go-plugin creates each secrets plugin's control socket under the process
TMPDIR (/tmp/pluginNNN by default). The daily systemd-tmpfiles-clean
deletes aged /tmp files, severing the socket of a long-lived plugin while
its process keeps running, so every request fails with rpc Unavailable /
dial unix /tmp/pluginNNN: no such file until a reload respawns it. This
took out the litellm engine (terraform-vault#112); the risk is shared by
every OpenBao plugin (gpg, rancher, gitea, ...).
Add a vault.service drop-in setting TMPDIR to a per-start RuntimeDirectory
on /run (tmpfs, no age-based cleanup), so plugin sockets can never be
reaped. The drop-in notifies a vault restart so the new TMPDIR takes
effect and plugins respawn with sockets under /run.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Replace deprecated dalen-puppetdbquery module with native puppetdb_query
function using PQL syntax to resolve URI.escape compatibility issues.
This is required to migrated to Puppet 8 (and kubernetes).
Changes:
- Remove dalen-puppetdbquery dependency from Puppetfile
- Replace query_nodes() calls with puppetdb_query() using PQL syntax
- Update 27 function calls across 18 Puppet manifests
- Maintain equivalent functionality with improved compatibility
Reviewed-on: #457
- vault 18.2 rpm produced by rpmbuilder repo
- ensure the /etc/vault directory is managed
- ensure service file is managed by puppet
- ensure package comes from unkin repo (not hashicorp)
- disable_mlock as unprivileged containers cannot use mlock
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/264
- add vault module to puppetfile
- define class to manage the install and config of vault
- manage the datavol and raft storage
- manage the unzip and other compression tools
- define custom unseal script and service
- add documentation on initial setup of vault
unkinben