vault: keep systemd-tmpfiles from reaping openbao plugin sockets

go-plugin gives each secrets plugin a control socket at /tmp/pluginNNN.
The daily systemd-tmpfiles-clean deletes /tmp files older than the OS
policy, which severs the socket of a long-lived plugin while its process
keeps running. Every request then fails with rpc Unavailable / dial unix
/tmp/pluginNNN: no such file, until a plugin reload respawns it. This hit
the litellm engine (terraform-vault#112) but the risk is shared by every
OpenBao plugin (gpg, rancher, gitea, ...).

Ship a tmpfiles.d exclude (x /tmp/plugin*) on all vault servers so plugin
sockets survive the cleaner. Takes effect on the next clean, no restart.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

hieradata/nodes/prodnxsr0014.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.21  # management loopback
-networking_loopback1_ip: 198.18.22.14  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.14  # ceph-public loopback
-networking_1000_ip: 198.18.15.14       # 1gbe network
-networking_2500_ip: 198.18.21.14       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:e5:c1
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:03

hieradata/nodes/prodnxsr0015.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.22  # management loopback
-networking_loopback1_ip: 198.18.22.15  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.15  # ceph-public loopback
-networking_1000_ip: 198.18.15.15       # 1gbe network
-networking_2500_ip: 198.18.21.15       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a6:30:c4
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:4f:f4

hieradata/nodes/prodnxsr0016.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.23  # management loopback
-networking_loopback1_ip: 198.18.22.16  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.16  # ceph-public loopback
-networking_1000_ip: 198.18.15.16       # 1gbe network
-networking_2500_ip: 198.18.21.16       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:9f:22:13
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:0c

hieradata/nodes/prodnxsr0017.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.24  # management loopback
-networking_loopback1_ip: 198.18.22.17  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.17  # ceph-public loopback
-networking_1000_ip: 198.18.15.17       # 1gbe network
-networking_2500_ip: 198.18.21.17       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: 8c:04:ba:9c:b6:08
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:12

hieradata/nodes/prodnxsr0018.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.25  # management loopback
-networking_loopback1_ip: 198.18.22.18  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.18  # ceph-public loopback
-networking_1000_ip: 198.18.15.18       # 1gbe network
-networking_2500_ip: 198.18.21.18       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:db:94
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:4f:fa

hieradata/nodes/prodnxsr0019.main.unkin.net.yaml

@@ -1,13 +0,0 @@
----
-networking_loopback0_ip: 198.18.19.26  # management loopback
-networking_loopback1_ip: 198.18.22.19  # ceph-cluster loopback
-networking_loopback2_ip: 198.18.23.19  # ceph-public loopback
-networking_1000_ip: 198.18.15.19       # 1gbe network
-networking_2500_ip: 198.18.21.19       # 2.5gbe network
-networking_1000_iface: enp1s0
-networking_2500_iface: enp2s0
-networking::interfaces:
-  "%{hiera('networking_1000_iface')}":
-    mac: a4:bb:6d:a4:56:11
-  "%{hiera('networking_2500_iface')}":
-    mac: c4:62:37:0d:50:00

modules/rke2/manifests/install.pp

@@ -27,18 +27,15 @@ class rke2::install (
     before  => Service["rke2-${node_type}"],
   }
 
-  # preload airgap tarballs (incl. canal CNI) so flannel/calico start from disk, not the mirror VIP that needs flannel to be reachable
+  # download required archive of containers
-  $image_archives = ['rke2-images.linux-amd64.tar.zst', 'rke2-images-canal.linux-amd64.tar.zst']
+  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
-  $image_archives.each |String $archive_file| {
+    ensure  => present,
-    archive { "/var/lib/rancher/rke2/agent/images/${archive_file}":
+    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
-      ensure  => present,
+    require => [
-      source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/${archive_file}",
+      Package["rke2-${node_type}"],
-      require => [
+      File['/var/lib/rancher/rke2/agent/images'],
-        Package["rke2-${node_type}"],
+    ],
-        File['/var/lib/rancher/rke2/agent/images'],
+    before  => Service["rke2-${node_type}"],
-      ],
-      before  => Service["rke2-${node_type}"],
-    }
   }
 
   # ensure the images cache file exists

modules/rke2/manifests/params.pp

@@ -1,7 +1,7 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.11',
+  String                  $rke2_version = '1.33.4',
   String                  $rke2_release = 'rke2r1',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},

site/profiles/manifests/vault/server.pp

@@ -122,6 +122,15 @@ class profiles::vault::server (
       ]
     }
 
+    # go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
+    # systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
+    # socket of a long-lived plugin and orphaning the still-running process
+    # (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
+    # such file). Exclude the sockets from cleaning for all plugins.
+    systemd::tmpfile { 'openbao-plugin-sockets.conf':
+      content => "x /tmp/plugin*\n",
+    }
+
     # ensure the vault audit log exists
     file { $audit_log:
       ensure => 'file',