Make gpg_secret_backend mount-only; plugin import split out

Plugin catalog registration now lives in its own module + config/plugins (see
the split-out PR), so this module no longer registers the plugin.

- Drop the vault_plugin resource and the sha256/command inputs; the mount now
  references the already-registered plugin type directly.
- Simplify config/gpg_secret_backend/gpg.yaml to just the mount description.

config/gpg_secret_backend/gpg.yaml

@@ -1,9 +1,4 @@
 # config/gpg_secret_backend/gpg.yaml
-# Registers the vault-plugin-secrets-gpg plugin and mounts it at "gpg".
+# Mounts the gpg secrets engine at "gpg". The plugin itself is registered in the
-# The binary is installed on the OpenBao nodes by Puppet
+# catalog separately (see config/plugins/vault-plugin-secrets-gpg.yaml).
-# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
-#
-# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
-# upgrade or OpenBao will refuse to launch the plugin.
 description: "GPG/OpenPGP secrets engine (sign/verify/encrypt/decrypt)"
-sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"

modules/vault_cluster/main.tf

@@ -341,8 +341,6 @@ module "gpg_secret_backend" {
 
   path        = each.key
   plugin      = each.value.plugin
-  command     = each.value.command
-  sha256      = each.value.sha256
   description = each.value.description
 }
 

modules/vault_cluster/modules/gpg_secret_backend/main.tf

@@ -1,20 +1,8 @@
-# Registers the GPG/OpenPGP secrets plugin in the catalog and mounts it. The
+# Mounts the gpg secrets engine. The plugin is registered ("imported") in the
-# plugin binary is installed on the OpenBao nodes by Puppet
+# catalog separately via the config/plugins/ discovery and the plugin module;
-# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg);
+# this module just enables a mount of the already-registered plugin type.
-# `command` is that filename, resolved relative to the server's plugin_directory.
-#
-# The sha256 is pinned here to the released binary. Puppet installs the RPM
-# floating, so on a plugin upgrade this sha256 must be bumped in lockstep or
-# OpenBao will refuse to launch the plugin.
-resource "vault_plugin" "this" {
-  type    = "secret"
-  name    = var.plugin
-  command = var.command
-  sha256  = var.sha256
-}
-
 resource "vault_mount" "this" {
   path        = var.path
-  type        = vault_plugin.this.name
+  type        = var.plugin
   description = var.description
 }

modules/vault_cluster/modules/gpg_secret_backend/variables.tf

@@ -4,22 +4,11 @@ variable "path" {
 }
 
 variable "plugin" {
-  description = "Name to register the plugin under in the catalog (also the mount type)"
+  description = "Registered plugin name to mount (the catalog name = mount type)"
   type        = string
   default     = "vault-plugin-secrets-gpg"
 }
 
-variable "command" {
-  description = "Plugin binary filename, relative to the server plugin_directory"
-  type        = string
-  default     = "vault-plugin-secrets-gpg"
-}
-
-variable "sha256" {
-  description = "SHA-256 of the installed plugin binary; must match the on-disk binary or OpenBao rejects it"
-  type        = string
-}
-
 variable "description" {
   description = "Human-friendly description of the mount"
   type        = string

modules/vault_cluster/variables.tf

@@ -316,11 +316,9 @@ variable "litellm_secret_backend_role" {
 }
 
 variable "gpg_secret_backend" {
-  description = "Map of GPG/OpenPGP secret engines to register + mount (path => plugin sha256 + config)"
+  description = "Map of GPG/OpenPGP secret engines to mount (path => registered plugin + description). The plugin is registered separately via config/plugins."
   type = map(object({
     plugin      = optional(string, "vault-plugin-secrets-gpg")
-    command     = optional(string, "vault-plugin-secrets-gpg")
-    sha256      = string
     description = optional(string)
   }))
   default = {}