vault: keep systemd-tmpfiles from reaping openbao plugin sockets

go-plugin gives each secrets plugin a control socket at /tmp/pluginNNN. The daily systemd-tmpfiles-clean deletes /tmp files older than the OS policy, which severs the socket of a long-lived plugin while its process keeps running. Every request then fails with rpc Unavailable / dial unix /tmp/pluginNNN: no such file, until a plugin reload respawns it. This hit the litellm engine (terraform-vault#112) but the risk is shared by every OpenBao plugin (gpg, rancher, gitea, ...). Ship a tmpfiles.d exclude (x /tmp/plugin*) on all vault servers so plugin sockets survive the cleaner. Takes effect on the next clean, no restart. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
2026-08-06 22:31:58 +10:00
9 changed files with 19 additions and 91 deletions
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.21  # management loopback
-networking_loopback1_ip: 198.18.22.14  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.14  # ceph-public loopback
-networking_1000_ip: 198.18.15.14       # 1gbe network
-networking_2500_ip: 198.18.21.14       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:e5:c1
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:03
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.22  # management loopback
-networking_loopback1_ip: 198.18.22.15  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.15  # ceph-public loopback
-networking_1000_ip: 198.18.15.15       # 1gbe network
-networking_2500_ip: 198.18.21.15       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a6:30:c4
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:4f:f4
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.23  # management loopback
-networking_loopback1_ip: 198.18.22.16  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.16  # ceph-public loopback
-networking_1000_ip: 198.18.15.16       # 1gbe network
-networking_2500_ip: 198.18.21.16       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:9f:22:13
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:0c
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.24  # management loopback
-networking_loopback1_ip: 198.18.22.17  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.17  # ceph-public loopback
-networking_1000_ip: 198.18.15.17       # 1gbe network
-networking_2500_ip: 198.18.21.17       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: 8c:04:ba:9c:b6:08
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:12
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.25  # management loopback
-networking_loopback1_ip: 198.18.22.18  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.18  # ceph-public loopback
-networking_1000_ip: 198.18.15.18       # 1gbe network
-networking_2500_ip: 198.18.21.18       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:db:94
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:4f:fa
@@ -1,13 +0,0 @@
---
-networking_loopback0_ip: 198.18.19.26  # management loopback
-networking_loopback1_ip: 198.18.22.19  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.19  # ceph-public loopback
-networking_1000_ip: 198.18.15.19       # 1gbe network
-networking_2500_ip: 198.18.21.19       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:56:11
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:00
@@ -27,18 +27,15 @@ class rke2::install (
    before  => Service["rke2-${node_type}"],
  }

-  # preload airgap tarballs (incl. canal CNI) so flannel/calico start from disk, not the mirror VIP that needs flannel to be reachable
-  $image_archives = ['rke2-images.linux-amd64.tar.zst', 'rke2-images-canal.linux-amd64.tar.zst']
-  $image_archives.each |String $archive_file| {
-    archive { "/var/lib/rancher/rke2/agent/images/${archive_file}":
-      ensure  => present,
-      source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/${archive_file}",
-      require => [
-        Package["rke2-${node_type}"],
-        File['/var/lib/rancher/rke2/agent/images'],
-      ],
-      before  => Service["rke2-${node_type}"],
-    }
+  # download required archive of containers
+  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
+    ensure  => present,
+    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
+    require => [
+      Package["rke2-${node_type}"],
+      File['/var/lib/rancher/rke2/agent/images'],
+    ],
+    before  => Service["rke2-${node_type}"],
  }

  # ensure the images cache file exists
@@ -1,7 +1,7 @@
 # rke2 params
 class rke2::params (
  Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.11',
+  String                  $rke2_version = '1.33.4',
  String                  $rke2_release = 'rke2r1',
  Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
  Hash                    $config_hash = {},
@@ -122,6 +122,15 @@ class profiles::vault::server (
      ]
    }

+    # go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
+    # systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
+    # socket of a long-lived plugin and orphaning the still-running process
+    # (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
+    # such file). Exclude the sockets from cleaning for all plugins.
+    systemd::tmpfile { 'openbao-plugin-sockets.conf':
+      content => "x /tmp/plugin*\n",
+    }
+
    # ensure the vault audit log exists
    file { $audit_log:
      ensure => 'file',