From 4d112ad67f5d5ef715a0ccbc4067ed86252dc8f7 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 20 Jul 2026 23:42:05 +1000 Subject: [PATCH] Pin openbao secrets plugins to exact versions (lockstep with catalog sha) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ensure: present/latest let the plugin binaries drift from the sha256 pinned in the terraform-vault catalog (config/plugins/*.yaml); on the next OpenBao restart a drifted binary fails the sha check and the plugin won't launch. Pin each to the version whose binary matches its registered sha (all verified against the RPMs): - openbao-plugin-secrets-litellm: 0.1.1 (sha 2263ebcb…) - openbao-plugin-secrets-gpg: 0.1.0 (sha 0e92d740…) - openbao-plugin-secrets-rancher: 0.1.1 (sha 9e597cd9…; was ensure: latest) openbao-plugins (base bundle) left unpinned. --- hieradata/roles/infra/storage/vault.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml index 06d5df7..7d6562b 100644 --- a/hieradata/roles/infra/storage/vault.yaml +++ b/hieradata/roles/infra/storage/vault.yaml @@ -27,8 +27,14 @@ profiles::nginx::simpleproxy::proxy_port: 8200 profiles::nginx::simpleproxy::proxy_path: '/' profiles::packages::include: + # openbao-plugins (base bundle) left unpinned; it tracks the openbao package. openbao-plugins: {} - openbao-plugin-secrets-litellm: {} - openbao-plugin-secrets-gpg: {} + # Secrets plugins pinned to the exact version whose binary matches the sha256 + # registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep + # on upgrade, or OpenBao refuses to launch the plugin after a restart. + openbao-plugin-secrets-litellm: + ensure: '0.1.1' + openbao-plugin-secrets-gpg: + ensure: '0.1.0' openbao-plugin-secrets-rancher: - ensure: latest + ensure: '0.1.1' -- 2.47.3