From 7e1f2c336ca4ad06c256ef5018fdaa541f8fe9cd Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 18 Aug 2026 23:21:44 +1000 Subject: [PATCH] Install openbao-plugin-secrets-arrstack v0.1.0 (#521) ## Why The new `openbao-plugin-secrets-arrstack` OpenBao secrets engine mints dynamic per-service arrproxy machine tokens for the arrstack (Sonarr/Radarr/Prowlarr) fleet. Its v0.1.0 RPM is now published in artifactapi (rpm-internal), so the OpenBao VM nodes can install the plugin binary into `/opt/openbao-plugins`. ## Changes - Add `openbao-plugin-secrets-arrstack` pinned to `0.1.0` to `profiles::packages::include` in `hieradata/roles/infra/storage/vault.yaml`, matching the existing pinned sibling plugins (litellm, gpg, rancher, gitea, apptoken, netbox, ghp). This PR only installs the RPM binary on the nodes. Catalog registration is handled separately by terraform-vault (`config/plugins/*.yaml`). ## Reference Plugin binary sha256 (used by the terraform-vault catalog registration, separate PR): ``` f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972 ``` Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/521 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- hieradata/roles/infra/storage/vault.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index ea1fbf2..915afbb 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -46,3 +46,5 @@ profiles::packages::include: ensure: '0.1.0' openbao-plugin-secrets-ghp: ensure: '0.1.0' + openbao-plugin-secrets-arrstack: + ensure: '0.1.0'