unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Pin openbao secrets plugins to exact versions #492

Merged
benvin merged 1 commits from benvin/pin-openbao-plugin-versions into develop 2026-07-20 23:46:37 +10:00
Conversation 0 Commits 1 Files Changed 1
+9 -3
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/storage/vault.yaml
+9 -3
View File
@@ -27,8 +27,14 @@ profiles::nginx::simpleproxy::proxy_port: 8200
profiles::nginx::simpleproxy::proxy_path: '/'
profiles::packages::include:
# openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
openbao-plugins: {}
openbao-plugin-secrets-litellm: {}
openbao-plugin-secrets-gpg: {}
# Secrets plugins pinned to the exact version whose binary matches the sha256
# registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
# on upgrade, or OpenBao refuses to launch the plugin after a restart.
openbao-plugin-secrets-litellm:
ensure: '0.1.1'
openbao-plugin-secrets-gpg:
ensure: '0.1.0'
openbao-plugin-secrets-rancher:
ensure: latest
ensure: '0.1.1'