unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Make gpg_secret_backend mount-only; plugin import split out
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details

Browse Source 
Plugin catalog registration now lives in its own module + config/plugins (see
the split-out PR), so this module no longer registers the plugin.

- Drop the vault_plugin resource and the sha256/command inputs; the mount now
  references the already-registered plugin type directly.
- Simplify config/gpg_secret_backend/gpg.yaml to just the mount description.
This commit is contained in:
Ben Vincent
2026-07-17 23:00:21 +10:00
parent e90070b9a0
commit ea8daea587
5 changed files with 8 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/gpg_secret_backend/gpg.yaml
+2 -7
View File
@@ -1,9 +1,4 @@
# config/gpg_secret_backend/gpg.yaml
# Registers the vault-plugin-secrets-gpg plugin and mounts it at "gpg".
# The binary is installed on the OpenBao nodes by Puppet
# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
#
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
# upgrade or OpenBao will refuse to launch the plugin.
# Mounts the gpg secrets engine at "gpg". The plugin itself is registered in the
# catalog separately (see config/plugins/vault-plugin-secrets-gpg.yaml).
description: "GPG/OpenPGP secrets engine (sign/verify/encrypt/decrypt)"
sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"