From f0a61dc35211c7bca5c5ce6de034ddeb5daac6cf Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Wed, 19 Aug 2026 21:37:57 +1000 Subject: [PATCH] Register vault-plugin-secrets-arrstack in the plugin catalog Import the arrstack secrets plugin (v0.1.0) into the OpenBao plugin catalog so later PRs can mount the engine. Registration is the first of three stacked, independently-applied steps (register -> policy -> resources) per the never-bundle rule. The plugins map glob and module.plugin already exist, so this only adds the catalog entry; the sha256 pins the released v0.1.0 binary. Apply order: run this only AFTER the Puppet plugin-install PR (#521, merged) has placed the binary at /opt/openbao-plugins/vault-plugin-secrets-arrstack on the OpenBao nodes. Registration fails until the binary is present. --- config/plugins/vault-plugin-secrets-arrstack.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 config/plugins/vault-plugin-secrets-arrstack.yaml diff --git a/config/plugins/vault-plugin-secrets-arrstack.yaml b/config/plugins/vault-plugin-secrets-arrstack.yaml new file mode 100644 index 0000000..fc92851 --- /dev/null +++ b/config/plugins/vault-plugin-secrets-arrstack.yaml @@ -0,0 +1,13 @@ +# config/plugins/vault-plugin-secrets-arrstack.yaml +# Imports (registers) the arrstack secrets plugin in the catalog. Filename = +# catalog name = mount type. The binary is installed on the OpenBao nodes by +# Puppet (openbao-plugin-secrets-arrstack RPM -> +# /opt/openbao-plugins/vault-plugin-secrets-arrstack). +# +# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM +# upgrade or OpenBao will refuse to launch the plugin. Registration only +# succeeds once the Puppet PR has installed the binary on the nodes. +type: secret +command: vault-plugin-secrets-arrstack +version: "0.1.0" +sha256: "f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972" -- 2.47.3