From d859daead422d474393e5dd700804dc222a610b9 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 01:11:02 +1000 Subject: [PATCH] vault: install netbox and apptoken OpenBao plugin RPMs on bao nodes (#519) ## Why terraform-vault #115 registers `vault-plugin-secrets-netbox` in the OpenBao plugin catalog pinned to the released v0.1.0 binary's sha256. OpenBao only registers/mounts a plugin whose binary is physically present in the plugin_directory (`/opt/openbao-plugins`); the `openbao-plugin-secrets-netbox` RPM is published on rpm-internal but not yet installed on the bao nodes, so #115 fails to register until Puppet lays the binary down. The `openbao-plugin-secrets-apptoken` binary is likewise published but missing from the bao package list, deferred from the apptoken engine's earlier deploy follow-up. ## Changes - Add `openbao-plugin-secrets-netbox` (pinned `0.1.0`) to the bao node `profiles::packages::include` list - Add `openbao-plugin-secrets-apptoken` (pinned `0.1.0`) to the same list, alongside the existing gpg/litellm/rancher/gitea plugin RPMs - Both install to `/opt/openbao-plugins`, matching the plugin_directory OpenBao reads and the sha256 registered in terraform-vault ## Ordering This must apply (Puppet converge on the `roles::infra::storage::vault` nodes) BEFORE terraform-vault #115 is applied, otherwise #115's catalog registration fails on a missing binary. Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/519 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- hieradata/roles/infra/storage/vault.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index b859480..37f8fae 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -40,3 +40,7 @@ profiles::packages::include: ensure: '0.1.1' openbao-plugin-secrets-gitea: ensure: '0.1.0' + openbao-plugin-secrets-apptoken: + ensure: '0.1.0' + openbao-plugin-secrets-netbox: + ensure: '0.1.0'