From 83f355cef43bbf9dc9a7197d624e1352e48137ba Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 19:07:30 +1000 Subject: [PATCH] vault: install openbao-plugin-secrets-gitea on the storage role (#498) ## Why The new Gitea token secrets engine (`vault-plugin-secrets-gitea`, released v0.1.0) needs its plugin binary present on the OpenBao servers before terraform-vault can register it in the plugin catalog and mount it. This is the same install step already done for the rancher, gpg, and litellm secrets plugins. ## Change - Add `openbao-plugin-secrets-gitea` to `profiles::packages::include` on the vault storage role, pinned to `0.1.0` so the on-disk binary stays in lockstep with the sha256 that terraform-vault pins in its plugin catalog entry (`config/plugins/vault-plugin-secrets-gitea.yaml`). ## Order This is the first step. It must merge (and Puppet must run on the vault nodes to lay down the binary) before the terraform-vault engine PR is applied, or OpenBao cannot launch the plugin. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/498 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/storage/vault.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 7d6562b..b859480 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -38,3 +38,5 @@ profiles::packages::include: ensure: '0.1.0' openbao-plugin-secrets-rancher: ensure: '0.1.1' + openbao-plugin-secrets-gitea: + ensure: '0.1.0'