromConfig(config StepConfig, creds VaultCredentials) (vaultC
 	return &client, nil
 }
 
-func addVaultCredentials(config *StepConfig, client vaultClient, params []StepParameters) {
+func resolveAllVaultReferences(config *StepConfig, client vaultClient, params []StepParameters) {
 	for _, param := range params {
 		// we don't overwrite secrets that have already been set in any way
 		if _, ok := config.Config[param.Name].(string); ok {
 			continue
 		}
-		ref := param.GetReference("vaultSecret")
-		if ref == nil {
-			continue
+		if ref := param.GetReference("vaultSecret"); ref != nil {
+			resolveVaultReference(ref, config, client, param)
 		}
-		var secretValue *string
-		for _, vaultPath := range ref.Paths {
-			// it should be possible to configure the root path were the secret is stored
-			vaultPath, ok := interpolation.ResolveString(vaultPath, config.Config)
-			if !ok {
-				continue
-			}
-
-			secretValue = lookupPath(client, vaultPath, &param)
-			if secretValue != nil {
-				config.Config[param.Name] = *secretValue
-				log.Entry().Infof("Resolved param '%s' with vault path '%s'", param.Name, vaultPath)
-				break
-			}
-		}
-		if secretValue == nil {
-			log.Entry().Warnf("Could not resolve param '%s' from vault", param.Name)
+		if ref := param.GetReference("vaultSecretFile"); ref != nil {
+			resolveVaultReference(ref, config, client, param)
 		}
 	}
 }
 
+func resolveVaultReference(ref *ResourceReference, config *StepConfig, client vaultClient, param StepParameters) {
+	var secretValue *string
+	for _, vaultPath := range ref.Paths {
+		// it should be possible to configure the root path were the secret is stored
+		vaultPath, ok := interpolation.ResolveString(vaultPath, config.Config)
+		if !ok {
+			continue
+		}
+
+		secretValue = lookupPath(client, vaultPath, &param)
+		if secretValue != nil {
+			log.Entry().Infof("Resolved param '%s' with vault path '%s'", param.Name, vaultPath)
+			if ref.Type == "vaultSecret" {
+				config.Config[param.Name] = *secretValue
+			} else if ref.Type == "vaultSecretFile" {
+				filePath, err := createTemporarySecretFile(param.Name, *secretValue)
+				if err != nil {
+					log.Entry().WithError(err).Warnf("Couldn't create temporary secret file for '%s'", param.Name)
+					return
+				}
+				config.Config[param.Name] = filePath
+			}
+			break
+		}
+	}
+	if secretValue == nil {
+		log.Entry().Warnf("Could not resolve param '%s' from vault", param.Name)
+	}
+}
+
+// RemoveVaultSecretFiles removes all secret files that have been created during execution
+func RemoveVaultSecretFiles() {
+	if VaultSecretFileDirectory != "" {
+		os.RemoveAll(VaultSecretFileDirectory)
+	}
+}
+
+func createTemporarySecretFile(namePattern string, content string) (string, error) {
+	if VaultSecretFileDirectory == "" {
+		var err error
+		VaultSecretFileDirectory, err = ioutil.TempDir("", "vault")
+		if err != nil {
+			return "", err
+		}
+	}
+
+	file, err := ioutil.TempFile(VaultSecretFileDirectory, namePattern)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	_, err = file.WriteString(content)
+	if err != nil {
+		return "", err
+	}
+	return file.Name(), nil
+}
+
 func lookupPath(client vaultClient, path string, param *StepParameters) *string {
 	log.Entry().Infof("Trying to resolve vault parameter '%s' at '%s'", param.Name, path)
 	secret, err := client.GetKvSecret(path)
diff --git a/pkg/config/vault_test.go b/pkg/config/vault_test.go
index 34c22fd59..07b32645d 100644
--- a/pkg/config/vault_test.go
+++ b/pkg/config/vault_test.go
@@ -2,6 +2,8 @@ package config
 
 import (
 	"fmt"
+	"io/ioutil"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/mock"
@@ -22,7 +24,7 @@ func TestVaultConfigLoad(t *testing.T) {
 		vaultData := map[string]string{secretName: "value1"}
 
 		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(vaultData, nil)
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 		assert.Equal(t, "value1", stepConfig.Config[secretName])
 	})
 
@@ -35,7 +37,7 @@ func TestVaultConfigLoad(t *testing.T) {
 		stepParams := []StepParameters{stepParam(secretName, "vaultSecret", "$(vaultBasePath)/pipelineA")}
 		vaultData := map[string]string{secretName: "value1"}
 		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(vaultData, nil)
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 
 		assert.Equal(t, "preset value", stepConfig.Config[secretName])
 	})
@@ -47,7 +49,7 @@ func TestVaultConfigLoad(t *testing.T) {
 		}}
 		stepParams := []StepParameters{stepParam(secretName, "vaultSecret", "$(vaultBasePath)/pipelineA")}
 		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(nil, fmt.Errorf("test"))
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 		assert.Len(t, stepConfig.Config, 1)
 	})
 
@@ -58,7 +60,7 @@ func TestVaultConfigLoad(t *testing.T) {
 		}}
 		stepParams := []StepParameters{stepParam(secretName, "vaultSecret", "$(vaultBasePath)/pipelineA")}
 		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(nil, nil)
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 		assert.Len(t, stepConfig.Config, 1)
 	})
 
@@ -73,7 +75,7 @@ func TestVaultConfigLoad(t *testing.T) {
 		vaultData := map[string]string{secretName: "value1"}
 		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(nil, nil)
 		vaultMock.On("GetKvSecret", "team1/pipelineB").Return(vaultData, nil)
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 		assert.Equal(t, "value1", stepConfig.Config[secretName])
 	})
 
