unkin-agent
6c489c6003
ci/woodpecker/push/apply Pipeline was successful
## Why The v0.2.0 arrstack plugin binary is live on all five OpenBao nodes (RPM applied via post-merge puppet runs), and the catalog still pins the v0.1.0 sha — OpenBao refuses to launch a plugin whose binary hash does not match the catalog entry. ## Changes - `config/plugins/vault-plugin-secrets-arrstack.yaml`: `version` -> `0.2.0` and `sha256` -> `9ea7f160…12fa1`, computed from the binary extracted from `openbao-plugin-secrets-arrstack-0.2.0-1.x86_64.rpm` (the same RPM puppet pins). ## Post-apply Run `vault plugin reload -plugin=vault-plugin-secrets-arrstack` after the apply so the running mount swaps to the v0.2.0 binary. Reviewed-on: #144 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
14 lines
673 B
YAML
14 lines
673 B
YAML
# config/plugins/vault-plugin-secrets-arrstack.yaml
|
|
# Imports (registers) the arrstack secrets plugin in the catalog. Filename =
|
|
# catalog name = mount type. The binary is installed on the OpenBao nodes by
|
|
# Puppet (openbao-plugin-secrets-arrstack RPM ->
|
|
# /opt/openbao-plugins/vault-plugin-secrets-arrstack).
|
|
#
|
|
# sha256 pins the released v0.2.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin. Registration only
|
|
# succeeds once the Puppet PR has installed the binary on the nodes.
|
|
type: secret
|
|
command: vault-plugin-secrets-arrstack
|
|
version: "0.2.0"
|
|
sha256: "9ea7f16013b3bcbadfcb15b08fd1545f8069893cf864bfdaa57e7e7e72612fa1"
|