unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1) (#488)

Browse Source 
## Why

The vault nodes have rancher plugin v0.1.0, which mints non-functional tokens (returns `status.value` not `status.bearerToken`; every cred/rotation 401s). v0.1.1 fixes it. `ensure_packages` defaults to `present`, which won't upgrade an already-installed package, so pin to `latest` to pull v0.1.1.

## Changes

- `openbao-plugin-secrets-rancher: { ensure: latest }` on the vault storage role.

## Note

`latest` will also pull future releases automatically — keep the terraform-vault catalog sha256 (`config/plugins/vault-plugin-secrets-rancher.yaml`) bumped in lockstep, or a vault restart after a future upgrade will fail the sha check. Happy to pin to an exact version instead if you'd prefer lockstep-by-pin.

---------

Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #488
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #488.
This commit is contained in:
Ben Vincent
2026-07-18 17:01:14 +10:00
committed by BenVincent
parent 8f49c35c16
commit 4230370418
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/storage/vault.yaml
+2 -1
View File
@@ -30,4 +30,5 @@ profiles::packages::include:
openbao-plugins: {} openbao-plugins: {}
openbao-plugin-secrets-litellm: {} openbao-plugin-secrets-litellm: {}
openbao-plugin-secrets-gpg: {} openbao-plugin-secrets-gpg: {}
openbao-plugin-secrets-rancher: {} openbao-plugin-secrets-rancher:
ensure: latest