From 3ec47831023a65d2ad3c0830a647e142d0d01de6 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 19:01:22 +1000 Subject: [PATCH] vault: install openbao-plugin-secrets-gitea on the storage role Why: the new gitea token secrets engine (vault-plugin-secrets-gitea) needs its plugin binary present on the OpenBao servers before terraform-vault can register it in the catalog and mount it. This mirrors how the rancher, gpg, and litellm secrets plugins are installed. Change: - Add openbao-plugin-secrets-gitea to profiles::packages::include on the vault storage role, pinned to 0.1.0 so the on-disk binary matches the sha256 that terraform-vault pins in its plugin catalog entry. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- hieradata/roles/infra/storage/vault.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 7d6562b..b859480 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -38,3 +38,5 @@ profiles::packages::include: ensure: '0.1.0' openbao-plugin-secrets-rancher: ensure: '0.1.1' + openbao-plugin-secrets-gitea: + ensure: '0.1.0'