unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

vault: install openbao-plugin-secrets-gitea on the storage role #498

Merged
benvin merged 1 commits from benvin/openbao-plugin-gitea into develop 2026-07-27 19:07:31 +10:00
Conversation 0 Commits 1 Files Changed 1
+2
unkinben commented 2026-07-27 19:01:44 +10:00
Owner
Copy Link
Copy Source

Why

The new Gitea token secrets engine (vault-plugin-secrets-gitea, released v0.1.0) needs its plugin binary present on the OpenBao servers before terraform-vault can register it in the plugin catalog and mount it. This is the same install step already done for the rancher, gpg, and litellm secrets plugins.

Change

  • Add openbao-plugin-secrets-gitea to profiles::packages::include on the vault storage role, pinned to 0.1.0 so the on-disk binary stays in lockstep with the sha256 that terraform-vault pins in its plugin catalog entry (config/plugins/vault-plugin-secrets-gitea.yaml).

Order

This is the first step. It must merge (and Puppet must run on the vault nodes to lay down the binary) before the terraform-vault engine PR is applied, or OpenBao cannot launch the plugin.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why The new Gitea token secrets engine (`vault-plugin-secrets-gitea`, released v0.1.0) needs its plugin binary present on the OpenBao servers before terraform-vault can register it in the plugin catalog and mount it. This is the same install step already done for the rancher, gpg, and litellm secrets plugins. ## Change - Add `openbao-plugin-secrets-gitea` to `profiles::packages::include` on the vault storage role, pinned to `0.1.0` so the on-disk binary stays in lockstep with the sha256 that terraform-vault pins in its plugin catalog entry (`config/plugins/vault-plugin-secrets-gitea.yaml`). ## Order This is the first step. It must merge (and Puppet must run on the vault nodes to lay down the binary) before the terraform-vault engine PR is applied, or OpenBao cannot launch the plugin. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben added 1 commit 2026-07-27 19:01:44 +10:00
vault: install openbao-plugin-secrets-gitea on the storage role
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
3ec4783102 
Why: the new gitea token secrets engine (vault-plugin-secrets-gitea) needs
its plugin binary present on the OpenBao servers before terraform-vault can
register it in the catalog and mount it. This mirrors how the rancher, gpg,
and litellm secrets plugins are installed.

Change:
- Add openbao-plugin-secrets-gitea to profiles::packages::include on the vault
  storage role, pinned to 0.1.0 so the on-disk binary matches the sha256 that
  terraform-vault pins in its plugin catalog entry.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin merged commit 83f355cef4 into develop 2026-07-27 19:07:31 +10:00
benvin deleted branch benvin/openbao-plugin-gitea 2026-07-27 19:07:31 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#498
Delete Branch "benvin/openbao-plugin-gitea"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?