From f1b6751257ec8f846489d21ef1ff6f293ccbd844 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 12:59:28 +1000 Subject: [PATCH] Register the netbox secrets plugin in the catalog Why: - The netbox secrets engine cannot be mounted until its plugin binary is registered in the OpenBao catalog, so the catalog entry must land before any engine mount or role config references it. How: - Add config/plugins/vault-plugin-secrets-netbox.yaml registering the plugin as a secret plugin, pinned to the released v0.1.0 binary sha256 that Puppet installs on the OpenBao nodes. Bump the sha in lockstep with any RPM upgrade. --- config/plugins/vault-plugin-secrets-netbox.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 config/plugins/vault-plugin-secrets-netbox.yaml diff --git a/config/plugins/vault-plugin-secrets-netbox.yaml b/config/plugins/vault-plugin-secrets-netbox.yaml new file mode 100644 index 0000000..9ff80c1 --- /dev/null +++ b/config/plugins/vault-plugin-secrets-netbox.yaml @@ -0,0 +1,11 @@ +# config/plugins/vault-plugin-secrets-netbox.yaml +# Imports (registers) the netbox secrets plugin in the catalog. Filename = +# catalog name = mount type. The binary is installed on the OpenBao nodes by +# Puppet (openbao-plugin-secrets-netbox RPM -> +# /opt/openbao-plugins/vault-plugin-secrets-netbox). +# +# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM +# upgrade or OpenBao will refuse to launch the plugin. +type: secret +command: vault-plugin-secrets-netbox +sha256: "362b7f6c9e21179ad51d2d810684d9387fe50e3a1887f171700122a0b2a05cef" -- 2.47.3