unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1) #488

Merged
benvin merged 1 commits from benvin/rancher-plugin-latest into develop 2026-07-18 17:01:15 +10:00
Conversation 0 Commits 1 Files Changed 1
+2 -1
unkinben commented 2026-07-18 16:36:40 +10:00
Owner
Copy Link
Copy Source

Why

The vault nodes have rancher plugin v0.1.0, which mints non-functional tokens (returns status.value not status.bearerToken; every cred/rotation 401s). v0.1.1 fixes it. ensure_packages defaults to present, which won't upgrade an already-installed package, so pin to latest to pull v0.1.1.

Changes

  • openbao-plugin-secrets-rancher: { ensure: latest } on the vault storage role.

Note

latest will also pull future releases automatically — keep the terraform-vault catalog sha256 (config/plugins/vault-plugin-secrets-rancher.yaml) bumped in lockstep, or a vault restart after a future upgrade will fail the sha check. Happy to pin to an exact version instead if you'd prefer lockstep-by-pin.

## Why The vault nodes have rancher plugin v0.1.0, which mints non-functional tokens (returns `status.value` not `status.bearerToken`; every cred/rotation 401s). v0.1.1 fixes it. `ensure_packages` defaults to `present`, which won't upgrade an already-installed package, so pin to `latest` to pull v0.1.1. ## Changes - `openbao-plugin-secrets-rancher: { ensure: latest }` on the vault storage role. ## Note `latest` will also pull future releases automatically — keep the terraform-vault catalog sha256 (`config/plugins/vault-plugin-secrets-rancher.yaml`) bumped in lockstep, or a vault restart after a future upgrade will fail the sha check. Happy to pin to an exact version instead if you'd prefer lockstep-by-pin.
unkinben added 1 commit 2026-07-18 16:36:40 +10:00
Upgrade openbao-plugin-secrets-rancher to latest (v0.1.1 bearerToken fix)
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ccc4cdb091 
v0.1.0 is already installed on the vault nodes but mints non-functional tokens.
ensure_packages defaults to 'present', which will not upgrade it, so pin ensure
to 'latest' to pull v0.1.1.

- openbao-plugin-secrets-rancher: ensure => latest on the vault storage role.
benvin merged commit 4230370418 into develop 2026-07-18 17:01:15 +10:00
benvin deleted branch benvin/rancher-plugin-latest 2026-07-18 17:01:15 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#488
Delete Branch "benvin/rancher-plugin-latest"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?