vault: install openbao-plugin-secrets-gitea on the storage role (#498)

## Why

The new Gitea token secrets engine (`vault-plugin-secrets-gitea`, released v0.1.0) needs its plugin binary present on the OpenBao servers before terraform-vault can register it in the plugin catalog and mount it. This is the same install step already done for the rancher, gpg, and litellm secrets plugins.

## Change

- Add `openbao-plugin-secrets-gitea` to `profiles::packages::include` on the vault storage role, pinned to `0.1.0` so the on-disk binary stays in lockstep with the sha256 that terraform-vault pins in its plugin catalog entry (`config/plugins/vault-plugin-secrets-gitea.yaml`).

## Order

This is the first step. It must merge (and Puppet must run on the vault nodes to lay down the binary) before the terraform-vault engine PR is applied, or OpenBao cannot launch the plugin.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: #498
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

This commit was merged in pull request #498.

This commit is contained in:

Ben Vincent

2026-07-27 19:07:30 +10:00

committed by

BenVincent

parent 82a5b2ee1a

commit 83f355cef4

1 changed files with 2 additions and 0 deletions

									
										hieradata/roles/infra/storage/vault.yaml
									
		+2
		
												View File
												
				@@ -38,3 +38,5 @@ profiles::packages::include:

				    ensure: '0.1.0'

				  openbao-plugin-secrets-rancher:

				    ensure: '0.1.1'

				  openbao-plugin-secrets-gitea:

				    ensure: '0.1.0'