@@ -87,7 +89,7 @@ func TestVaultConfigLoad(t *testing.T) {
 		}
 		vaultData := map[string]string{secretName: "value1"}
 		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(vaultData, nil)
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 		assert.Equal(t, "value1", stepConfig.Config[secretName])
 		vaultMock.AssertNotCalled(t, "GetKvSecret", "team1/pipelineB")
 	})
@@ -96,12 +98,54 @@ func TestVaultConfigLoad(t *testing.T) {
 		vaultMock := &mocks.VaultMock{}
 		stepConfig := StepConfig{Config: map[string]interface{}{}}
 		stepParams := []StepParameters{stepParam(secretName, "vaultSecret", "$(vaultBasePath)/pipelineA")}
-		addVaultCredentials(&stepConfig, vaultMock, stepParams)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
 		assert.Equal(t, nil, stepConfig.Config[secretName])
 		vaultMock.AssertNotCalled(t, "GetKvSecret", mock.AnythingOfType("string"))
 	})
 }
 
+func TestVaultSecretFiles(t *testing.T) {
+	const secretName = "testSecret"
+	t.Run("Test Vault Secret File Reference", func(t *testing.T) {
+		vaultMock := &mocks.VaultMock{}
+		stepConfig := StepConfig{Config: map[string]interface{}{
+			"vaultPath": "team1",
+		}}
+		stepParams := []StepParameters{stepParam(secretName, "vaultSecretFile", "$(vaultPath)/pipelineA")}
+		vaultData := map[string]string{secretName: "value1"}
+		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(vaultData, nil)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
+		assert.NotNil(t, stepConfig.Config[secretName])
+		path := stepConfig.Config[secretName].(string)
+		contentByte, err := ioutil.ReadFile(path)
+		assert.NoError(t, err)
+		content := string(contentByte)
+		assert.Equal(t, content, "value1")
+	})
+
+	os.RemoveAll(VaultSecretFileDirectory)
+	VaultSecretFileDirectory = ""
+
+	t.Run("Test temporary secret file cleanup", func(t *testing.T) {
+		vaultMock := &mocks.VaultMock{}
+		stepConfig := StepConfig{Config: map[string]interface{}{
+			"vaultPath": "team1",
+		}}
+		stepParams := []StepParameters{stepParam(secretName, "vaultSecretFile", "$(vaultPath)/pipelineA")}
+		vaultData := map[string]string{secretName: "value1"}
+		assert.NoDirExists(t, VaultSecretFileDirectory)
+		vaultMock.On("GetKvSecret", "team1/pipelineA").Return(vaultData, nil)
+		resolveAllVaultReferences(&stepConfig, vaultMock, stepParams)
+		assert.NotNil(t, stepConfig.Config[secretName])
+		path := stepConfig.Config[secretName].(string)
+		assert.DirExists(t, VaultSecretFileDirectory)
+		assert.FileExists(t, path)
+		RemoveVaultSecretFiles()
+		assert.NoFileExists(t, path)
+		assert.NoDirExists(t, VaultSecretFileDirectory)
+	})
+}
+
 func stepParam(name string, refType string, refPaths ...string) StepParameters {
 	return StepParameters{
 		Name: name,
diff --git a/pkg/generator/helper/helper.go b/pkg/generator/helper/helper.go
index a46818d3f..a263f1b3a 100644
--- a/pkg/generator/helper/helper.go
+++ b/pkg/generator/helper/helper.go
@@ -114,6 +114,7 @@ func {{.CobraCmdFuncName}}() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				{{- range $notused, $oRes := .OutputResources }}
 				{{ index $oRes "name" }}.persist({{if $.ExportPrefix}}{{ $.ExportPrefix }}.{{end}}GeneralConfig.EnvRootPath, "{{ index $oRes "name" }}"){{ end }}
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
diff --git a/pkg/generator/helper/testdata/TestProcessMetaFiles/custom_step_code_generated.golden b/pkg/generator/helper/testdata/TestProcessMetaFiles/custom_step_code_generated.golden
index 507bdfbc9..ee66801e8 100644
--- a/pkg/generator/helper/testdata/TestProcessMetaFiles/custom_step_code_generated.golden
+++ b/pkg/generator/helper/testdata/TestProcessMetaFiles/custom_step_code_generated.golden
@@ -131,6 +131,7 @@ func TestStepCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(piperOsCmd.GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				influxTest.persist(piperOsCmd.GeneralConfig.EnvRootPath, "influxTest")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())
diff --git a/pkg/generator/helper/testdata/TestProcessMetaFiles/step_code_generated.golden b/pkg/generator/helper/testdata/TestProcessMetaFiles/step_code_generated.golden
index ad0eb3448..0715d9a3c 100644
--- a/pkg/generator/helper/testdata/TestProcessMetaFiles/step_code_generated.golden
+++ b/pkg/generator/helper/testdata/TestProcessMetaFiles/step_code_generated.golden
@@ -130,6 +130,7 @@ func TestStepCommand() *cobra.Command {
 			telemetryData := telemetry.CustomData{}
 			telemetryData.ErrorCode = "1"
 			handler := func() {
+				config.RemoveVaultSecretFiles()
 				commonPipelineEnvironment.persist(GeneralConfig.EnvRootPath, "commonPipelineEnvironment")
 				influxTest.persist(GeneralConfig.EnvRootPath, "influxTest")
 				telemetryData.Duration = fmt.Sprintf("%v", time.Since(startTime).Milliseconds())