ensure: present/latest let the plugin binaries drift from the sha256 pinned in
the terraform-vault catalog (config/plugins/*.yaml); on the next OpenBao restart
a drifted binary fails the sha check and the plugin won't launch. Pin each to
the version whose binary matches its registered sha (all verified against the
RPMs):
- openbao-plugin-secrets-litellm: 0.1.1 (sha 2263ebcb…)
- openbao-plugin-secrets-gpg: 0.1.0 (sha 0e92d740…)
- openbao-plugin-secrets-rancher: 0.1.1 (sha 9e597cd9…; was ensure: latest)
openbao-plugins (base bundle) left unpinned.
Ben Vincent