unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Install openbao-plugin-secrets-arrstack v0.1.0 #521

Merged
benvin merged 1 commits from benvin/openbao-plugin-secrets-arrstack into develop 2026-08-18 23:21:45 +10:00
Conversation 0 Commits 1 Files Changed 1
+2
unkin-agent commented 2026-08-18 23:11:48 +10:00
Member
Copy Link
Copy Source

Why

The new openbao-plugin-secrets-arrstack OpenBao secrets engine mints dynamic per-service arrproxy machine tokens for the arrstack (Sonarr/Radarr/Prowlarr) fleet. Its v0.1.0 RPM is now published in artifactapi (rpm-internal), so the OpenBao VM nodes can install the plugin binary into /opt/openbao-plugins.

Changes

  • Add openbao-plugin-secrets-arrstack pinned to 0.1.0 to profiles::packages::include in hieradata/roles/infra/storage/vault.yaml, matching the existing pinned sibling plugins (litellm, gpg, rancher, gitea, apptoken, netbox, ghp).

This PR only installs the RPM binary on the nodes. Catalog registration is handled separately by terraform-vault (config/plugins/*.yaml).

Reference

Plugin binary sha256 (used by the terraform-vault catalog registration, separate PR):

f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972
## Why The new `openbao-plugin-secrets-arrstack` OpenBao secrets engine mints dynamic per-service arrproxy machine tokens for the arrstack (Sonarr/Radarr/Prowlarr) fleet. Its v0.1.0 RPM is now published in artifactapi (rpm-internal), so the OpenBao VM nodes can install the plugin binary into `/opt/openbao-plugins`. ## Changes - Add `openbao-plugin-secrets-arrstack` pinned to `0.1.0` to `profiles::packages::include` in `hieradata/roles/infra/storage/vault.yaml`, matching the existing pinned sibling plugins (litellm, gpg, rancher, gitea, apptoken, netbox, ghp). This PR only installs the RPM binary on the nodes. Catalog registration is handled separately by terraform-vault (`config/plugins/*.yaml`). ## Reference Plugin binary sha256 (used by the terraform-vault catalog registration, separate PR): ``` f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972 ```
unkin-agent added 1 commit 2026-08-18 23:11:48 +10:00
Install openbao-plugin-secrets-arrstack v0.1.0
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
fea81790bc 
Add the openbao-plugin-secrets-arrstack RPM to the OpenBao VM nodes so the
new secrets engine binary is present in /opt/openbao-plugins for catalog
registration by terraform-vault.
benvin merged commit 7e1f2c336c into develop 2026-08-18 23:21:45 +10:00
benvin deleted branch benvin/openbao-plugin-secrets-arrstack 2026-08-18 23:21:45 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#521
Delete Branch "benvin/openbao-plugin-secrets-arrstack"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?