unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Add a plugin-import module + config/plugins for catalog registration #89

Merged
benvin merged 1 commits from benvin/vault-plugin-import into master 2026-07-17 23:08:05 +10:00
Conversation 0 Commits 1 Files Changed 8
+90
unkinben commented 2026-07-17 22:58:49 +10:00
Owner
Copy Link
Copy Source

Split plugin catalog registration out of the per-engine backend modules into its own concern (previously bundled into #87's gpg_secret_backend).

Changes

  • New generic plugin module (vault_plugin: type/name/command/sha256/plugin_version) that imports a binary into the catalog.
  • New config/plugins/ discovery group (filename = catalog name = mount type), wired through vault_cluster (plugins variable + module) and the syd1 environment.
  • config/plugins/vault-plugin-secrets-gpg.yaml pins the released v0.1.0 binary sha256 (0e92d740…a7b20, from the published RPM). Puppet installs the RPM floating, so bump this in lockstep on upgrade.

Any engine now registers its plugin by dropping a file in config/plugins/; its *_secret_backend module just mounts the registered type.

Needs the deployer's plugin-catalog access (#88). Merge order: #88 → this → #87.

Split plugin catalog registration out of the per-engine backend modules into its own concern (previously bundled into #87's gpg_secret_backend). ## Changes - New generic `plugin` module (`vault_plugin`: type/name/command/sha256/plugin_version) that imports a binary into the catalog. - New `config/plugins/` discovery group (filename = catalog name = mount type), wired through `vault_cluster` (`plugins` variable + module) and the syd1 environment. - `config/plugins/vault-plugin-secrets-gpg.yaml` pins the released v0.1.0 binary sha256 (`0e92d740…a7b20`, from the published RPM). Puppet installs the RPM floating, so bump this in lockstep on upgrade. Any engine now registers its plugin by dropping a file in `config/plugins/`; its `*_secret_backend` module just mounts the registered type. Needs the deployer's plugin-catalog access (#88). Merge order: **#88 → this → #87**.
unkinben added 1 commit 2026-07-17 22:58:49 +10:00
Add a plugin-import module + config/plugins for catalog registration
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
0287a87db7 
Registering a plugin in the catalog is a distinct concern from mounting an
engine, so give it its own module and config directory instead of folding
sha256/command into each engine's backend module.

- Add a generic 'plugin' module (vault_plugin: type/name/command/sha256/
  plugin_version) that imports a binary into the catalog.
- Add a config/plugins/ discovery group (filename = catalog name) and wire it
  through vault_cluster (plugins variable + module) and the syd1 environment.
- Add config/plugins/vault-plugin-secrets-gpg.yaml pinning the released v0.1.0
  binary sha256. Other engines can now register their plugin by dropping a file
  here; their *_secret_backend module just mounts the registered type.
benvin merged commit 3d59758324 into master 2026-07-17 23:08:05 +10:00
benvin deleted branch benvin/vault-plugin-import 2026-07-17 23:08:05 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#89
Delete Branch "benvin/vault-plugin-import"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?