Import (register) the rancher plugin in the catalog

Registers the released v0.1.0 rancher secrets plugin in the OpenBao plugin
catalog so it can be mounted. The binary is laid down on the vault nodes by
Puppet (openbao-plugin-secrets-rancher RPM).

- Add config/plugins/vault-plugin-secrets-rancher.yaml (type=secret,
  command=vault-plugin-secrets-rancher, sha256 pinned to the released binary).

config/plugins/vault-plugin-secrets-rancher.yaml

@@ -0,0 +1,11 @@
+# config/plugins/vault-plugin-secrets-rancher.yaml
+# Imports (registers) the rancher secrets plugin in the catalog. Filename =
+# catalog name = mount type. The binary is installed on the OpenBao nodes by
+# Puppet (openbao-plugin-secrets-rancher RPM ->
+# /opt/openbao-plugins/vault-plugin-secrets-rancher).
+#
+# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
+# upgrade or OpenBao will refuse to launch the plugin.
+type: secret
+command: vault-plugin-secrets-rancher
+sha256: "d2b17f45b5fa9e6549443fec3ba22f17ef575d2d811c14324187dc9904ec574a"

policies/rancher/admin.yaml

@@ -1,55 +0,0 @@
-# Allow the vault deployer to import the rancher plugin and manage its engine
-# (config, seeded service accounts, and roles).
-#
-# terraform-vault registers the plugin itself (vault_plugin -> sys/plugins/catalog,
-# a sudo-protected path) and manages the engine via the ranchervaultsecret
-# provider, so the deployer needs catalog access on top of the mount access it
-# already has (sys/mounts/*). Without this, apply 403s on the plugin
-# registration and on rancher/{config,service-accounts,roles} writes.
----
-rules:
-  # Import / register (and deregister) the rancher plugin in the catalog.
-  - path: "sys/plugins/catalog/secret/vault-plugin-secrets-rancher"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-      - sudo
-  # Engine connection config.
-  - path: "rancher/config"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-  # Seeded, auto-rotated service-account tokens (+ manual rotate).
-  - path: "rancher/service-accounts/*"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-      - list
-  - path: "rancher/service-accounts"
-    capabilities:
-      - read
-      - list
-  # Token-minting roles.
-  - path: "rancher/roles/*"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-      - list
-  - path: "rancher/roles"
-    capabilities:
-      - read
-      - list
-
-auth:
-  approle:
-    - tf_vault
-  k8s/au/syd1:
-    - woodpecker_terraform_vault