unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Install openbao-plugin-secrets-gpg on vault nodes (#480)

Browse Source 
Deploy the GPG/OpenPGP secrets engine to the OpenBao (vault-role) cluster by installing its plugin RPM into `/opt/openbao-plugins`, mirroring the existing `openbao-plugin-secrets-litellm` deployment (#479).

- Add `openbao-plugin-secrets-gpg` to `profiles::packages::include` in the vault role hiera. The RPM ships from artifactapi `rpm-internal` (built on the [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) v0.1.0 tag) and lands the plugin binary in the node's configured `plugin_directory`.

Registering + enabling the secrets backend (`plugin register` / `secrets enable`) is a follow-up terraform-vault change, matching how litellm is wired.

Reviewed-on: #480
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #480.
This commit is contained in:
Ben Vincent
2026-07-16 22:48:08 +10:00
committed by BenVincent
parent 88fcb97ad1
commit 0702676da6
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/storage/vault.yaml
+1
View File
@@ -29,3 +29,4 @@ profiles::nginx::simpleproxy::proxy_path: '/'
profiles::packages::include: profiles::packages::include:
openbao-plugins: {} openbao-plugins: {}
openbao-plugin-secrets-litellm: {} openbao-plugin-secrets-litellm: {}
openbao-plugin-secrets-gpg: {}