unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

vault: register ghp plugin in the catalog (config/plugins only) #123

Merged
benvin merged 1 commits from benvin/ghp-vault-plugin-catalog into master 2026-08-16 15:43:18 +10:00
Conversation 0 Commits 1 Files Changed 1
+11
unkin-agent commented 2026-08-16 15:41:06 +10:00
Member
Copy Link
Copy Source

Why: step 3 of the ordered ghp plugin add — register vault-plugin-secrets-ghp in the OpenBao plugin catalog as its own atomic change, before the engine is mounted/configured.

How: add config/plugins/vault-plugin-secrets-ghp.yaml (type: secret; sha256 pins the v0.1.0 binary installed by puppet-prod#520). config/plugins/* is generically discovered by config.hcl, so this is the only file. Catalog import is covered by the shared sudo-protected sys/plugins/catalog grant.

Order: puppet-prod#520 (install) -> terraform-vault#122 (config-write policy, merged) -> this (catalog) -> terraform-vault#121 (mount + config + role).

Why: step 3 of the ordered ghp plugin add — register vault-plugin-secrets-ghp in the OpenBao plugin catalog as its own atomic change, before the engine is mounted/configured. How: add config/plugins/vault-plugin-secrets-ghp.yaml (type: secret; sha256 pins the v0.1.0 binary installed by puppet-prod#520). config/plugins/* is generically discovered by config.hcl, so this is the only file. Catalog import is covered by the shared sudo-protected sys/plugins/catalog grant. Order: puppet-prod#520 (install) -> terraform-vault#122 (config-write policy, merged) -> **this** (catalog) -> terraform-vault#121 (mount + config + role).
unkin-agent added 1 commit 2026-08-16 15:41:07 +10:00
vault: register ghp plugin in the catalog (config/plugins only)
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
7866b0c9d6 
Step 3 of the ordered ghp plugin add: import vault-plugin-secrets-ghp into the
OpenBao secret plugin catalog (type secret, sha256 pins the v0.1.0 binary that
puppet-prod#520 installs). config/plugins/* is generically discovered, so this is
the sole file. Catalog import uses the shared sudo-protected
sys/plugins/catalog grant; no per-engine policy needed here.

Must apply AFTER the binary is installed (puppet#520) and BEFORE the engine
resources (#121) mount+configure it.
benvin merged commit 5084a53015 into master 2026-08-16 15:43:18 +10:00
benvin deleted branch benvin/ghp-vault-plugin-catalog 2026-08-16 15:43:18 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#123
Delete Branch "benvin/ghp-vault-plugin-catalog"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?