vault: install netbox and apptoken OpenBao plugin RPMs on bao nodes (#519)

## Why

terraform-vault #115 registers `vault-plugin-secrets-netbox` in the OpenBao plugin catalog pinned to the released v0.1.0 binary's sha256. OpenBao only registers/mounts a plugin whose binary is physically present in the plugin_directory (`/opt/openbao-plugins`); the `openbao-plugin-secrets-netbox` RPM is published on rpm-internal but not yet installed on the bao nodes, so #115 fails to register until Puppet lays the binary down. The `openbao-plugin-secrets-apptoken` binary is likewise published but missing from the bao package list, deferred from the apptoken engine's earlier deploy follow-up.

## Changes

- Add `openbao-plugin-secrets-netbox` (pinned `0.1.0`) to the bao node `profiles::packages::include` list
- Add `openbao-plugin-secrets-apptoken` (pinned `0.1.0`) to the same list, alongside the existing gpg/litellm/rancher/gitea plugin RPMs
- Both install to `/opt/openbao-plugins`, matching the plugin_directory OpenBao reads and the sha256 registered in terraform-vault

## Ordering

This must apply (Puppet converge on the `roles::infra::storage::vault` nodes) BEFORE terraform-vault #115 is applied, otherwise #115's catalog registration fails on a missing binary.

Reviewed-on: #519
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

This commit was merged in pull request #519.

This commit is contained in:

Ben Vincent

2026-08-09 01:11:02 +10:00

committed by

BenVincent

parent 0fd01ac1a7

commit d859daead4

1 changed files with 4 additions and 0 deletions

									
										hieradata/roles/infra/storage/vault.yaml
									
		+4
		
												View File
												
				@@ -40,3 +40,7 @@ profiles::packages::include:

				    ensure: '0.1.1'

				  openbao-plugin-secrets-gitea:

				    ensure: '0.1.0'

				  openbao-plugin-secrets-apptoken:

				    ensure: '0.1.0'

				  openbao-plugin-secrets-netbox:

				    ensure: '0.1.0'