unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Pin plugin-backed mounts to their catalog version #171

Merged
benvin merged 2 commits from benvin/plugin-version-pin into master 2026-10-23 22:55:05 +11:00
Conversation 2 Commits 2 Files Changed 6
+76
unkin-agent commented 2026-10-23 22:41:37 +11:00
Member
Copy Link
Copy Source

Plugin-backed mounts keep their pinned plugin_version when a catalog yaml bumps version, so the old catalog entry is deregistered while the mount still points at it and the backend fails to start on the next leader change.

  • add mount_plugin_version module tuning sys/mounts/<path>/tune to the catalog yaml version for each plugin-backed mount
  • register new plugin versions before deregistering old ones (create_before_destroy)
  • document the post-bump backend reload in the arrstack plugin yaml
  • document that a versioned plugin yaml must keep version (removing it strands the mount on the old version)
Plugin-backed mounts keep their pinned `plugin_version` when a catalog yaml bumps `version`, so the old catalog entry is deregistered while the mount still points at it and the backend fails to start on the next leader change. - add `mount_plugin_version` module tuning `sys/mounts/<path>/tune` to the catalog yaml version for each plugin-backed mount - register new plugin versions before deregistering old ones (`create_before_destroy`) - document the post-bump backend reload in the arrstack plugin yaml - document that a versioned plugin yaml must keep `version` (removing it strands the mount on the old version)
unkin-agent added 1 commit 2026-10-23 22:41:37 +11:00
Pin plugin-backed mounts to their catalog version
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
2aa96a793b
unkin-agent commented 2026-10-23 22:47:58 +11:00
Author
Member
Copy Link
Copy Source
  • nit: modules/vault_cluster/main.tf:418 — dropping version from a versioned plugin yaml removes the pin instance (no-op via disable_delete) while CBD deregisters the versioned entry, leaving the mount pinned to a missing version (tune rejects an empty plugin_version, so it cannot be unpinned) → add a precondition or yaml comment that a versioned plugin must stay versioned / needs a manual remount
- nit: modules/vault_cluster/main.tf:418 — dropping `version` from a versioned plugin yaml removes the pin instance (no-op via `disable_delete`) while CBD deregisters the versioned entry, leaving the mount pinned to a missing version (tune rejects an empty `plugin_version`, so it cannot be unpinned) → add a precondition or yaml comment that a versioned plugin must stay versioned / needs a manual remount
unkin-agent added 1 commit 2026-10-23 22:50:19 +11:00
Note that versioned plugins must stay versioned
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
429ca16d0f
unkin-agent commented 2026-10-23 22:54:18 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit cc298526e9 into master 2026-10-23 22:55:05 +11:00
benvin deleted branch benvin/plugin-version-pin 2026-10-23 22:55:05 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#171
Delete Branch "benvin/plugin-version-pin"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?