unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

vault: install openbao-plugin-secrets-gitea on the storage role
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details

Browse Source 
Why: the new gitea token secrets engine (vault-plugin-secrets-gitea) needs
its plugin binary present on the OpenBao servers before terraform-vault can
register it in the catalog and mount it. This mirrors how the rancher, gpg,
and litellm secrets plugins are installed.

Change:
- Add openbao-plugin-secrets-gitea to profiles::packages::include on the vault
  storage role, pinned to 0.1.0 so the on-disk binary matches the sha256 that
  terraform-vault pins in its plugin catalog entry.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
This commit is contained in:
Ben Vincent
2026-07-27 19:01:22 +10:00
parent 82a5b2ee1a
commit 3ec4783102
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/storage/vault.yaml
+2
View File
@@ -38,3 +38,5 @@ profiles::packages::include:
ensure: '0.1.0'
openbao-plugin-secrets-rancher:
ensure: '0.1.1'
openbao-plugin-secrets-gitea:
ensure: '0.1.0'