From a69318b62dd20d9b7527273249d24eff7ee51eb8 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 20 Jul 2026 23:46:36 +1000 Subject: [PATCH] Pin openbao secrets plugins to exact versions (#492) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why `ensure: present`/`latest` lets the plugin binaries drift from the sha256 pinned in the terraform-vault catalog (`config/plugins/*.yaml`). On the next OpenBao restart, a drifted binary fails the sha check and the plugin won't launch — a latent footgun (hit exactly this with rancher on `ensure: latest`). ## Changes Pin each secrets plugin to the version whose binary matches its registered catalog sha (all verified against the RPMs in rpm-internal): - `openbao-plugin-secrets-litellm`: **0.1.1** (sha 2263ebcb…) - `openbao-plugin-secrets-gpg`: **0.1.0** (sha 0e92d740…) - `openbao-plugin-secrets-rancher`: **0.1.1** (sha 9e597cd9…; was `ensure: latest`) All three are no-op on the binary (installed versions already match) — this just locks them so a future release can't silently upgrade the binary out of lockstep with the catalog. `openbao-plugins` (base bundle) left unpinned — its version couldn't be verified from the tooling side and it tracks the openbao package, not a catalog sha. ## Note To upgrade a plugin in future: bump the RPM version here **and** the catalog sha256 in terraform-vault in the same change, then `vault write sys/plugins/reload/backend plugin=`. --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/492 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/storage/vault.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 06d5df7..7d6562b 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -27,8 +27,14 @@ profiles::nginx::simpleproxy::proxy_port: 8200 profiles::nginx::simpleproxy::proxy_path: '/' profiles::packages::include: + # openbao-plugins (base bundle) left unpinned; it tracks the openbao package. openbao-plugins: {} - openbao-plugin-secrets-litellm: {} - openbao-plugin-secrets-gpg: {} + # Secrets plugins pinned to the exact version whose binary matches the sha256 + # registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep + # on upgrade, or OpenBao refuses to launch the plugin after a restart. + openbao-plugin-secrets-litellm: + ensure: '0.1.1' + openbao-plugin-secrets-gpg: + ensure: '0.1.0' openbao-plugin-secrets-rancher: - ensure: latest + ensure: '0.1.1'