A few hour of troubleshooting later and I think it’s safe to conclude the plugin and the vault-operator injection don’t like eachother.
I have now removed the vault-operator annotations and hardcoded the DRONE_SECRET value and managed to get it to work. Note I did also have to add env VAULT_AUTH_MOUNT_POINT and set that to the value the vault.security.banzaicloud.io/vault-path annotation was set to.
This isn’t ideal as I can’t get the DRONE_SECRET from Vault anymore, but it’s better then not being to use Vault integration in the pipelines.
If someone has a way of using both then please let me know.