From 9891311d523a986f1cee3050f191fb76c6c53ce5 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 11:20:02 +1000 Subject: [PATCH] Install openbao-plugin-secrets-rancher on vault nodes (#483) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The Rancher token secrets engine needs its plugin binary present in the OpenBao plugin directory before terraform-vault can register/mount it. Mirrors #480 (gpg). ## Changes - Add `openbao-plugin-secrets-rancher` to `profiles::packages::include` on the vault storage role. Installs the RPM (from rpm-internal) to `/opt/openbao-plugins/vault-plugin-secrets-rancher`. ## Merge order Part 3 of 4 — merge first (binary must exist on disk before the terraform-vault plugin-import #92 registers it with a matching sha256). --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/483 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/storage/vault.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 4f716f7..25a7961 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -30,3 +30,4 @@ profiles::packages::include: openbao-plugins: {} openbao-plugin-secrets-litellm: {} openbao-plugin-secrets-gpg: {} + openbao-plugin-secrets-rancher: {}