Install openbao-plugin-secrets-arrstack v0.1.0 (#521)

## Why

The new `openbao-plugin-secrets-arrstack` OpenBao secrets engine mints dynamic per-service arrproxy machine tokens for the arrstack (Sonarr/Radarr/Prowlarr) fleet. Its v0.1.0 RPM is now published in artifactapi (rpm-internal), so the OpenBao VM nodes can install the plugin binary into `/opt/openbao-plugins`.

## Changes

- Add `openbao-plugin-secrets-arrstack` pinned to `0.1.0` to `profiles::packages::include` in `hieradata/roles/infra/storage/vault.yaml`, matching the existing pinned sibling plugins (litellm, gpg, rancher, gitea, apptoken, netbox, ghp).

This PR only installs the RPM binary on the nodes. Catalog registration is handled separately by terraform-vault (`config/plugins/*.yaml`).

## Reference

Plugin binary sha256 (used by the terraform-vault catalog registration, separate PR):

```
f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972
```

Reviewed-on: #521
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #521.

This commit is contained in:

Unkin Agent

2026-08-18 23:21:44 +10:00

committed by

BenVincent

parent 2a329058c0

commit 7e1f2c336c

1 changed files with 2 additions and 0 deletions

									
										hieradata/roles/infra/storage/vault.yaml
									
		+2
		
												View File
												
				@@ -46,3 +46,5 @@ profiles::packages::include:

				    ensure: '0.1.0'

				  openbao-plugin-secrets-ghp:

				    ensure: '0.1.0'

				  openbao-plugin-secrets-arrstack:

				    ensure: '0.1.0'