unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Install openbao-plugin-secrets-arrstack v0.1.0 (#521)

Browse Source 
## Why

The new `openbao-plugin-secrets-arrstack` OpenBao secrets engine mints dynamic per-service arrproxy machine tokens for the arrstack (Sonarr/Radarr/Prowlarr) fleet. Its v0.1.0 RPM is now published in artifactapi (rpm-internal), so the OpenBao VM nodes can install the plugin binary into `/opt/openbao-plugins`.

## Changes

- Add `openbao-plugin-secrets-arrstack` pinned to `0.1.0` to `profiles::packages::include` in `hieradata/roles/infra/storage/vault.yaml`, matching the existing pinned sibling plugins (litellm, gpg, rancher, gitea, apptoken, netbox, ghp).

This PR only installs the RPM binary on the nodes. Catalog registration is handled separately by terraform-vault (`config/plugins/*.yaml`).

## Reference

Plugin binary sha256 (used by the terraform-vault catalog registration, separate PR):

```
f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972
```

Reviewed-on: #521
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #521.
This commit is contained in:
Unkin Agent
2026-08-18 23:21:44 +10:00
committed by BenVincent
parent 2a329058c0
commit 7e1f2c336c
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/storage/vault.yaml
+2
View File
@@ -46,3 +46,5 @@ profiles::packages::include:
ensure: '0.1.0' ensure: '0.1.0'
openbao-plugin-secrets-ghp: openbao-plugin-secrets-ghp:
ensure: '0.1.0' ensure: '0.1.0'
openbao-plugin-secrets-arrstack:
ensure: '0.1.0'