From 0287a87db7880bb99d174f389acd7b4140736b90 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Fri, 17 Jul 2026 22:58:30 +1000 Subject: [PATCH] Add a plugin-import module + config/plugins for catalog registration Registering a plugin in the catalog is a distinct concern from mounting an engine, so give it its own module and config directory instead of folding sha256/command into each engine's backend module. - Add a generic 'plugin' module (vault_plugin: type/name/command/sha256/ plugin_version) that imports a binary into the catalog. - Add a config/plugins/ discovery group (filename = catalog name) and wire it through vault_cluster (plugins variable + module) and the syd1 environment. - Add config/plugins/vault-plugin-secrets-gpg.yaml pinning the released v0.1.0 binary sha256. Other engines can now register their plugin by dropping a file here; their *_secret_backend module just mounts the registered type. --- config/config.hcl | 7 +++++ config/plugins/vault-plugin-secrets-gpg.yaml | 10 +++++++ environments/au/syd1/terragrunt.hcl | 1 + modules/vault_cluster/main.tf | 12 +++++++++ modules/vault_cluster/modules/plugin/main.tf | 12 +++++++++ .../vault_cluster/modules/plugin/terraform.tf | 9 +++++++ .../vault_cluster/modules/plugin/variables.tf | 27 +++++++++++++++++++ modules/vault_cluster/variables.tf | 12 +++++++++ 8 files changed, 90 insertions(+) create mode 100644 config/plugins/vault-plugin-secrets-gpg.yaml create mode 100644 modules/vault_cluster/modules/plugin/main.tf create mode 100644 modules/vault_cluster/modules/plugin/terraform.tf create mode 100644 modules/vault_cluster/modules/plugin/variables.tf diff --git a/config/config.hcl b/config/config.hcl index 03b25d7..5ca4f26 100644 --- a/config/config.hcl +++ b/config/config.hcl @@ -198,5 +198,12 @@ locals { }) if startswith(file_path, "litellm_secret_backend_role/") } + plugins = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => merge(content, { + name = trimsuffix(basename(file_path), ".yaml") + }) + if startswith(file_path, "plugins/") + } } } diff --git a/config/plugins/vault-plugin-secrets-gpg.yaml b/config/plugins/vault-plugin-secrets-gpg.yaml new file mode 100644 index 0000000..5583d4c --- /dev/null +++ b/config/plugins/vault-plugin-secrets-gpg.yaml @@ -0,0 +1,10 @@ +# config/plugins/vault-plugin-secrets-gpg.yaml +# Imports (registers) the gpg secrets plugin in the catalog. Filename = catalog +# name = mount type. The binary is installed on the OpenBao nodes by Puppet +# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg). +# +# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM +# upgrade or OpenBao will refuse to launch the plugin. +type: secret +command: vault-plugin-secrets-gpg +sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20" diff --git a/environments/au/syd1/terragrunt.hcl b/environments/au/syd1/terragrunt.hcl index 7b59f0e..e481db7 100644 --- a/environments/au/syd1/terragrunt.hcl +++ b/environments/au/syd1/terragrunt.hcl @@ -70,6 +70,7 @@ inputs = { pki_mount_only = local.config.pki_mount_only litellm_secret_backend = local.config.litellm_secret_backend litellm_secret_backend_role = local.config.litellm_secret_backend_role + plugins = local.config.plugins # Pass policy maps to vault_cluster module policy_auth_map = local.policies.policy_auth_map diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf index 80c4023..f2bdbf5 100644 --- a/modules/vault_cluster/main.tf +++ b/modules/vault_cluster/main.tf @@ -334,6 +334,18 @@ module "litellm_secret_backend_role" { depends_on = [module.litellm_secret_backend] } +module "plugin" { + source = "./modules/plugin" + + for_each = var.plugins + + name = each.value.name + type = each.value.type + command = each.value.command + sha256 = each.value.sha256 + plugin_version = each.value.version +} + module "vault_policy" { source = "./modules/vault_policy" diff --git a/modules/vault_cluster/modules/plugin/main.tf b/modules/vault_cluster/modules/plugin/main.tf new file mode 100644 index 0000000..2d27cfb --- /dev/null +++ b/modules/vault_cluster/modules/plugin/main.tf @@ -0,0 +1,12 @@ +# Registers ("imports") a plugin binary in the Vault/OpenBao plugin catalog so +# it can be mounted. The binary must already exist in the server +# plugin_directory (installed out of band, e.g. by Puppet); `command` is its +# filename there. The sha256 must match the on-disk binary or the server refuses +# to launch the plugin. +resource "vault_plugin" "this" { + type = var.type + name = var.name + command = coalesce(var.command, var.name) + sha256 = var.sha256 + version = var.plugin_version +} diff --git a/modules/vault_cluster/modules/plugin/terraform.tf b/modules/vault_cluster/modules/plugin/terraform.tf new file mode 100644 index 0000000..ce22437 --- /dev/null +++ b/modules/vault_cluster/modules/plugin/terraform.tf @@ -0,0 +1,9 @@ +terraform { + required_version = ">= 1.10" + required_providers { + vault = { + source = "hashicorp/vault" + version = "5.6.0" + } + } +} diff --git a/modules/vault_cluster/modules/plugin/variables.tf b/modules/vault_cluster/modules/plugin/variables.tf new file mode 100644 index 0000000..83fff8b --- /dev/null +++ b/modules/vault_cluster/modules/plugin/variables.tf @@ -0,0 +1,27 @@ +variable "name" { + description = "Name to register the plugin under in the catalog (also the mount type)" + type = string +} + +variable "type" { + description = "Plugin type: secret, auth or database" + type = string + default = "secret" +} + +variable "command" { + description = "Plugin binary filename relative to the server plugin_directory. Defaults to the plugin name." + type = string + default = null +} + +variable "sha256" { + description = "SHA-256 of the installed plugin binary; must match the on-disk binary" + type = string +} + +variable "plugin_version" { + description = "Optional plugin version to register the catalog entry under" + type = string + default = null +} diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf index 157bd99..ebd03a7 100644 --- a/modules/vault_cluster/variables.tf +++ b/modules/vault_cluster/variables.tf @@ -315,6 +315,18 @@ variable "litellm_secret_backend_role" { default = {} } +variable "plugins" { + description = "Map of plugins to import (register) in the catalog, keyed by catalog name" + type = map(object({ + name = string + type = optional(string, "secret") + command = optional(string) + sha256 = string + version = optional(string) + })) + default = {} +} + variable "policy_auth_map" { description = "Map of auth mounts -> auth roles -> policy names" type = map(map(list(string))) -- 2.47.3