From dcc73131a40fe65b39693cfcf1afe277e8ec1883 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 22:59:35 +1000 Subject: [PATCH] Bump rancher plugin catalog to v0.1.1 (bearerToken fix) (#96) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why v0.1.0 of the rancher plugin minted non-functional tokens — it returned `status.value` (the secret fragment) instead of `status.bearerToken` (`ext/:`), so every cred and every root rotation 401'd against Rancher. Fixed in plugin v0.1.1 (PR #2, released). ## Changes - `config/plugins/vault-plugin-secrets-rancher.yaml` sha256 → v0.1.1 binary `9e597cd9…d5955` (verified against both v0.1.1 RPMs). Re-registers the catalog entry so OpenBao launches the fixed binary. ## Deploy coordination 1. Puppet installs the v0.1.1 RPM on the vault nodes (separate puppet-prod PR). 2. Merge this → apply re-registers the catalog with the new sha. 3. `vault plugin reload -plugin=vault-plugin-secrets-rancher` so the running plugin swaps to v0.1.1 (its sha must match this catalog entry). --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/96 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- config/plugins/vault-plugin-secrets-rancher.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/plugins/vault-plugin-secrets-rancher.yaml b/config/plugins/vault-plugin-secrets-rancher.yaml index 5fc2d1d..64bac42 100644 --- a/config/plugins/vault-plugin-secrets-rancher.yaml +++ b/config/plugins/vault-plugin-secrets-rancher.yaml @@ -4,8 +4,8 @@ # Puppet (openbao-plugin-secrets-rancher RPM -> # /opt/openbao-plugins/vault-plugin-secrets-rancher). # -# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM +# sha256 pins the released v0.1.1 binary; bump it in lockstep with any RPM # upgrade or OpenBao will refuse to launch the plugin. type: secret command: vault-plugin-secrets-rancher -sha256: "d2b17f45b5fa9e6549443fec3ba22f17ef575d2d811c14324187dc9904ec574a" +sha256: "9e597cd9512a0629f940141dc6611bf95eaf165abcb52470eee027bf467d5955"