vault: install netbox and apptoken OpenBao plugin RPMs on bao nodes #519

Merged

benvin merged 1 commits from benvin/vault-plugin-netbox into develop 2026-08-09 01:11:02 +10:00

Conversation 0 Commits 1 Files Changed 1

+4

unkinben commented 2026-08-09 00:58:58 +10:00

Owner

Copy Link

Copy Source

Why

terraform-vault #115 registers vault-plugin-secrets-netbox in the OpenBao plugin catalog pinned to the released v0.1.0 binary's sha256. OpenBao only registers/mounts a plugin whose binary is physically present in the plugin_directory (/opt/openbao-plugins); the openbao-plugin-secrets-netbox RPM is published on rpm-internal but not yet installed on the bao nodes, so #115 fails to register until Puppet lays the binary down. The openbao-plugin-secrets-apptoken binary is likewise published but missing from the bao package list, deferred from the apptoken engine's earlier deploy follow-up.

Changes

• Add openbao-plugin-secrets-netbox (pinned 0.1.0) to the bao node profiles::packages::include list
• Add openbao-plugin-secrets-apptoken (pinned 0.1.0) to the same list, alongside the existing gpg/litellm/rancher/gitea plugin RPMs
• Both install to /opt/openbao-plugins, matching the plugin_directory OpenBao reads and the sha256 registered in terraform-vault

Ordering

This must apply (Puppet converge on the roles::infra::storage::vault nodes) BEFORE terraform-vault #115 is applied, otherwise #115's catalog registration fails on a missing binary.

## Why terraform-vault #115 registers `vault-plugin-secrets-netbox` in the OpenBao plugin catalog pinned to the released v0.1.0 binary's sha256. OpenBao only registers/mounts a plugin whose binary is physically present in the plugin_directory (`/opt/openbao-plugins`); the `openbao-plugin-secrets-netbox` RPM is published on rpm-internal but not yet installed on the bao nodes, so #115 fails to register until Puppet lays the binary down. The `openbao-plugin-secrets-apptoken` binary is likewise published but missing from the bao package list, deferred from the apptoken engine's earlier deploy follow-up. ## Changes - Add `openbao-plugin-secrets-netbox` (pinned `0.1.0`) to the bao node `profiles::packages::include` list - Add `openbao-plugin-secrets-apptoken` (pinned `0.1.0`) to the same list, alongside the existing gpg/litellm/rancher/gitea plugin RPMs - Both install to `/opt/openbao-plugins`, matching the plugin_directory OpenBao reads and the sha256 registered in terraform-vault ## Ordering This must apply (Puppet converge on the `roles::infra::storage::vault` nodes) BEFORE terraform-vault #115 is applied, otherwise #115's catalog registration fails on a missing binary.

unkinben added 1 commit 2026-08-09 00:58:58 +10:00

vault: install netbox and apptoken OpenBao plugin RPMs on bao nodes ... 5b68967f48

terraform-vault #115 registers vault-plugin-secrets-netbox in the plugin
catalog, but OpenBao only registers a plugin whose binary is physically
present in plugin_directory (/opt/openbao-plugins); the netbox RPM is
published on rpm-internal but not yet installed, so #115 fails to register
until Puppet lays the binary down. The apptoken engine's binary is likewise
published but missing from the bao package list, deferred from its earlier
deploy follow-up.

- Add openbao-plugin-secrets-netbox (0.1.0) to the bao node package list
- Add openbao-plugin-secrets-apptoken (0.1.0) to the bao node package list

benvin merged commit d859daead4 into develop 2026-08-09 01:11:02 +10:00

benvin deleted branch benvin/vault-plugin-netbox 2026-08-09 01:11:02 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#519