unkinben
a69318b62d
## Why `ensure: present`/`latest` lets the plugin binaries drift from the sha256 pinned in the terraform-vault catalog (`config/plugins/*.yaml`). On the next OpenBao restart, a drifted binary fails the sha check and the plugin won't launch — a latent footgun (hit exactly this with rancher on `ensure: latest`). ## Changes Pin each secrets plugin to the version whose binary matches its registered catalog sha (all verified against the RPMs in rpm-internal): - `openbao-plugin-secrets-litellm`: **0.1.1** (sha 2263ebcb…) - `openbao-plugin-secrets-gpg`: **0.1.0** (sha 0e92d740…) - `openbao-plugin-secrets-rancher`: **0.1.1** (sha 9e597cd9…; was `ensure: latest`) All three are no-op on the binary (installed versions already match) — this just locks them so a future release can't silently upgrade the binary out of lockstep with the catalog. `openbao-plugins` (base bundle) left unpinned — its version couldn't be verified from the tooling side and it tracks the openbao package, not a catalog sha. ## Note To upgrade a plugin in future: bump the RPM version here **and** the catalog sha256 in terraform-vault in the same change, then `vault write sys/plugins/reload/backend plugin=<name>`. --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #492 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
---
|
|
profiles::vault::server::members_role: roles::infra::storage::vault
|
|
profiles::vault::server::members_lookup: true
|
|
profiles::vault::server::data_dir: /data/vault
|
|
profiles::vault::server::plugin_dir: /opt/openbao-plugins
|
|
profiles::vault::server::manage_storage_dir: true
|
|
profiles::vault::server::tls_disable: false
|
|
profiles::vault::server::package_name: openbao
|
|
profiles::vault::server::package_ensure: 2.4.4
|
|
profiles::vault::server::disable_openbao: false
|
|
|
|
# additional altnames
|
|
profiles::pki::vault::alt_names:
|
|
- vault.main.unkin.net
|
|
- vault.service.consul
|
|
- vault.service.consul
|
|
- vault
|
|
|
|
# manage a simple nginx reverse proxy
|
|
profiles::nginx::simpleproxy::nginx_vhost: 'vault.service.consul'
|
|
profiles::nginx::simpleproxy::nginx_aliases:
|
|
- vault.main.unkin.net
|
|
- vault
|
|
profiles::nginx::simpleproxy::proxy_scheme: 'http'
|
|
profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
|
|
profiles::nginx::simpleproxy::proxy_port: 8200
|
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
|
|
|
profiles::packages::include:
|
|
# openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
|
|
openbao-plugins: {}
|
|
# Secrets plugins pinned to the exact version whose binary matches the sha256
|
|
# registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
|
|
# on upgrade, or OpenBao refuses to launch the plugin after a restart.
|
|
openbao-plugin-secrets-litellm:
|
|
ensure: '0.1.1'
|
|
openbao-plugin-secrets-gpg:
|
|
ensure: '0.1.0'
|
|
openbao-plugin-secrets-rancher:
|
|
ensure: '0.1.1'
|