unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

vault: install openbao-plugin-secrets-ghp on OpenBao nodes #520

Merged
benvin merged 1 commits from benvin/vault-plugin-ghp into develop 2026-08-16 14:47:59 +10:00
Conversation 0 Commits 1 Files Changed 1
+2
unkin-agent commented 2026-08-16 14:42:43 +10:00
Member
Copy Link
Copy Source

Why: step 1 of adding the ghp Vault secrets engine — the plugin binary must be on the OpenBao nodes before terraform-vault registers it in the catalog (the catalog sha256 pins this exact build).

How: pin openbao-plugin-secrets-ghp ensure 0.1.0 in hieradata/roles/infra/storage/vault.yaml profiles::packages::include, alongside the other secrets plugins.

Ordering: this merges + puppet-applies first; then the config-write policy; then the terraform-vault engine resources (terraform-vault#121).

Why: step 1 of adding the ghp Vault secrets engine — the plugin binary must be on the OpenBao nodes before terraform-vault registers it in the catalog (the catalog sha256 pins this exact build). How: pin `openbao-plugin-secrets-ghp` ensure 0.1.0 in hieradata/roles/infra/storage/vault.yaml profiles::packages::include, alongside the other secrets plugins. Ordering: this merges + puppet-applies first; then the config-write policy; then the terraform-vault engine resources (terraform-vault#121).
unkin-agent added 1 commit 2026-08-16 14:42:43 +10:00
vault: pin openbao-plugin-secrets-ghp on the OpenBao nodes
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
98b4352d8c 
Installs the ghp secrets-engine plugin binary (v0.1.0) into /opt/openbao-plugins
so terraform-vault can register it in the catalog (sha256 pinned in
config/plugins/vault-plugin-secrets-ghp.yaml). First of the ordered plugin-add
steps: install via puppet -> config-write policy -> engine resources.
benvin merged commit 2a329058c0 into develop 2026-08-16 14:47:59 +10:00
benvin deleted branch benvin/vault-plugin-ghp 2026-08-16 14:47:59 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#520
Delete Branch "benvin/vault-plugin-ghp"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?