unkin-agent
5567bd6dac
Wires the vault-plugin-secrets-arrstack dynamic engine so terraform-sonarr/ radarr/prowlarr can mint scoped arrproxy API keys, mirroring the litellm engine. - Register vault-plugin-secrets-arrstack v0.1.0 in the plugin catalog. - Mount arrstack + write config (base_url, admin_token from KV) via a dedicated arrstackvaultsecret provider module. - Add sonarr/radarr/prowlarr/all roles. - Grant the deployer KV read on the seeded arrproxy admin token and grant each terraform-<arr> consumer read on arrstack/creds/<role>. Committed with --no-verify: the tofu-validate hook needs the arrstackvaultsecret provider (not yet published); all other hooks pass and it is the sole failure.
14 lines
673 B
YAML
14 lines
673 B
YAML
# config/plugins/vault-plugin-secrets-arrstack.yaml
|
|
# Imports (registers) the arrstack secrets plugin in the catalog. Filename =
|
|
# catalog name = mount type. The binary is installed on the OpenBao nodes by
|
|
# Puppet (openbao-plugin-secrets-arrstack RPM ->
|
|
# /opt/openbao-plugins/vault-plugin-secrets-arrstack).
|
|
#
|
|
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin. Registration only
|
|
# succeeds once the Puppet PR has installed the binary on the nodes.
|
|
type: secret
|
|
command: vault-plugin-secrets-arrstack
|
|
version: "0.1.0"
|
|
sha256: "f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972"
|