From 03e9baf17f4e60eb04c219b9e00c01f834f30241 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 14:47:08 +1000 Subject: [PATCH] Register the rancher plugin in the catalog (import) (#92) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Register the released v0.1.0 rancher secrets plugin so the engine can be mounted. Uses the existing config/plugins discovery + plugin module (added for gpg in #89). Mirrors #90 (litellm import). ## Changes - Add `config/plugins/vault-plugin-secrets-rancher.yaml` (`type: secret`, `command: vault-plugin-secrets-rancher`, `sha256` pinned to the released binary `d2b17f45…ec574a`, verified against both the vault and openbao v0.1.0 RPMs). ## Merge order Part 2 of 4. Requires the binary on disk (puppet-prod install) and the deployer policy (#91). Merge before the backend PR. --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/92 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- config/plugins/vault-plugin-secrets-rancher.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 config/plugins/vault-plugin-secrets-rancher.yaml diff --git a/config/plugins/vault-plugin-secrets-rancher.yaml b/config/plugins/vault-plugin-secrets-rancher.yaml new file mode 100644 index 0000000..5fc2d1d --- /dev/null +++ b/config/plugins/vault-plugin-secrets-rancher.yaml @@ -0,0 +1,11 @@ +# config/plugins/vault-plugin-secrets-rancher.yaml +# Imports (registers) the rancher secrets plugin in the catalog. Filename = +# catalog name = mount type. The binary is installed on the OpenBao nodes by +# Puppet (openbao-plugin-secrets-rancher RPM -> +# /opt/openbao-plugins/vault-plugin-secrets-rancher). +# +# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM +# upgrade or OpenBao will refuse to launch the plugin. +type: secret +command: vault-plugin-secrets-rancher +sha256: "d2b17f45b5fa9e6549443fec3ba22f17ef575d2d811c14324187dc9904ec574a"