unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

vault: stop systemd-tmpfiles reaping openbao plugin sockets #508

Closed
unkinben wants to merge 1 commits from benvin/openbao-plugin-socket-tmpfiles into develop
pull from: benvin/openbao-plugin-socket-tmpfiles
merge into: unkin:develop
Conversation 1 Commits 1 Files Changed 1
+9

1 Commits

Author SHA1 Message Date
unkinben 5e8cff921c vault: keep systemd-tmpfiles from reaping openbao plugin sockets
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details 
go-plugin gives each secrets plugin a control socket at /tmp/pluginNNN.
The daily systemd-tmpfiles-clean deletes /tmp files older than the OS
policy, which severs the socket of a long-lived plugin while its process
keeps running. Every request then fails with rpc Unavailable / dial unix
/tmp/pluginNNN: no such file, until a plugin reload respawns it. This hit
the litellm engine (terraform-vault#112) but the risk is shared by every
OpenBao plugin (gpg, rancher, gitea, ...).

Ship a tmpfiles.d exclude (x /tmp/plugin*) on all vault servers so plugin
sockets survive the cleaner. Takes effect on the next clean, no restart.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
 2026-08-06 22:31:58 +10:00