unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

vault: register vault-plugin-secrets-arrstack in the catalog (1/3) #125

Merged
benvin merged 1 commits from benvin/arrstack-register into master 2026-08-19 21:50:56 +10:00
Conversation 0 Commits 1 Files Changed 1
+13
unkin-agent commented 2026-08-19 21:42:49 +10:00
Member
Copy Link
Copy Source

Why

Splits the arrstack Vault engine work (was #124) into three independently-appliable PRs so registration, policy, and engine resources are never bundled. This is PR 1 of 3 (register).

Change

  • Registers the vault-plugin-secrets-arrstack plugin (v0.1.0) in the OpenBao plugin catalog via config/plugins/vault-plugin-secrets-arrstack.yaml.
  • sha256 pins the released v0.1.0 binary.
  • No wiring changes needed: the plugins glob and module.plugin already exist on master.

Apply order

Apply this after the Puppet plugin-install PR (unkin/puppet-prod #521, merged) has placed the binary at /opt/openbao-plugins/vault-plugin-secrets-arrstack on the OpenBao nodes. Registration fails until the binary is present on-node.

Stack

  1. register (this PR) -> benvin/arrstack-register off master
  2. policy -> benvin/arrstack-policy
  3. resources -> benvin/arrstack-resources

Supersedes #124.

## Why Splits the arrstack Vault engine work (was #124) into three independently-appliable PRs so registration, policy, and engine resources are never bundled. This is **PR 1 of 3 (register)**. ## Change - Registers the `vault-plugin-secrets-arrstack` plugin (v0.1.0) in the OpenBao plugin catalog via `config/plugins/vault-plugin-secrets-arrstack.yaml`. - `sha256` pins the released v0.1.0 binary. - No wiring changes needed: the `plugins` glob and `module.plugin` already exist on `master`. ## Apply order Apply this **after** the Puppet plugin-install PR (unkin/puppet-prod #521, merged) has placed the binary at `/opt/openbao-plugins/vault-plugin-secrets-arrstack` on the OpenBao nodes. Registration fails until the binary is present on-node. ## Stack 1. **register (this PR)** -> `benvin/arrstack-register` off `master` 2. policy -> `benvin/arrstack-policy` 3. resources -> `benvin/arrstack-resources` Supersedes #124.
unkin-agent added 1 commit 2026-08-19 21:42:49 +10:00
Register vault-plugin-secrets-arrstack in the plugin catalog
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
f0a61dc352 
Import the arrstack secrets plugin (v0.1.0) into the OpenBao plugin
catalog so later PRs can mount the engine. Registration is the first of
three stacked, independently-applied steps (register -> policy ->
resources) per the never-bundle rule.

The plugins map glob and module.plugin already exist, so this only adds
the catalog entry; the sha256 pins the released v0.1.0 binary.

Apply order: run this only AFTER the Puppet plugin-install PR (#521,
merged) has placed the binary at
/opt/openbao-plugins/vault-plugin-secrets-arrstack on the OpenBao nodes.
Registration fails until the binary is present.
benvin merged commit df0510e33b into master 2026-08-19 21:50:56 +10:00
benvin deleted branch benvin/arrstack-register 2026-08-19 21:50:56 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#125
Delete Branch "benvin/arrstack-register"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?