unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Install openbao-plugin-secrets-gpg on vault nodes #480

Merged
benvin merged 1 commits from benvin/openbao-plugin-gpg into develop 2026-07-16 22:48:08 +10:00
Conversation 0 Commits 1 Files Changed 1
+1
unkinben commented 2026-07-16 22:43:34 +10:00
Owner
Copy Link
Copy Source

Deploy the GPG/OpenPGP secrets engine to the OpenBao (vault-role) cluster by installing its plugin RPM into /opt/openbao-plugins, mirroring the existing openbao-plugin-secrets-litellm deployment (#479).

  • Add openbao-plugin-secrets-gpg to profiles::packages::include in the vault role hiera. The RPM ships from artifactapi rpm-internal (built on the vault-plugin-secrets-gpg v0.1.0 tag) and lands the plugin binary in the node's configured plugin_directory.

Registering + enabling the secrets backend (plugin register / secrets enable) is a follow-up terraform-vault change, matching how litellm is wired.

Deploy the GPG/OpenPGP secrets engine to the OpenBao (vault-role) cluster by installing its plugin RPM into `/opt/openbao-plugins`, mirroring the existing `openbao-plugin-secrets-litellm` deployment (#479). - Add `openbao-plugin-secrets-gpg` to `profiles::packages::include` in the vault role hiera. The RPM ships from artifactapi `rpm-internal` (built on the [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) v0.1.0 tag) and lands the plugin binary in the node's configured `plugin_directory`. Registering + enabling the secrets backend (`plugin register` / `secrets enable`) is a follow-up terraform-vault change, matching how litellm is wired.
unkinben added 1 commit 2026-07-16 22:43:34 +10:00
chore: install openbao-plugin-secrets-gpg on vault nodes
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
c8cc60fdb8 
Deploy the GPG/OpenPGP secrets engine to the OpenBao (vault-role) cluster by
installing its plugin RPM into /opt/openbao-plugins, mirroring the existing
openbao-plugin-secrets-litellm deployment. The RPM ships from artifactapi
rpm-internal (built on the vault-plugin-secrets-gpg v0.1.0 tag).

Registering/enabling the backend is a separate terraform-vault change.
benvin merged commit 0702676da6 into develop 2026-07-16 22:48:08 +10:00
benvin deleted branch benvin/openbao-plugin-gpg 2026-07-16 22:48:08 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#480
Delete Branch "benvin/openbao-plugin-gpg"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?