From 2a329058c06a286ceeec1232c894b018db4190f6 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 16 Aug 2026 14:47:58 +1000 Subject: [PATCH] vault: install openbao-plugin-secrets-ghp on OpenBao nodes (#520) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: step 1 of adding the ghp Vault secrets engine — the plugin binary must be on the OpenBao nodes before terraform-vault registers it in the catalog (the catalog sha256 pins this exact build). How: pin `openbao-plugin-secrets-ghp` ensure 0.1.0 in hieradata/roles/infra/storage/vault.yaml profiles::packages::include, alongside the other secrets plugins. Ordering: this merges + puppet-applies first; then the config-write policy; then the terraform-vault engine resources (terraform-vault#121). Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/520 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- hieradata/roles/infra/storage/vault.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 37f8fae..ea1fbf2 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -44,3 +44,5 @@ profiles::packages::include: ensure: '0.1.0' openbao-plugin-secrets-netbox: ensure: '0.1.0' + openbao-plugin-secrets-ghp: + ensure: '0.1.0'