From 0702676da6296911878f7e948617b9116f37f084 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 16 Jul 2026 22:48:08 +1000 Subject: [PATCH] Install openbao-plugin-secrets-gpg on vault nodes (#480) Deploy the GPG/OpenPGP secrets engine to the OpenBao (vault-role) cluster by installing its plugin RPM into `/opt/openbao-plugins`, mirroring the existing `openbao-plugin-secrets-litellm` deployment (#479). - Add `openbao-plugin-secrets-gpg` to `profiles::packages::include` in the vault role hiera. The RPM ships from artifactapi `rpm-internal` (built on the [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) v0.1.0 tag) and lands the plugin binary in the node's configured `plugin_directory`. Registering + enabling the secrets backend (`plugin register` / `secrets enable`) is a follow-up terraform-vault change, matching how litellm is wired. Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/480 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/storage/vault.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 9af5305..4f716f7 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -29,3 +29,4 @@ profiles::nginx::simpleproxy::proxy_path: '/' profiles::packages::include: openbao-plugins: {} openbao-plugin-secrets-litellm: {} + openbao-plugin-secrets-gpg: {}