From 4230370418fdc96770797d820ea21e2a56516a6f Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 17:01:14 +1000 Subject: [PATCH] Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1) (#488) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The vault nodes have rancher plugin v0.1.0, which mints non-functional tokens (returns `status.value` not `status.bearerToken`; every cred/rotation 401s). v0.1.1 fixes it. `ensure_packages` defaults to `present`, which won't upgrade an already-installed package, so pin to `latest` to pull v0.1.1. ## Changes - `openbao-plugin-secrets-rancher: { ensure: latest }` on the vault storage role. ## Note `latest` will also pull future releases automatically — keep the terraform-vault catalog sha256 (`config/plugins/vault-plugin-secrets-rancher.yaml`) bumped in lockstep, or a vault restart after a future upgrade will fail the sha check. Happy to pin to an exact version instead if you'd prefer lockstep-by-pin. --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/488 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/storage/vault.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 25a7961..06d5df7 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -30,4 +30,5 @@ profiles::packages::include: openbao-plugins: {} openbao-plugin-secrets-litellm: {} openbao-plugin-secrets-gpg: {} - openbao-plugin-secrets-rancher: {} + openbao-plugin-secrets-rancher: + ensure: latest