HashiCorp Vault with Pipelines?

[Calvin Park]

Is anyone using Vault successfully with Jenkins? I'm an admin for Jenkins which external teams use, and I can't come up with a good workflow.

Currently we're using Jenkins Credential Store (JCS) + folders

    Good: secrets are not shared across folders (teams)

    Bad: 1. Customers can't add secrets without me so I'm a bottleneck

            2. I need to add the secrets so I'm forced to see them

I can solve 1 by storing the Vault key in Jenkins, then have the customers store various secrets in Vault. Is there any way for Jenkins admins to not see the customers' secrets?