unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-vault:9c4d20da9e994530f0442dadd194c8dfb6a9f40b
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/rancher-secrets-engine unkin/terraform-vault:benvin/rancher-plugin-import unkin/terraform-vault:benvin/rancher-deployer-policy unkin/terraform-vault:benvin/import-litellm-plugin unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access
..
compare: unkin/terraform-vault:benvin/rancher-plugin-import
Branches Tags
unkin/terraform-vault:benvin/rancher-secrets-engine unkin/terraform-vault:benvin/rancher-plugin-import unkin/terraform-vault:benvin/rancher-deployer-policy unkin/terraform-vault:master unkin/terraform-vault:benvin/import-litellm-plugin unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access

2 Commits
9c4d20da9e .. benvin/rancher-plugin-import

Author SHA1 Message Date
Ben Vincent 3fe5806ff5 Import (register) the rancher plugin in the catalog
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details 
Registers the released v0.1.0 rancher secrets plugin in the OpenBao plugin
catalog so it can be mounted. The binary is laid down on the vault nodes by
Puppet (openbao-plugin-secrets-rancher RPM).

- Add config/plugins/vault-plugin-secrets-rancher.yaml (type=secret,
  command=vault-plugin-secrets-rancher, sha256 pinned to the released binary).
 2026-07-17 23:38:13 +10:00
unkinben 933de177fa Register + mount the GPG secrets engine at gpg/ (#87)
ci/woodpecker/push/apply Pipeline was successful
Details 
Complete the deploy of the [vault-plugin-secrets-gpg](https://git.unkin.net/unkin/vault-plugin-secrets-gpg) engine. Puppet ([puppet-prod #480](unkin/puppet-prod#480)) installs the `openbao-plugin-secrets-gpg` RPM onto the OpenBao nodes; this registers that binary in the plugin catalog and enables the secrets engine so `gpg/` is actually usable.

- Add a `gpg_secret_backend` module using the standard `hashicorp/vault` provider (already required at 5.6.0): `vault_plugin` (catalog register with a pinned sha256) + `vault_mount` (enable at the mount path).
- Wire it through `vault_cluster` (new `gpg_secret_backend` variable + module block) and the config discovery (`config.hcl` group + syd1 terragrunt input), mirroring `litellm_secret_backend`.
- Add `config/gpg_secret_backend/gpg.yaml` mounting at `gpg/` and pinning the released v0.1.0 binary sha256 (`0e92d740…a7b20`, extracted from the published RPM). Puppet installs the RPM floating, so this sha must be bumped in lockstep on any plugin upgrade or OpenBao rejects the binary.

Validated locally with `tofu validate` + `tofu fmt`. Granting non-root access to `gpg/*` (auth roles + policies) is a follow-up scoped to whoever consumes the engine (e.g. passv from CI).

Reviewed-on: #87
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
 2026-07-17 23:19:38 +10:00
1 changed files with 11 additions and 0 deletions
Expand all files Collapse all files
config/plugins/vault-plugin-secrets-rancher.yaml
+11
View File
@@ -0,0 +1,11 @@
# config/plugins/vault-plugin-secrets-rancher.yaml
# Imports (registers) the rancher secrets plugin in the catalog. Filename =
# catalog name = mount type. The binary is installed on the OpenBao nodes by
# Puppet (openbao-plugin-secrets-rancher RPM ->
# /opt/openbao-plugins/vault-plugin-secrets-rancher).
#
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
# upgrade or OpenBao will refuse to launch the plugin.
type: secret
command: vault-plugin-secrets-rancher
sha256: "d2b17f45b5fa9e6549443fec3ba22f17ef575d2d811c14324187dc9904ec574a"