From 5084a530151c597ef1966112b8c7a5d23de94731 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 16 Aug 2026 15:43:18 +1000 Subject: [PATCH] vault: register ghp plugin in the catalog (config/plugins only) (#123) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: step 3 of the ordered ghp plugin add — register vault-plugin-secrets-ghp in the OpenBao plugin catalog as its own atomic change, before the engine is mounted/configured. How: add config/plugins/vault-plugin-secrets-ghp.yaml (type: secret; sha256 pins the v0.1.0 binary installed by puppet-prod#520). config/plugins/* is generically discovered by config.hcl, so this is the only file. Catalog import is covered by the shared sudo-protected sys/plugins/catalog grant. Order: puppet-prod#520 (install) -> terraform-vault#122 (config-write policy, merged) -> **this** (catalog) -> terraform-vault#121 (mount + config + role). Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/123 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- config/plugins/vault-plugin-secrets-ghp.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 config/plugins/vault-plugin-secrets-ghp.yaml diff --git a/config/plugins/vault-plugin-secrets-ghp.yaml b/config/plugins/vault-plugin-secrets-ghp.yaml new file mode 100644 index 0000000..b8ea4cd --- /dev/null +++ b/config/plugins/vault-plugin-secrets-ghp.yaml @@ -0,0 +1,11 @@ +# config/plugins/vault-plugin-secrets-ghp.yaml +# Imports (registers) the ghp secrets plugin in the catalog. Filename = +# catalog name = mount type. The binary is installed on the OpenBao nodes by +# Puppet (openbao-plugin-secrets-ghp RPM -> +# /opt/openbao-plugins/vault-plugin-secrets-ghp). +# +# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM +# upgrade or OpenBao will refuse to launch the plugin. +type: secret +command: vault-plugin-secrets-ghp +sha256: "85761421cd532788ed28fb57e93d3868f3577320a538289936d9ed3be5f396de"